What Pair Coding Actually Looks Like
A real Semgrep session with a human, an agent, and the evidence we kept — including the parts that went wrong.
Security engineering · AI agents · evidence
I build tools that make agent capabilities legible.
I'm Bo Kaung — a builder, breaker, and defender working on AI agent security. I write about what I find, including the parts that went wrong.
Writing
Latest posts
Your Agent's Skills Are Code. Audit Them.
Introducing SkillTriage, a static security auditor for AI agent skills and Claude Code plugins, mapped to the OWASP Agentic Skills Top 10.
Elsewhere