MurphyA/hacker-news huggingface dataset:
Lessons from securing AI systems at runtime (agents, MCPs, LLMs)
by joyjeetdan | 2026-02-06 09:25:59+00:00
Over the last year, we noticed a pattern while working with teams deploying AI in production.

The hard problems weren’t model choice or prompt quality.
They showed up after deployment.

Agents started calling tools nobody remembered wiring up.
LLMs accessed internal APIs through chains that weren’t obvious from logs.
Execution identity diverged from user identity.
MCP servers became quiet but critical control planes.

Most existing security assumptions break in these scenarios because they assume:

static services

clear ownership

single-hop execution

pre-defined boundaries

AI systems violate all of those.

We recently spent a week documenting and shipping solutions around runtime visibility and governance for AI systems, focusing on how agents, MCP servers, APIs, and models actually behave once live.

Instead of high-level frameworks, we tried to answer practical questions:

What exists right now?

Who is acting on whose behalf?

What tools are being invoked, and in what sequence?

Where does data flow during real executions?

We wrote up the learnings and what we built here:
https://www.levo.ai/resources/product-release/launch-week-2026-recap

Not posting this as a “launch”, more as a discussion starter.
Curious how others are thinking about securing AI systems once they stop being demos and start being infrastructure.
by lelanthran | 2026-02-06 09:26:01+00:00
> Anyone can pick up some CAD software and design a house if they so desire. Is the town going to let you build it without a certified engineer/architect signing off? Fuck no. But we don't lock down CAD software.

No, we lock down using that output from the CAD software in the real world.

> And presumably, mission critical software is still going to be stamped off on by a certified engineer of some sort.

The "mission critical" qualifier is new to your analogy, but is irrelevant anyway - the analogy breaks because, while you can do what you like with CAD software on your own PC, that output never gets used outside of your PC without careful and multiple levels of review, while in the s/ware case, there is no review.
by Shubham_Amb | 2026-02-06 09:26:02+00:00
Thanks, that's a good point. I completely forgot to add the specs to the readme

For context, I built this on my local rig (RTX 3080 10GB, Ryzen 5, 16GB RAM).

I also tested the backend on Lightning AI (T4 GPU) to make sure it wasn't just working on my machine. I'll update the readme now.
by jbstack | 2026-02-06 09:26:52+00:00
Also there's always the risk that the bolt cutter has a defect (perhaps deliberately introduced at some point when it was manufactured) which will cause you more damage than the thing you're trying to prevent by carrying it.

I'm personally a bit wary of introducing a relatively obscure security tool into my setup, to protect against a rare possible attack. The chance that I'll get caught copy-pasting a compromised URL into my terminal is fairly small, and there's also a small chance I'll compromise my system either now or at some later point via a supply chain attack if I use the tool. Which chance is bigger?
by 999900000999 | 2026-02-06 09:27:00+00:00
At which point did someone force OP to use GH Actions ?

It's fantastic for simple jobs, I use it for my hobbyist projects because I just need 20 to 30 lines to build and deploy a web build.

Just because a bike isn't good for traveling in freezing weather doesn't mean no one should own a bike.

Pick the right tool for the job.

Plus CI/CD is the boring part. I always imagined GH Actions as a quick and somewhat sloppy solution for hobbyist projects.

Not for anything serious.
by pfannkuchen | 2026-02-06 09:27:27+00:00
Most of the corruption I have in mind comes from the banking system and the system of government bribery we euphemistically call “lobbying”.

If we positively mandate full reserve free banking with no central bank and no state issued currency, that would eliminate I think all of the banking corruption I have in mind. I’m not sure about usury under the classical definition, if we run into problems still that might have to go too (though I do see downsides to innovation because loans are like crack cocaine for innovation, complete with the overdose deaths).

Lobbying is more difficult to make illegal because influence is much more nuanced than first-order* banking and influence will route around basically any protections given enough time. But today we don’t even try to make it illegal. Perhaps a meta-scheme where the lobbying rules periodically change according to some secret sequence could disrupt things enough to make it difficult to route around.

* First order in the sense that much of the complexity comes from playing with the primitives we have today and not from the primitives themselves, and the primitives I prefer are much clunkier to play with.
by zahlman | 2026-02-06 09:27:34+00:00
> Instead, it let's you run safely run Python code written by an LLM embedded in your agent, with startup times measured in single digit microseconds not hundreds of milliseconds.

Perhaps if the interpreter is in turn embedded in the executable and runs in-process, but even a do-nothing `uv` invocation takes ~10ms on my system.

I like the idea of a minimal implementation like this, though. I hadn't even considered it from an AI sandboxing perspective; I just liked the idea of a stdlib-less alternative upon which better-thought-out "core" libraries could be stacked, with less disk footprint.

Have to say I didn't expect it to come out of Pydantic.
by fuzzfactor | 2026-02-06 09:27:50+00:00
The way an ISO is supposed to be made to boot from USB (or HDD, SSD) is to set up the BIOS to boot to the proper type device (or let you select from a boot menu).

Start with a conventional MBR and active FAT32 partition, and make sure it will boot to MS-DOS, this only requires the 3 DOS OS files to be present when the bootsector is a DOS bootsector (which seeks IO.SYS).

Once that's done, then (optionally) copy the DOS bootsector to a file on that FAT32 volume, name the (512 byte) file BOOTSECT.DOS. A disk editor can do this, or carefully use dd in Linux.

I then boot to Windows and use its CLI to run SYSLINUX.EXE (v6.03 on virgin media), to "Syslinux" (verb) the FAT32 volume. You can alternatively do this from Linux. This replaces the DOS bootsector with a Syslinux bootsector that will seek a Syslinux folder instead of seeking IO.SYS. Also writes ldlinux.sys and ldlinux.c32 to the FAT volume.

You do have to be consistent with your Syslinux version, the .C32 files in use must be from the same version of Syslinux that you use to "Syslinux" the FAT volume. And must match the version of Isolinux used to make the ISO. To find out which version of Isolinux was originally used on the ISO, open the ISO in a disk editor and these have big sectors but about the third sector down will be some readable text with the Isolinux version number.

Then copy all the files & folders from the mounted ISO to the FAT volume, change the name of the isolinux folder to syslinux, in the syslinux folder change the name of isolinux.cfg to syslinux.cfg.

A properly prepared distro distributed in ISO form should then boot normally the way it is intended when stored on a FAT filesystem instead.

Show-stoppers can still arise when some live distros have .CFG bootstrings within their Isolinux folder that specify CDROM or other hardcoded deficiencies, for USB you can sometimes specify REMOVABLE after you change the foldername to Syslinux. You can also specify a chosen volume in case it's not picked up by default.

You may need to look at every .CFG file in the Syslinux folder, they are all usually linked, ideally there is only syslinux.cfg but some people make it more complicated than that. Back them up before editing but they are just text files.
by csa | 2026-02-06 09:28:31+00:00
> At best you are buying a dollar with dollar.

There are at least two scenarios in which “just a dollar” is a great outcome for someone purchasing a stable coin (assuming that it’s actually stable):

1. You want the convenience of digital coin transfers/payments without the variance of price swings (e.g., recent Bitcoin). This can be especially useful when you have access to a phone but limited or no direct access to modern banking facilities.

2. It’s easy to get your local currency onto an exchange, but it’s not easy or advisable to have a dollar bank account or keep large amounts of dollars in cash in your locale.

3. (I guess for completeness) You want to engage in activities that are of questionable legality (e.g., drug sales in certain places, online poker in most of the US, etc.).
by jonathanlydall | 2026-02-06 09:28:36+00:00
Lots of wisdom in this post about some of the realities of software development.

The core point they're trying to make is that agile (or similar) practices are the incorrect way to approach consolidation of smaller systems into bigger ones when the overall system already works and is very large.

I agree with their assertion that being forced to address difficult problems earlier on in the process results in ultimately better outcomes, but I think it ignores the reality that properly planning a re-write of monumentally sized and already in use system is practically impossible.

It takes a long time (years?) to understand and plan all the essential details, but in the interim the systems you're wanting to rewrite are evolving and some parts of the plan you thought you had completed are no longer correct. In essence, the goal posts keep shifting.

In this light, strangler fig pattern is probably the pragmatic approach for many of these re-writes. It's impossible to understand everything up front, so understand what you reasonably can for now, act on that, deliver something that works and adds value, then rinse and repeat. The problem is that for sufficiently large system, this will take decades and few software architects stick around at a single company long enough to see it through.

A final remark I want to make is that, after only a few years of being a full-time software developer, "writing code" is one of the easiest parts of the job. The hard part is knowing what code needs to be written, this requires skills in effective communication with various people, including other software developers and (probably more importantly) non-technical people who understand how the business processes actually need to work. If you want to be a great software developer, learn how to be good at this.
by OnjaMadagascar | 2026-02-06 09:28:37+00:00
Onja | Full Stack Developer, Course Design & Back-End Developer, Course Design | Full-Time | ONSITE - Madagascar

Looking to join a social-impact driven company? Are you a software developer ready to use your skills for good? Onja trains underprivileged youth into world-class software developers. We are on the lookout for Course Designers who can help our students go from ‘what is coding’ to working in Global tech teams.

Help build a scalable course that will help train Madagascar’s brightest young people, while working alongside a team of talented, fun colleagues from all over Madagascar and the world.

Please apply through the following links:
Full Stack Developer, Course Design: https://onja.org/careers/full-stack-developer-course-design

Back-End Developer, Course Design: https://onja.org/careers/back-end-developer-course-design
by int_19h | 2026-02-06 09:28:44+00:00
> They are being served at 2-2.5-3$ /Mtok. That's sonnet / gpt-mini / gemini3-flash price range.

The interesting number is usually input tokens, not output, because there's much more of the former in any long-running session (like say coding agents) since all outputs become inputs for the next iteration, and you also have tool calls adding a lot of additional input tokens etc.

It doesn't change your conclusion much though. Kimi K2.5 has almost the same input token pricing as Gemini 3 Flash.
by mnw21cam | 2026-02-06 09:29:27+00:00
For me, it actually seems fairly plausible. I was a fairly untrained 70kg forty-something when I went to the gym and very quickly found that as I did a bit of hiking, I could max out the standing calf raise machine at 155kg. This involves having a very padded 155kg on your shoulders while in a standing position. It felt to me like that was the most my shoulders and back could cope with, and it's more than double body weight.
by LinXitoW | 2026-02-06 09:30:08+00:00
For reference, I use LLMs daily for coding. I do think they are useful.

I am speaking about corporations and sales tactics, because this VERY experiment was done by exactly such a corporation. How about you think about how "this whole thing works", and apply it to their post? What did they not write? How many worse experiments did they not post about to not jeopardize investments?

I don't find this impressive, because it doesn't do anything I'd want, anything I'd need, anything the world needs, and it doesn't do anything new compared to my personal experience. Which, just to reiterate, is that LLMs are useful, just not nowhere close to as world shattering/ending as the CEOs are selling it. Acknowledging that has nothing to do with being a luddite.
by bsgeraci | 2026-02-06 09:32:00+00:00
I am using the openscap and trivia. Can you add a discussion to my github about some of this. I would love some of your feedback on what you need on your level. I need to check the update mechanism so we are keeping the database up to date. I also want a way to keep it up to date when it is airgapped, not everyones use case but one I have delt with at my jobs.

I still need to put some e2e testing on those policies. https://demo.artifactkeeper.com/security/policies here is a demo and you can add a policy. Again that one I need to make a series of end to end testing but that was designed in mind :) I really want a staging area and promotion of packages after scans.

On my list of things to do.
by jstimpfle | 2026-02-06 09:32:37+00:00
I don't think that's happening in practice, but 1) it may not be specified and 2) What you say could well be the state after a crash. In particular if those files live in different directories.

You can remedy 2) by doing fsync() on the parent directory in between. I just asked ChatGPT which directory you need to fsync. It says it's both, the source and the target directory. Which "makes sense" and simplifies implementations, but it means the rename operation is atomic only at runtime, not if there's a crash in between. It think you might end up with 0 or 2 entries after a crash if you're unlucky.

If that's true, then for safety maybe one should never rename across directories, but instead do a coordinated link(source, target), fsync(target_dir), unlink(source), fsync(source_dir)
by samiv | 2026-02-06 09:32:53+00:00
It's not about the tooling it's about the reasoning. An architect copy pasting existing blueprints is still in charge and has to decide what the copy paste and where. Same as programmer slapping a bunch of code together, plumbing libraries or writing fresh code. They are the ones who drive the logical reasoning and the building process.

The ai tooling reverses this where the thinking is outsourced to the machine and the user is borderline nothing more than a spectator, an observer and a rubber stamp on top.

Anyone who is in this position seriously need to think their value added. How do they plan to justify their position and salary to the capital class. If the machine is doing the work for you, why would anyone pay you as much as they do when they can just replace you with someone cheaper, ideally with no-one for maximum profit.

Everyone is now in a competition not only against each other but also against the machine. And any specialized. Expert knowledge moat that you've built over decades of hard work is about to evaporate.

This is the real pressing issue.

And the only way you can justify your value added, your position, your salary is to be able to undermine the AI, find flaws in it's output and reasoning. After all if/when it becomes flawless you have no purpose to the capital class!
by netdevphoenix | 2026-02-06 09:32:54+00:00
Coal miners are cheap, easy to replace and have little negotiation power. Devs are expensive, harder to replace and have some leverage. Coal miners can take a pick or an axe with them when they leave. Devs can take away with them valuable operational knowledge with them that can bring to a competitor. Not comparable.

Plus, look at the job market. Every single tech company out there has been laying off devs in the last 3 years. If maximising productivity above expenses was so valuable, every tech company out there would be hiring like crazy because senior devs are cheap as chips nowadays. But they aren't, devs might be cheap but money itself isn't right now so they are prioritising lower expenses over increased productivity. Because that makes shareholders happy. And that's what every company aims for.

Maximising productivity is only an absolute goal in the minds of devs not in the minds of executives.
by runroader | 2026-02-06 09:33:06+00:00
https://www.bike-ev.com/news/cars/byds-270-europe-sales-surg...
But these numbers don't split out only EVs. So assuming these numbers are correct, BYD would be below even Geeley which seems... odd. It's probably availability bias, but I see BYD cars every day and that's not true for Geely.
by gerardnico | 2026-02-06 09:33:26+00:00
Marketing is an art.

I found the real value of this deck only at the end of the kickstarter page and I went through because I read the blog first.

Every sales needs a story (Rory, alchemy). It would have been awesome to also have a bit of Japanese story on each card or to embed a game in it.

All the best in your endeavours.
It’s not easy for sure.
by louiereederson | 2026-02-06 09:36:19+00:00
This is partly a description of the concept of the business ontology. Bob Muglia has been discussing this as the central problem to be solved in the data platform space for at least a decade. You could view the battle between the various vendors vying for a role in enterprise AI as really a battle over who owns the business ontology or semantic layer.

This article does a good job explaining https://metadataweekly.substack.com/p/ontologies-context-gra...
by Anon1096 | 2026-02-06 09:37:28+00:00
It's not that uncommon if you work in massive lowish level systems. Clang/LLVM being relatively bug free is the result of many corporate big tech low level compiler swes working with the application swes to debug why XYZ isn't working properly and then writing the appropriate fix. But compiler bugs still come up every so often, I've seen it on multiple occasions.
by jimbohn | 2026-02-06 09:38:11+00:00
As a European, I find it very funny to see how nobody in the US is willing to address the elephant in the room called Mossad. This looks more likely an israeli operation which sourced girls from russia and likely had the FSB as a customer/scratch my back I scratch yours/collab thing. I mean, most US politicians and the president seem to be on an "israel first" agenda.
by vanderZwan | 2026-02-06 09:38:30+00:00
Haha, right? I remember meeting up with some friends after school back in 1996 at the home of the one kid whose dad was a surgeon, and him showing off their Pentium Pro with a mindboggling 32 MiB of RAM! And then we tried playing SimIsle! Which actually managed to run on their computer! Very, very slowly! Unbelievable! :)
by Timexo | 2026-02-06 09:39:04+00:00
Hi HN,
I built ThumbNew because I noticed a gap between high-end design tools and the speed required for modern content creation.
Most creators spend hours in Canva or Photoshop not because they want to "design," but because they need a high-CTR visual for their video. I wanted to see if I could automate the "vibe" and layout part using AI to generate production-ready thumbnails in seconds.
Technical bits / Why I built this:
Speed: It’s built to be near-instant. The UI is focused on "get in, get out."
Tech Stack: Hosted on Netlify, leveraging AI for the image generation and layout logic.
The "Vibe": I went with a neo-brutalist aesthetic to move away from the generic SaaS look we see everywhere in 2026.
I’m specifically looking for feedback on:
The UX: Is the "instant" generation intuitive enough?
The Output: Are the thumbnails actually usable for your projects?
The Logic: What features would make this a "must-have" for your workflow?
I'll be around to answer any questions
by ben_w | 2026-02-06 09:39:30+00:00
Which is why I phrased it the way I did.

We, all of us collectively, are deeply, deeply ignorant of what is a necessary and sufficient condition to be a being that has an experience. Our ignorance is broad enough and deep enough to encompass everything from panpsychism to solipsism.

The only thing I'm confident of, and even then only because the possibility space is so large, is that if (if!) a Transformer model were to have subjective experience, it would not be like that of any human.
by somebodythere | 2026-02-06 09:40:00+00:00
even a squirrel that needs guidance from a human grandmaster, is heavily inspired by existing games, and who can use Piece Mover library is incredible. 5 years ago the squirrel was just a squirrel. then it was able to make legal moves. now it can play a whole game from start to finish, with help. that is incredible
by grey-area | 2026-02-06 09:40:26+00:00
Well there are lots and lots of examples that don't end in bankruptcy, just a very large loss of capital for investors. The majority of the stars of the dotcom bubble just as one example: Qualcomm, pets.com, Yahoo!, MicroStrategy etc etc.

Uber, which you cite as a success, is only just starting to make any money, and any original investors are very unlikely to see a return given the huge amounts ploughed in.

MicroStrategy has transformed itself, same company, same founder, similar scam 20 years later, only this time they're peddling bitcoin as the bright new future. I'm surprised they didn't move on to GAI.

Qualcomm is now selling itself as an AI first company, is it, or is it trying to ride the next bubble?

Even if GAI becomes a roaring success, the prominent companies now are unlikely to be those with lasting success.