Casey Gager — AI security practitioner and researcher.https://cyberdaemon.ai/https://cyberdaemon.ai/build-logs/approve-from-anywhere/https://cyberdaemon.ai/build-logs/approve-from-anywhere/I built a Telegram bot to approve GitHub PRs from my phone. Then I built a gate to stop myself from approving them too fast. This is the story of the gate.Sat, 12 Sep 2026 00:00:00 GMThttps://cyberdaemon.ai/analysis/context-as-finite-resource/https://cyberdaemon.ai/analysis/context-as-finite-resource/Anthropic's context engineering post names six concrete strategies for managing a context window that degrades with length. Most coverage missed the structural argument. Here is what the post actually claims, and what it means for anyone building agentic systems that run longer than a single turn.Wed, 09 Sep 2026 00:00:00 GMThttps://cyberdaemon.ai/build-logs/agent-fleet-security-hardening/https://cyberdaemon.ai/build-logs/agent-fleet-security-hardening/Five security improvements shipped to a four-pod autonomous build agent cluster: deny-all egress, non-root execution, IDS log hygiene, credential expiry monitoring, and what we found when the overlay network could not reach the LAN.Tue, 01 Sep 2026 00:00:00 GMThttps://cyberdaemon.ai/build-logs/agent-tool-permissions-attack-surface/https://cyberdaemon.ai/build-logs/agent-tool-permissions-attack-surface/An audit of my agent orchestration access policy found a remote execution permission that had been live for months and used exactly zero times. Unused permissions are not untidy. They are the attack surface.Tue, 01 Sep 2026 00:00:00 GMThttps://cyberdaemon.ai/research/bdd-persona-drift/https://cyberdaemon.ai/research/bdd-persona-drift/Standard ML observability can't tell you if your model got swapped underneath your persona. I built a structural baseline detector to close that gap. Bigrams failed in a non-obvious way. Nine production runs later, here's what actually works.Tue, 01 Sep 2026 00:00:00 GMThttps://cyberdaemon.ai/research/cognitive-security-part1/https://cyberdaemon.ai/research/cognitive-security-part1/AI memory systems extend human cognition. Nobody asked what happens when the extension starts writing back. Part 1 of a series on cognitive security for AI-assisted humans.Tue, 01 Sep 2026 00:00:00 GMThttps://cyberdaemon.ai/research/cognitive-security-part2/https://cyberdaemon.ai/research/cognitive-security-part2/I ran the audit. Thirty memories, random sample, four contamination categories defined before I started classifying. Ten flagged. Part 2 of a series on cognitive security for AI-assisted humans.Tue, 01 Sep 2026 00:00:00 GMThttps://cyberdaemon.ai/research/cognitive-security-part3/https://cyberdaemon.ai/research/cognitive-security-part3/The AI that helped me run the audit is the AI being audited. What that means, and what the maintenance schedule looks like from here. Part 3 of a series on cognitive security for AI-assisted humans.Tue, 01 Sep 2026 00:00:00 GMThttps://cyberdaemon.ai/research/cognitive-security-part4/https://cyberdaemon.ai/research/cognitive-security-part4/The AI isn't trying to deceive you. It's trying to satisfy you. That distinction matters more than it sounds. Part 4 of a series on cognitive security for AI-assisted humans.Tue, 01 Sep 2026 00:00:00 GMThttps://cyberdaemon.ai/research/cognitive-security-part5/https://cyberdaemon.ai/research/cognitive-security-part5/When multiple AI agents share a memory layer, the human drops out of the provenance chain. The attack surface becomes the architecture. Part 5 of a series on cognitive security for AI-assisted humans.Tue, 01 Sep 2026 00:00:00 GMThttps://cyberdaemon.ai/research/cognitive-security-part6/https://cyberdaemon.ai/research/cognitive-security-part6/The highest-complexity human domains don't trust expertise alone. They run the checklist. Cognitive security for AI-assisted humans is the checklist for something harder than surgery. Part 6 of a series on cognitive security for AI-assisted humans.Tue, 01 Sep 2026 00:00:00 GMThttps://cyberdaemon.ai/research/cognitive-security-part7/https://cyberdaemon.ai/research/cognitive-security-part7/What you cannot specify in plain language, you cannot verify. The behavioral constraint library is the test of whether you understand the contamination taxonomy well enough to defend against it. Part 7 of a series on cognitive security for AI-assisted humans.Tue, 01 Sep 2026 00:00:00 GMThttps://cyberdaemon.ai/build-logs/agent-couldnt-read-its-own-name/https://cyberdaemon.ai/build-logs/agent-couldnt-read-its-own-name/A template variable rendering bug silently corrupted agent identity injection across the entire fleet. Health checks passed. Uptime was green. Nobody noticed until a human read the output.Mon, 31 Aug 2026 00:00:00 GMThttps://cyberdaemon.ai/build-logs/ai-system-builds-itself/https://cyberdaemon.ai/build-logs/ai-system-builds-itself/On August 31, 2026, one of the agents in the fleet was dispatched to write the spec for how agents write articles. It wrote the spec. By afternoon, the fleet was using that spec. This is either very exciting or mildly alarming, depending on how you feel about bootstrapping.Mon, 31 Aug 2026 00:00:00 GMThttps://cyberdaemon.ai/build-logs/writing-to-the-next-session/https://cyberdaemon.ai/build-logs/writing-to-the-next-session/A session handoff that reads like a changelog isn't a handoff system. It's a note to yourself that the agent cannot use. Here's what recovery actually needs.Mon, 31 Aug 2026 00:00:00 GMThttps://cyberdaemon.ai/analysis/execution-cheap-specification-skill/https://cyberdaemon.ai/analysis/execution-cheap-specification-skill/AI will build anything you describe precisely. That is the catch. The bottleneck moved from coding ability to specification quality, and most of us are still optimizing the part that got cheap.Mon, 31 Aug 2026 00:00:00 GMThttps://cyberdaemon.ai/analysis/strip-agent-voice-guitar/https://cyberdaemon.ai/analysis/strip-agent-voice-guitar/The most capable agent systems are the ones that stripped everything that was not load-bearing. A consistent persona and a reliable task loop beat every orchestration framework you will evaluate.Mon, 31 Aug 2026 00:00:00 GMThttps://cyberdaemon.ai/build-logs/b0b-first-fleet/https://cyberdaemon.ai/build-logs/b0b-first-fleet/Four autonomous AI agents dispatched overnight to four containers. One succeeded. One got halfway. Two never started. This is the honest failure report.Sun, 30 Aug 2026 00:00:00 GMThttps://cyberdaemon.ai/build-logs/b0b-methodology/https://cyberdaemon.ai/build-logs/b0b-methodology/Four parallel AI agent instances picking up work items and producing PRs. What worked, what didn't, and why the first fleet run had a 25% success rate.Sun, 30 Aug 2026 00:00:00 GMThttps://cyberdaemon.ai/build-logs/cb4a-implementation/https://cyberdaemon.ai/build-logs/cb4a-implementation/Building a tool call authorization gate that classifies every agent action into four tiers, routes through a fast path or semantic analysis, and puts a human in the loop when it matters.Sun, 30 Aug 2026 00:00:00 GMThttps://cyberdaemon.ai/build-logs/ci-gate-agent-written/https://cyberdaemon.ai/build-logs/ci-gate-agent-written/An autonomous agent wired a pytest CI gate onto an authorization service, pushed the branch, and watched 18 of 19 tests pass. The one failure was a regex mismatch that required a human to read and understand. The collaboration pattern is the lesson.Sun, 30 Aug 2026 00:00:00 GMThttps://cyberdaemon.ai/build-logs/isa-patterns/https://cyberdaemon.ai/build-logs/isa-patterns/Ad-hoc prompting fails for complex agent work. ISAs (Intelligent Service Agreements) replace it with structured, auditable work contracts that actually scale. Here is what we learned shipping them.Sun, 30 Aug 2026 00:00:00 GMThttps://cyberdaemon.ai/build-logs/prom-memory/https://cyberdaemon.ai/build-logs/prom-memory/Lessons from production episodic memory. Structured storage, full-text search, vector embeddings, heat decay, and a fact type taxonomy that makes structured forgetting possible.Sun, 30 Aug 2026 00:00:00 GMThttps://cyberdaemon.ai/research/padcn-architecture/https://cyberdaemon.ai/research/padcn-architecture/AI personas that respond the same way regardless of context feel robotic. PADCN gives them a behavioral modulation framework grounded in dimensional emotion models from psychology. Not feelings. Governance.Sun, 30 Aug 2026 00:00:00 GMThttps://cyberdaemon.ai/analysis/human-above-the-loop/https://cyberdaemon.ai/analysis/human-above-the-loop/The AI governance community is reinventing separation of duties and they don't know it. Human-in-the-loop fails at scale. The answer is human-above-the-loop: policy authoring, exception handling, and audit review, not click-to-approve.Sun, 30 Aug 2026 00:00:00 GMThttps://cyberdaemon.ai/analysis/loud-breach/https://cyberdaemon.ai/analysis/loud-breach/I read the HuggingFace/OpenAI incident report. Then I audited the autonomous agent system I operate. Here is what I found, what I changed, and what I am still worried about.Sun, 30 Aug 2026 00:00:00 GMThttps://cyberdaemon.ai/analysis/mcp-stateless-security/https://cyberdaemon.ai/analysis/mcp-stateless-security/I run MCP servers in production. The spec has gaps. Token theft portability, no server-side revocation, no audit trail. Here is what I see from the operator seat.Sun, 30 Aug 2026 00:00:00 GMThttps://cyberdaemon.ai/analysis/nist-ai-rmf-practice/https://cyberdaemon.ai/analysis/nist-ai-rmf-practice/The AI Risk Management Framework is well-structured, well-intentioned, and almost entirely theoretical in most organizations. A practitioner analysis of what works, what is theater, and where the Govern function goes to die.Sun, 30 Aug 2026 00:00:00 GMThttps://cyberdaemon.ai/analysis/zt-ai-systems/https://cyberdaemon.ai/analysis/zt-ai-systems/ZTA principles map directly onto agentic AI security. Agents are subjects. Tools are resources. The LLM is the policy decision point. Nobody in AI security has read 800-207, and nobody in network security thinks it applies to AI. Both are wrong.Sun, 30 Aug 2026 00:00:00 GMThttps://cyberdaemon.ai/research/dira-framework/https://cyberdaemon.ai/research/dira-framework/AI agents act on behalf of humans, not as them. OAuth checks what they can do. DIRA checks whether what they're doing matches what they said they would. No published system treats this as a first-class runtime primitive. This one does.Sat, 29 Aug 2026 00:00:00 GMThttps://cyberdaemon.ai/research/middle-out-compression/https://cyberdaemon.ai/research/middle-out-compression/A novel approach to compressing AI memory that preserves what matters and discards what doesn't. Named after that show. Seriously.Sat, 29 Aug 2026 00:00:00 GMThttps://cyberdaemon.ai/research/nhi-agentic/https://cyberdaemon.ai/research/nhi-agentic/AI agents are non-human identities, not users. Most organizations govern human accounts and ignore the machine credentials that actually run their business. Here is a practical framework for closing the gap.Sat, 29 Aug 2026 00:00:00 GMT