Where was Mythos when WordPress fell?
On marketing claims nobody checks, the 1,000 projects Anthropic never listed, and why an industry full of experts followed along.
AI & security
Tools, experiments, and opinions on using AI for security research.
2026
To Kara, Alex, and Michiel — Your Researchers Are Leaving
Bug bounty platforms never humanized researchers or triage. Now they're drowning in AI slop and wondering why their best people are leaving.
Running h1-brain Against a Real Target
A start-to-finish walkthrough of using h1-brain on an actual program. From hack() briefing to attack plan.
Teaching Claude Everything You've Hacked
h1-brain is an MCP server that gives Claude your HackerOne bounty history and a database of public disclosures. Setup and first sync.
What h1-brain Actually Does
Every tool in h1-brain, explained. Your reports, public disclosures, and the hack() briefing that ties them together.
Replaced by a Goldfish
Opus 4.6, the pentesting hype, and why most of the AI discourse around security is just noise.
Daily Workflows with the Email Agent
Real usage patterns for an AI email agent — morning triage, thread summaries, draft replies, and where the human stays in the loop.
Gmail API Credentials the Paranoid Way
Setting up Google Cloud OAuth credentials with minimal scopes for an AI email agent — because 'full access' is never the right default.
Guardrails That Actually Work
A four-layer defense model for AI email agents — because no single safety measure is enough when your inbox is on the line.
Wiring Gmail into OpenClaw
Installing the Gmail MCP server, configuring agent tools, and filtering down to only the operations you actually want.
Writing a SOUL.md for Email
Defining hard rules, tone guidelines, and PII handling for an AI email agent — because 'be helpful' isn't a security policy.
Syncing Obsidian to a Headless Server
Running Obsidian in a headless Docker container with Obsidian Sync, giving AI agents direct access to your vault.
Connecting Claude Max and Telegram
Using OAuth credentials from a Claude Max subscription to power OpenClaw agents, and wiring up a Telegram bot for mobile access.
Securing the Dashboard with Nginx Proxy Manager
Putting the OpenClaw Control UI behind HTTPS with basic auth, WebSocket passthrough, and a proper Content Security Policy — all through Nginx Proxy Manager.
Setting Up OpenClaw on a Hetzner ARM64 Server
Getting Node.js 22 and OpenClaw running on a fresh Hetzner CAX ARM64 Ubuntu Noble server — including the ARM64 gotchas nobody warns you about.