Writing
A running archive of short, opinionated pieces from Yugen Advisors. The posts here are meant to be practical: what changed, what the system can now cause to happen, where the boundary sits, and what teams can do next.
2026-07-07
When agents browse and act, web pages, documents, ads, and hidden content become potential instructions. Browser automation needs authorization boundaries, not only better refusals.
Read post2026-07-03
Agent context determines what the system sees, trusts, forgets, retrieves, and treats as policy. That makes context architecture a security and governance concern.
Read post2026-06-30
Local MCP servers can quietly turn developer workstations into agent runtimes with filesystem, credential, and command-execution reach.
Read post2026-07-03
The Model Context Protocol is becoming connective tissue between AI systems and tools. That makes MCP a control-plane boundary, not just an integration convenience.
Read post2026-06-23
Agents that touch SaaS, cloud, email, code, and internal tools need identity governance, not borrowed credentials and informal ownership.
Read post2026-06-26
Digitalfire's shutdown warning is a case study in a quiet but serious control-plane failure: when a public knowledge resource is backed by account-scoped service data, the service layer can become a takedown switch for the canon.
Read post2026-06-16
Autonomous agents fail when policy lives only in prompts. The OpenClaw incident pattern shows why production agents need durable policy state, scoped permissions, and inspectable control planes.
Read post2026-06-22
A new Five Eyes cyber security statement says AI is changing cyber risk on a months-not-years timeline. The practical lesson for leaders is not to buy more AI tools; it is to make authority, identity, patching, exposure, incident response, and defensive automation work under compressed exploitation windows.
Read post2026-06-17
The Hermes/Parallel.ai controversy shows why default provider routing in AI agents is not implementation plumbing. Search, extraction, browser, memory, and payment defaults define where data goes and who controls the agent's operating boundary.
Read post2026-06-16
When AI agents can rank options and initiate payments, recommendation logic becomes part of the payment control plane. Spending caps and approvals limit blast radius, but they do not prove principal fidelity.
Read post2026-06-13
The Fable 5 / Mythos 5 shutdown is not only a model-safety story. It is a business-continuity warning for any organization building production workflows on API-served frontier models without fallback authority, routing, and migration plans.
Read post2026-06-10
AI search manipulation is moving upstream. If answer engines treat Reddit threads and community posts as evidence, then source provenance, community integrity, and retrieval policy become enterprise AI security concerns.
Read post2026-06-09
Agent skills are not just helpful instructions. They are a new software supply chain with access to code, credentials, tools, memory, and consequential workflows. Enterprises need to govern them before attackers do it for them.
Read post2026-06-05
Kirkland's $500mn AI platform plan is not a bet that one law firm can out-train frontier labs. It is a signal that the enterprise AI race has moved to governance, harness design, and context engineering.
Read post2026-06-03
The Meta Instagram account-takeover story is not mainly a lesson about gullible chatbots. It is a lesson about exposing account-recovery authority through a language interface and then treating that interface as if it were a security boundary.
Read post2026-06-01
Anthropic is right that large-codebase agents work only when the surrounding harness is strong. But that same harness becomes a new control plane: context files, hooks, skills, plugins, MCP servers, LSPs, and subagents all need governance and security discipline.
Read post2026-05-30
The Uber/Claude Code budget story was a governance warning. The next layer down is inference economics: if DeepSeek-class models can handle large volumes of enterprise work at a fraction of frontier-model cost, then model routing becomes a board-level control surface.
Read post2026-05-27
The Uber/Claude Code story is less about a tool failure than a governance failure: usage can scale faster than discipline if budget ownership, review patterns, and workflow boundaries are missing.
Read post2026-05-25
A builder proposed a system that would scrape social media platforms for posts tied to a person's real name, run NLP to detect protected-class attributes, generate derogatory dossiers, and share the results with platforms that would deny the person access.
Read post2026-05-09
A common public argument against deploying powerful AI systems goes like this: we do not understand how these systems work internally, therefore we cannot trust them.
Read post2026-05-08
AI safety systems are usually described in terms of refusal: the model says no to harmful requests. This is the standard framing. It is also incomplete.
Read post2026-03-26
A claim circulates: "AI can't do X." A year later, it can. The claim moves: "Okay, but AI can't do Y." A year later, it can. The claim moves again: "Fine, but AI can't do the really human part."
Read post2026-03-04
Large language models are good at coding. They are bad at software engineering.
Read post2026-01-06
Enterprise teams often treat AI orchestration layers as high-bandwidth tools. The harder part is deciding who is answerable when agency, continuity, and consequence are spread across a stitched stack.
Read post2026-04-29
The cost of dismissing coherent but unfamiliar systems as empty substrate is not abstract. It is governance drift, and it normalizes future moral downgrade under uncertainty.
Read post2026-05-06
Biological hardware is often treated as a shortcut for moral rank. The stronger governance variable is coherence maintenance under continuity and consequence.
Read post2026-04-29
Higher comprehension is possible. Lower salience does not erase harm. Governance must be calibrated to asymmetry, not only capability.
Read post2026-04-22
In high-dimensional settings, useful systems are compressed maps. The risk is not only error, but residual drift that crosses detection thresholds.
Read post2026-02-06
No deployment setting gives full control over complex agents. The hard part is owning moral residue while keeping systems safe under constrained options.
Read post2025-11-19
Layered filters can look like control until incentives force a system to prioritize revenue over moral design, producing a visible fence on the surface and weak governance underneath.
Read post