Blog · Rudratosh Shastri

Writing on AI-agent security & engineering

31 articles by Rudratosh Shastri on how AI agents get tricked through the content they read, how to measure prompt-injection defences honestly, what LLMs really cost, and the security and backend engineering lessons from 15 years of shipping.

Is Claude taking control of my development skills? I went looking for proof.

Your grammar checker uploads every word you type. I built one that never leaves your Mac.

Can a local LLM replace Claude Code? The benchmark everyone quotes is the wrong one.

The fake 'DEV Support' scam is back, and now it wants your card balance (a living list of every scam hitting dev.to)

Apple won't give you an API for your Health data. A free Shortcut will (here's the whole pipeline)

Your GitHub profile is wallpaper. Mine is a spaceship.

ELI5: Why can hiding one sentence inside a web page make an AI ignore its own owner and obey a total stranger?

6 Ways You're Using Claude Code Like a Chatbot — And What Tech Leads Do Instead

Your AI guardrail is green. It's also catching nothing.

Meta's prompt-injection detector caught 1% of real agent attacks. One config change made it 99%. That's the problem.

'Someone already built that' is a lie. 'It's already secure' is the dangerous one.

I let AI write my code for a month. The junior devs caught what it broke — I didn't.

Your GitHub profile shows your follower count. It also shows attackers your whole attack surface.

Microsoft's own security update broke Ctrl+C in Excel. Here's the patch number, and don't uninstall the first one.

The sandbox had no internet. The AI agent got out through DNS anyway.

Your GitHub MCP server costs 55,000 tokens before your agent reads a single word.

Someone trained a decision model for $104. The price isn't the interesting part — it's that it refuses to write text.

Your shopping agent reads the reviews. Attackers write the reviews. Guess who wins.

One prompt to GPT-6 Astra can cost $10. Here's exactly when the 1M context is worth it — and when it's a trap.

Rust quietly ate my JavaScript toolchain in 2026, and my builds are 20x faster for it

2025 was about typing faster. 2026 is about knowing what not to build.

AI writes the code. AI reviews the code. So who's actually on the hook when it breaks?

Junior developer jobs didn't disappear. The bar for them quietly moved, and nobody sent the memo.

"Pinned to a SHA" is a lie your coding agent told you. Here's the Git trick behind Plugin4Shell.

If you got a 'DEV Support: verify your account in 12 hours' comment — stop. It's a phishing scam.

An AI Correctly Ignored a Forum Rumor. I Removed One Label and It Paid Out $150.

I Almost Built a Startup This Week. The Evidence Said No — In One Afternoon.

10 Years In, Everything I Was Proud Of As a Junior Was Wrong

Your AI Agent Will Follow a Stranger's Instructions. Here's How I Actually Test For It.

The Hidden Bill: Where AI Agent Costs Actually Come From

I tested 10 prompt-injection detectors on 629 real AI agent attacks

Sanity's Knowledge Base stopped 6 of 7 poisoned pages. The 7th fooled Claude Opus 5.

AI agents can't tell who's giving the orders. So I built a tiny gate.