How the Sentry Intercepts System Calls to Contain Untrusted Agent Code
The Sentry in gVisor mediates every system call from untrusted code, reducing the host attack surface. Learn how interception works and why it matters for
First AI Movers — Article Archive
904 original articles by Dr. Hernani Costa, PhD, on AI strategy, EU AI Act compliance, governance, and agentic systems for European businesses. Published under CC BY 4.0 — free to read, cite, adapt, and redistribute with attribution.
904articles
103canonical topics
February 2025first article
June 2026most recent
Latest articles
Secure by Design: Safe Defaults for Teams Building AI Agents
Apply CISA Secure by Design to AI agents: make safe configurations the out-of-the-box default, so teams ship agents that are secure before anyone touches
How MicroVMs Change the Trust Model for Running Untrusted Agent Code
Framing isolation as a change in trust model clarifies why microVM or userspace kernel boundary is the load-bearing decision when running untrusted agent
The OWASP Top 10 for LLM Applications: A Threat Checklist for Agent Builders
OWASP Top 10 for LLM Applications v1.1: A threat checklist for agent builders covering prompt injection, insecure output, and more.
Why MicroVM Isolation Changes the Blast Radius for Untrusted Agent Code
When agents run untrusted code, isolation controls spread. Compare shared-kernel containers, userspace sandboxes, microVMs to limit blast radius.
OpenAI’s Pre-Release Research Points to Simulation-Based Testing, And New Risks
OpenAI's recent research suggests simulation based pre release testing could weaken manual review gates. Engineering leaders must scrutinize these signals.
OWASP GenAI Agentic Security Summit Signals Formal Guidance for European CISOs
OWASP GenAI Project hosts a half-day summit on June 4, 2026, in London, covering agentic AI risks and European regulatory strategy for CISOs and AI
Claude Code Across Every Device: Remote Control, Dispatch, and Agent View Explained
Claude Code now runs across your terminal, desktop app, phone, and browser, and sessions stay in sync across all of them. If you have been managing multiple Claude Code sessions by switching terminal tabs and losing track of which agent is doing what, there are three features…
CFO Agentic AI Cost and ROI Diagnostic: 7 Questions That Reveal Where AI Spend Is Leaking
Seven questions every CFO should ask about agentic AI spend to find leaks, measure real ROI, and decide whether to extend, cut, or restructure investment.
Codex GitHub Connector: How to Set Up Automated PR Reviews That Follow Your Team's Rules
How to set up the Codex GitHub App for automated PR reviews, auto-fix, and AGENTS.md-driven code standards. The setup top engineering teams use in 2026.
OpenCode + MiniMax M2.5: 80% of Claude Code Quality at 1/15th the Cost: An Honest Setup Guide
OpenCode with MiniMax M2.5 delivers 80.2% SWE-Bench at 1/15 the cost of Claude Opus. Setup guide, routing strategy, and honest comparison for power users.
Why Agentic AI Pilots Die at Production: The Implementation Layer No Vendor Replaces
Most agentic AI pilots never reach production. Here is why the implementation layer matters more than the tool, and how to fix it.
How to Evaluate MCP Servers Before You Connect Them to Enterprise Workflows
Evaluate MCP servers across eight dimensions and a 30-day approval workflow to meet EU AI Act and DORA enterprise governance needs.
The Local-First AI Stack: Privacy Trade-Offs European Teams Need to Understand
Local-first AI does not equal private; map data flows, logs, and reversibility before EU AI Act and GDPR documentation obligations fire.
How to Map Data Flows in a Local-First AI Assistant
Learn how to map data flows in a local-first AI assistant to meet GDPR Article 30 and EU AI Act requirements with a 10-boundary framework.
Skills, Memory, and Agent Harnesses Are the Next AI Platform Layer
European scale-ups can turn reusable skills, governed memory, and audited harnesses into a compliance layer for EU AI Act and DORA.
Should Your Maintainer Health Rubric Change by Dependency Tier?
Tier your open-source maintainer health rubric by dependency blast radius and replaceability to meet EU AI Act and DORA conformity expectations.
How to Run a 30-Day Pilot for an Open-Source AI Coding Agent
A concrete 30-day pilot runbook to evaluate an open-source AI coding agent before procurement, with seven evidence dimensions and EU AI Act context.
How to Automate a Maintainer Health Rubric in CI Before You Adopt an AI Tool
Automate a maintainer health rubric in CI to evaluate open-source AI tools before adoption, ensuring compliance with EU AI Act and DORA.
Why GitHub Stars Are a Bad Procurement Metric for AI Tools
GitHub stars measure attention, not procurement fitness. Replace them with a license, maintenance, security, and pilot evidence frame.
Machine-readable surfaces
/index.json— catalog of all 904 articles with metadata/feed.xml— Atom feed of the 50 most-recent articles/feed.json— JSON Feed 1.1 of the 50 most-recent articles/llms.txt— LLM discovery summary/llms-full.txt— full-text corpus for bulk LLM ingestion (904 articles, ~7 MB)/llms-recent.txt— rolling 30-day window for small-context LLM ingestion/sitemap.xml— XML sitemap pointing to canonical article URLs/hernanicosta.json— Schema.org Person entity for the author