Agentsec Weekly: A Newsletter on AI Agent Security

After a few quiet months, I’ve started Agentsec Weekly, a free weekly newsletter on AI agent security. alphasec isn’t going anywhere.

Stop Hiring, Start Orchestrating: Running an AI Agent Company with Paperclip on Railway

Deploy a fully autonomous AI agent company on Railway with Paperclip. One-click setup, embedded or external Postgres, and your agents.

Stop Hiring, Start Orchestrating: Running an AI Agent Company with Paperclip on DigitalOcean

Deploy a fully autonomous AI agent company on DigitalOcean with Paperclip. No manual config, no fuss - just Docker, Caddy, and your agents.

From A2A Agent to Gemini Enterprise: A Practical Deployment Guide

A practical guide to Google A2A agents - covering setup, API key vs OAuth authentication, deployment to Cloud Run, and registration with Gemini Enterprise.

Self-Host Your Own Push Notification Server with ntfy

ntfy turns any HTTP request into a push notification - no API keys, no vendor lock-in. Here's how to deploy your own private instance on Railway in minutes.

LiteLLM and the Canary (Token) in the Coal Mine

A supply chain attack on LiteLLM swept up cloud credentials, SSH keys, and crypto wallets. Most victims never knew. Canary tokens exist for moments like this.

Securing Google Cloud: The MVSP Checklist Guide

Google Cloud MVSP defines 60 controls across 6 domains for a minimum security baseline. Use an open-source tool to learn and track your progress.

WebMCP: The Web Finally Speaks Agent

A brief on WebMCP, Google's new browser standard that gives AI agents a proper way to use the web — without screenshots, scraping, or guesswork.

Privileged Account Monitoring: 5 Hard Truths

From shadow admins to zero standing privilege, this guide cuts through the noise with 5 essential truths for securing your most critical identities and access paths.