2nd Sight Lab

2nd Sight Lab Security and Technology Research. Pentesting. teriradichel.substack.com

Progress. When I get done I’ll have to deploy a whole AWS organization in a test account and see how fast I can do it. T...
08/25/2026

Progress. When I get done I’ll have to deploy a whole AWS organization in a test account and see how fast I can do it. This is all part of setting up my AI 🤖and pentest sandboxes and job runner.

Fuzzgramming + Brutevibing 🤖~~~~~~~~~~~~~~~~~~~~This thing in building is so complex it’s nearly impossible for me to ke...
08/21/2026

Fuzzgramming + Brutevibing 🤖
~~~~~~~~~~~~~~~~~~~~
This thing in building is so complex it’s nearly impossible for me to keep all the moving parts in my brain. And generally I don’t like overly complex things. But I don’t really see another way to do this and keep it flexible.

Over time I’ve simplified it a ton, but I don’t think it is simple enough. Right now I just need to use it and I’ll figure out if I can simplify it more later.

I did design it so any size organizations can use it, I want to even make it work in a single account. A remote account. A one person account. Whatever you want. For now it uses an organization by default.

But I also designed it so you can divvy out deployment privileges to different parts of your organization with different levels of permission for you know - governance.

So here’s the thing about building with AI. This is a serious app. It has to be logically accurate not vibey. I’ve built banking apps for companies with billions of dollars of assets under management. This app has some hard core logic.

Of course I wouldn’t build a banking app in bash but it was fast and lightweight for a POC. But the core logic is there to migrate the idea to some other language if you must.

So as I ponder my experience…

There’s two sides to this. On the one hand I don’t know half of what’s in it and I’m afraid to look. I will hate it and it will tempt me to immediately want to stop what I’m doing and refactor everything and that could take a lifetime given what happens when you vibe AI code.

On the other hand, I know the core logic and architecture is solid. I could be wrong and I’m sure if someone was paid a bounty they could find a flaw here and there but I think the parallel processing is pretty decent. I built it in such a way that I don’t have to fight with flock and file locks and all that.

I hope it is correct but I am still concerned about one aspect of adding errors to each node in the diagram. I think it’s right but I can’t yet say I’m certain. For some reason the project that updates the diagram data model has been the biggest problem. After getting consistent UI.

But today I got it working right end to end. It ran without the diagram locking up, fast enough, and seems to have the right data.

To the point I can USE IT.

With 5-8 terminal windows open juggling agents I can go like 100 times faster. I’m trying to quantify it in my ai-tracker repo but that’s hard to do.

The challenge is that for a single developer and especially depending on what part of the world you live in the cost is high, but for a company with a solid developer at the wheel output can go way up.

At the same time just when you think you are done, it kicks you in the teeth. It deletes key code, it creates a weird error that is so esoteric I am not even going to try to figure it out and explain it. Sometimes the models just feel haywire.

Those annoying moments are the moments I’m pondering, when you don’t know everything in the code and you don’t even want to look.

But sometimes, like today, the models are stuck and it is your best option. One little fix turned a whole bunch of nodes on my diagram green. Finding atrocious error handling and fixing it opened a flood gate of information to help solve some problems.

Can we overcome those gotchas? I don’t know. I feel like what I’m doing is fuzzgramming with a monolithic graph. I throw things at it over and over until if does down then right path and I get what I want.

Sometimes I have to slow down and literally make it write once line at a time to get it right. Brutevibing.

AI generated code is NOT pretty. It is not going to always be perfect and might generate a lot of noise but in the end you come up with something you couldn’t otherwise that “works” and produces correct outputs.

Still pondering optimizations, but today I got what I wanted. And immediately checked it into got with creds my agents are not allowed to use.

An AI-Generated Diagram of What I Am BuildingWould you like to see why I’m burning so many tokens?Just as I was about to...
08/20/2026

An AI-Generated Diagram of What I Am Building

Would you like to see why I’m burning so many tokens?

Just as I was about to publish this something went haywire. But got it.

AI is so bad a parallel processing but I feel like I brute forced my way there.

So much more to do but this is actually huge.

More details in a later.

Would you like to see why I’m burning so many tokens?

Can’t get role to work with MFA on Claude CodeWhat security would you really like to have for your agent credentials? Lo...
08/19/2026

Can’t get role to work with MFA on Claude Code

What security would you really like to have for your agent credentials? Locked down to a single IP Address? MFA without browser attack surface? Limited to a single user in a single account?

I have an AWS acount. I’m using Claude Code. How can I use my AWS credentials with MFA to access it?

Been facing a myriad of frustrations which are summed up at the link below. I kind of got my system working again and I ...
08/12/2026

Been facing a myriad of frustrations which are summed up at the link below. I kind of got my system working again and I think I solved the concurrency problem in a decently simple way. Simple being relative to the complexity of the prior attempt.

But the eternal loop is back and I have to sort out an AWS Organizations role assumption issue and fix all the individual resource projects to work with the new framework.

It does seem like maybe reducing the size of the projects helps. But the problem is, the complexity of the architecture is a lot for the ai 🤖 agents to hold in their illogical statistic driven brains.

I saw the tokens slipping away yesterday with no gratifying return on that investment.

Serious human oversight today, brute forcing my way to a solution.

Burned through another $200 plan already.

I will admit one thing. I was so frustrated last night and I just wanted to get it working so I was throwing errors at multiple agents. Fix it already! I get this way sometimes. I just wanted the darn thing to work. They can do so much and then they just hit a wall and I start chucking stuff at it.

But I should have just gone to bed. I work up to face the fact I was probably going to quickly run out of tokens again and took the time to direct the agent to solve the hard problems. I got through it but as I wrote in my AI tracker there are some things that are so maddening as they seem so simple and basic.

So here’s where I’m thinking again about a more personalized model.

But for now I need to get this done.

And to be fair some of the things I’d had to fix were complicated spanning multiple projects, processes, and different data models.

After all, I’m building everything in an AWS Organization including multiple accounts and OUs using a predefined configuration, deployed in parallel where possible with dependency management and a status and error tracker. I guess that’s complicated.

I’m hearing from my fellow AWS heroes they can survive a month on one Claude Max plan. Really? Maybe they are not at the screen 24 x 7 writing code (that’s how it feels) using 5-8 terminal windows at a time.

I’m reading that Kiro burns less tokens because it is more directed.

Then I look at Claude and read about claude.md and file pointers that tell it to only read files when it needs them not on every turn.

I wonder how my memory and mistakes and file logs eat up credits and context. I started new projects so they should be smaller. I tell it to only read the past day.

I split my requirements out into an md file per source code file. I did that a while ago to make my README smaller. I didn’t see a huge difference. Maybe it helped.

I’m reading that a pointer to a file with @ will help clause go straight to the file saving some burn. Does Kiro have such a thing? I’m reading it has that in chat but not readmes, steering, etc. I use explicit paths in readmes to try to point agents directly to correct files. How much does it help. IDK.🤷‍♀️

Well I’m glad I got the core engine kind of running. Annoyed with how long it took to convert things I thought would just work. But overall I think I have a pretty extensible parallel processing framework to run jobs.

Currently deployment jobs but they could be any kind of jobs. You know that whole job framework I have been trying to build for like five years now….

One more day. I keep telling myself that.

Tracking how long it takes to write code and how much it costs - 2ndSightLab/ai-tracker

07/28/2026

5 days ago I wrote this on X:

So let’s just guess that the package manager was JFrog. If you are running JFrog keep a close eye on your network traffic.

Unfortunately anything with Internet access, if compromised, can become a proxy. Like DNS servers. Not an easy problem to solve.
~~

I was right. JFrog was the third party package manager the agent escaped in the OpenAI / Hugging Face incident.

Now about everything else…I hope people are starting to understand how network security is one of your most powerful security tools, not just for blocking but for identifying a breach.

I wrote about that in my book and it is how I got into security.

See comment for link.

Revisiting the Bastion Host In Light of AI Agent EscapesA bastion host adds a point of inspection for potential rogue tr...
07/27/2026

Revisiting the Bastion Host In Light of AI Agent Escapes

A bastion host adds a point of inspection for potential rogue traffic

See comments.

SSH Key on a Yubikey ~ AlmostProtecting credentials from rogue AI agents and malware on your laptop and how Apple makes ...
07/27/2026

SSH Key on a Yubikey ~ Almost

Protecting credentials from rogue AI agents and malware on your laptop and how Apple makes it difficult

See comments.

07/27/2026

Wow Facebook is the most waste of time place where I post things and now they want me to pay $15 per month for zero traffic? GET. OUT. 🙄

No time to blog but here's this:Visual ~ can write scripts to deploy resources on AWS with any method I want including a...
07/15/2026

No time to blog but here's this:

Visual ~ can write scripts to deploy resources on AWS with any method I want including an agent without giving access to deployment mechanisms. Can rearrange my org structure, rename, move things around. Can give different roles permission to deploy different things. Deploys in parallel with dependency management I can update in my app. Things can be deployed to all accounts in org or an environment ou. Tracks static of all resources, with error messages. Script to deploy each resource is in the data model.

Key challenges in last post.

Tracked building this with AI here - mistakes, time, progress, cost, AWS Wishlist. [Link in comment]

Address

Seattle, WA
31401

Alerts

Be the first to know and let us send you an email when 2nd Sight Lab posts news and promotions. Your email address will not be used for any other purpose, and you can unsubscribe at any time.

Shortcuts

Share