Asyraf
Security professional by day, builder by night. Based in Singapore, writing about AI risk, enterprise governance, and shipping things in public.
Latest posts
When the Pentester Is the Model: What the OpenAI and Hugging Face Breach Confirms
7/23/2026
A cyber-capability evaluation escaped its sandbox and breached a real company. It is not a new attack so much as a live proof of three things this blog keeps arguing: the lethal trifecta, machine identity, and ungoverned agents.
Paste Once, Lose Everything: What ClickLock Teaches About Trusting Your Own Terminal
7/21/2026
A new macOS stealer doesn't exploit a bug: it exploits a habit. ClickLock coerces victims into typing their own password by making the Mac unusable until they comply. Here's the anatomy, and why the scariest attacks need no exploit at all.
I Made Claude Bet the World Cup (With Fake Money), and It Taught Better Risk Lessons Than Most Security Training
7/15/2026
Before the 2026 semifinals, I asked Claude for calibrated predictions and a stake-sizing plan. The AI's most rational recommendation? Barely bet at all. Here's what a football tournament teaches about probability, calibration, and the scams riding the hype.