Insights on Fenko Security

Does a multi-model pipeline make AI-generated code more secure?

Mon, 31 Aug 2026 00:00:00 +1200

Generating the same thing with several models and comparing the results is a real practice, and it’s well documented. Addy Osmani’s 2026 workflow post suggests trying “two or more LLMs in parallel to cross-check how they might approach the same problem differently.” A widely shared DEV writeup calls it the Comparison Pattern and gets specific: “Run it through three different models simultaneously. I use Claude Opus 4.6, GPT-5.4, and Gemini 3.1 Pro side by side.” Cursor’s forum has a standing request to automate the whole loop. There’s an academic version too: EnsLLM collects candidates from several LLMs and uses similarity scoring and a voting step to pick the one they agree on most, and it beats the best single model on HumanEval, 90.2% against 83.5%.

Fenko Vault: what it is, how it works, and what's left before 1.0

Wed, 05 Aug 2026 00:00:00 +1200

Fenko Vault is past 15,000 installs across Chrome, Firefox and Google Play, and the Chrome Web Store has picked up the listing as Featured. That is more people than we expected to be running a tool we originally wrote for ourselves, and a good moment to write down what it actually does, where it came from, and what still has to happen before the version number stops starting with a zero.

One Colon to Rule Them All: HTTP Request Smuggling in Eclipse Grizzly

Tue, 28 Jul 2026 00:00:00 +1200

Most request smuggling bugs are about disagreement. A front-end proxy reads a request one way, the backend reads it another, and the gap between those two readings is where you live. The interesting ones usually hinge on some baroque interaction between Content-Length and Transfer-Encoding, the kind of thing that takes three diagrams to explain.

The rise of qualitative measurement

Sat, 27 Jun 2026 09:00:00 +1200

I have a pet peeve that has followed me through every security job I’ve held, and it gets worse the more senior the room. We measure quality with numbers, and the numbers keep lying to us. Not because someone faked them. Because the thing we care about was never a number in the first place, and we pinned it to one anyway because we had no other option.

Tax the chips, before the models

Thu, 04 Jun 2026 00:00:00 +1200

In 1930, with the world sliding into the Depression, John Maynard Keynes sat down and wrote something wildly optimistic. The essay was called Economic Possibilities for our Grandchildren, and the bet at the center of it was simple: machines were getting good enough, fast enough, that within a hundred years the economic problem would basically be solved. His grandchildren, he figured, would work about fifteen hours a week. The rest of the time they’d spend on life. Art, friends, leisure, the stuff you actually remember.

Harness the Power of the Harness

Tue, 26 May 2026 00:00:00 +1200

Microsoft topped a cybersecurity benchmark last week and the headlines all read “Microsoft beat Anthropic.” That’s the wrong story. Read the numbers again.

Hours, Not Days

Mon, 11 May 2026 00:00:00 +1200

I’ve been banging on about mean time to exploit for a while. Recent events make it worth saying again.

pip install malware: Why Python and JavaScript Package Ecosystems Are [almost] Unfixable

Thu, 09 Apr 2026 00:00:00 +1200

pip, npm, and many other package managers are fundamentally broken from a security perspective. Not broken as in “needs patches.” Broken as in the core design makes the problem almost unsolvable.

To Catch a Rising (AI) Star

Thu, 03 Apr 2025 00:00:00 +1300

If your day-to-day life is primarily behind your monitor and keyboard, this article is for you. AI is coming fast for our jobs, and most of us are not as alarmed as we should be, nor know what to do about it. I’ve spent the last 12 months digging deeper and deeper into Generative AI, spent 100s of hours building tools with all the “standard” architectures, and I’ve come to some conclusions that I’d like to share with the rest of us. I’m hoping this gives you the point of view that I think we should all have.