USING AI IN MY OWN PROJECTS
Doing what I asked
isn't always enough.
I use agents for everyday things like my calendar and email, and for projects in my own environment. The more I use them, the more important it is to question what they've actually done.
The PHP example
When the PHP vulnerability came up, I took systems in my own environment offline and waited for patching. This was in my personal setup, which I work on alongside my job.
There is a wider lesson here. If I ask an agent to patch one PHP installation, it may do exactly that. It won't necessarily tell me there's another PHP version on the same machine, or ask whether that needs updating too.
The update can be done without the whole problem being solved. That's where AI can give you a false sense of security.
Knowing what's running
I still need a good picture of my systems and the versions actually running on them. A vulnerability scanner helps with that. In my case, it's a personal vulnerability scanner for my home lab.
That gives me something to check against when I ask an agent to make a change. I need to keep asking what else might need attention, rather than taking a completed task as the whole answer.
Using the agents day to day
My daily SOC briefing brings together vulnerabilities and threat intelligence. Other agents help with appointments, email and reading the news. These are things I use, as well as projects I'm learning from.