Very Scary AI

The blog

AI security, explained like you're smart but busy.

Every post answers one question, links every number to its source, and ends with something you can fix today.

mcp · 5 min read

Are MCP servers safe? Check what your AI tools can touch

Are MCP servers safe? They can be, but many hold plaintext keys or full-disk access. Here's what to check in your AI tool config, in plain English.

Read it October 24, 2026

email · 5 min read

Can someone send email pretending to be you?

Yes, if your domain lacks SPF, DKIM and DMARC. Here's how email spoofing works, what each record does, and example records to copy.

Read it October 24, 2026

ai agents · 5 min read

Is it safe to give an AI agent your email?

Is it safe to give an AI agent your email? It can be, with limited access and approvals. Here are the real risks and a five-minute setup checklist.

Read it October 24, 2026

api keys · 5 min read

I leaked an API key. Here's exactly what to do

Leaked an API key? Revoke it first, then replace it and check for misuse. Step-by-step links for OpenAI, Anthropic, Stripe, AWS and GitHub.

Read it October 24, 2026

prompt injection · 6 min read

What is prompt injection? A plain-English guide

What is prompt injection? A plain-English guide to how hidden text tricks AI agents into leaking data, with real examples and a five-minute fix.

Read it October 24, 2026