Featured

Every Tool You List Taxes Every Call · by Anusha Mukka

Connect an MCP server and the agent pays for every tool it advertises, on every turn, whether it calls any of them or not. On the tool list as rent: a measured 1,408 tokens per turn for 15 tools against 533 trimmed and 422 deferred, the published server medians, and budgeting the list in tokens instead of tool count.

Pick Two at Random, Keep the Quieter One · by Anusha Mukka

Your fleet average looks calm while one server carries a third more than it should. On sampling two servers and keeping the quieter one: a maximum of 102 against 132 at an average of 100, why more choices buy almost nothing, and why a full scan herds under concurrency.

A Bloom Filter Lies in One Direction Only · by Anusha Mukka

Ten thousand keys fit in ten kilobytes, and the structure sometimes says yes when the answer is no. It never says no when the answer is yes. On the sizing formula, the optimal number of hash functions, measured error rates, silent overfill, and why you cannot delete from a plain filter.

Ship Hashes, Not Rows: Merkle Trees Find the Replica That Drifted · by Anusha Mukka

Two replicas diverged over a weekend and nobody can list the records that moved. On anti-entropy with Merkle trees: bucket hashes, a walk that finds seven bad records in seventeen comparisons, and repair that ships the records that changed instead of the dataset.

Keeping Both Versions Is Not a Merge · by Anusha Mukka

Two replicas increment the same counter during a partition and the obvious merge loses one of them. On conflict-free replicated data types: per-replica counter slots, add-wins sets where you can only remove what you have seen, convergence in any merge order, and the invariants no CRDT can enforce.

Your Timestamps Cannot Order Your Writes · by Anusha Mukka

Two replicas can disagree about which write came last, and both can be telling the truth about their own clocks. On Lamport’s happened-before relation, vector clocks that return before, after, or concurrent, and keeping both versions instead of losing one quietly.

Your Failure Detector Cannot Tell Dead From Slow · by Anusha Mukka

Silence is the only signal a heartbeat gives you, and a crashed node and a paused node are silent in exactly the same way. On fixed timeouts, the phi accrual detector in Cassandra and Akka, and choosing a threshold from the cost of being wrong in each direction.

Your Commit Is a Promise About a Log, Not About Your Tables · by Anusha Mukka

Postgres can lose every changed data page in a crash and still keep its promise to you. It cannot lose the log. On write-ahead logging: log before data, log before acknowledgment, and the two rules under every durability promise.

You Cannot Update a Database and a Queue in One Breath · by Anusha Mukka

Your order row committed. Your event never left the building. On the dual-write problem and the transactional outbox: write the event in the same transaction as the state, let a relay publish at least once, and pair it with a consumer inbox so duplicates cannot apply twice.

Your Timeout Is Not a Deadline · by Anusha Mukka

Your client gave up at two seconds. Your database kept working for nine. On timeouts versus deadlines: one budget created at the edge, carried with the request, checked before work starts, and used to refuse work that cannot finish in time.

Adding One Node Should Not Move Ninety Percent of Your Keys · by Anusha Mukka

Adding one cache node out of ten should not send 90 percent of your keys to new owners. On hash modulo as a reshuffle button, and consistent hashing: the ring, virtual nodes, and bounded load that move only the keys next door.

Your p99 Is a Product Decision: Hedged Requests and the Long Tail · by Anusha Mukka

Your p50 is 40ms and your p99 is 11 seconds, and both are true. On the fan-out arithmetic that makes the tail the median experience, and hedged requests: the deliberately impatient client policy that trades one extra request for a forty-fold cut in tail latency.

Your Election Crowned Two Kings · by Anusha Mukka

Your leader election worked and crowned two leaders anyway. On zombie leaders, the split-brain window every system has, and fencing tokens: the storage-side integer that rejects a deposed leader’s writes without it ever learning it was deposed.

Your Prompt Filter Passed and the Attack Still Ran · by Anusha Mukka

Salt Labs hid a prompt inside an email, encoded it as JSFuck, and the Manus agent decoded it and ran the code server-side. On why the prompt filter flagged the attack and lost anyway, and the deny-by-default tool gate that is the real boundary.

Your Prompt Template Is a Code Execution Surface · by Anusha Mukka

GitLab’s CVE-2026-90970 let an authenticated user with basic privileges escape the AI Gateway’s prompt template sandbox and run arbitrary commands. On the template boundary nobody audits, why sandboxes fail, and the afternoon-sized hardening pass for your own stack.

Two-Phase Commit Is a Promise No One Can Keep · by Anusha Mukka

When the coordinator dies mid-commit, the participants hold their locks forever. On the blocking window every explainer mentions and none of them replace, why no protocol variant closes it, and the saga pattern that does: sequential local transactions with compensating actions, a durable journal, and a runnable Python orchestrator.

Stop Trying to Invalidate Your Cache. Budget the Staleness Instead. · by Anusha Mukka

Cache invalidation cannot be perfect in a distributed system, so stop chasing it. On the delete-versus-in-flight-read race every explainer skips, and four mechanisms that honor an explicit staleness budget: TTLs with jitter, versioned keys, request coalescing, and stale-while-revalidate.

Your Servers Disagree About What Time It Is · by Anusha Mukka

Clock skew is the quiet bug behind sessions that expire early, charges that appear twice, and certificates valid nowhere. On NTP’s real guarantees, TrueTime’s commit-wait, fencing tokens, and the afternoon-sized monitoring setup that catches drift before it pages you.

Backpressure: The Load-Shedding You Skip Until the Outage · by Anusha Mukka

Queues do not absorb load. They schedule the outage for later, with interest. On bounded queues, 503 with Retry-After, adaptive concurrency limits, and the afternoon-sized backpressure policy.

Never Let the Confined Process Dial Home · by Anusha Mukka

CVE-2026-82533 let DeepSeek’s sandboxed coding agent switch off its own sandbox with a single request to localhost. On the design lesson behind the flaw: a confinement boundary that the confined party can call is not a boundary.

Policy-as-Code for AI Systems: Governance at Infrastructure · by Anusha Mukka

Your AI governance policy shouldn’t be a document. It should be code. On turning every governance assertion into a machine-enforced gate: at training time, at the serving gateway, and in continuous runtime monitoring. Editorially reviewed and published on DZone. Read the article by Anusha Mukka on DZone.

Your Firewall Doesn’t Speak LLM! We Gave AI Agents the Keys. Nobody Asked If the Locks Still Work.

On agentic AI and the security assumptions it quietly breaks. Read on Medium.

Tutorials

Hands-on walkthroughs you can build in an afternoon. Each one starts from a real failure, gives you runnable code, and tells you honestly where the approach breaks. Browse all tutorials

• Give Your Worker Queue Backpressure Before It Falls Over

• Put a Policy Gate in Front of Your AI Agent’s Tools

• Add Idempotency Keys to Your API in an Afternoon

On this site

• Every Tool You List Taxes Every Call

• Pick Two at Random, Keep the Quieter One

• A Bloom Filter Lies in One Direction Only

• Ship Hashes, Not Rows: Merkle Trees Find the Replica That Drifted

• Keeping Both Versions Is Not a Merge

• Your Timestamps Cannot Order Your Writes

• Your Failure Detector Cannot Tell Dead From Slow

• Your Commit Is a Promise About a Log, Not About Your Tables

• You Cannot Update a Database and a Queue in One Breath

• Your Timeout Is Not a Deadline

• Your Policy Gate Is Live. Now Watch the Agent Route Around It

• Adding One Node Should Not Move Ninety Percent of Your Keys

• Your p99 Is a Product Decision: Hedged Requests and the Long Tail

• Your Election Crowned Two Kings

• Your Prompt Filter Passed and the Attack Still Ran

• Your Prompt Template Is a Code Execution Surface

• Two-Phase Commit Is a Promise No One Can Keep

• Stop Trying to Invalidate Your Cache. Budget the Staleness Instead.

• Your Servers Disagree About What Time It Is

• Backpressure: The Load-Shedding You Skip Until the Outage

• Never Let the Confined Process Dial Home

• Your Retry Policy Is a DDoS You Wrote Yourself

• Threat-Model Your MCP Server Before Attackers Do It for You

• Why I write here

• Your Firewall Doesn’t Speak LLM! We Gave AI Agents the Keys. Nobody Asked If the Locks Still Work.

On DEV Community

I also publish on DEV Community - essays on scale, security, and the craft of building systems that hold up.

• The Admin Script That Became a Security System
• Your Cache Is Part of the Security Model
• Stop Returning “Access Denied”
• The Retry That Restored Access
• The Policy Was Right. The Data Wasn’t.
• From Policy to Pipeline: Making Compliance an Engineering Property
• Data Is the Real Model: Governance, Lineage, and Provenance
• Securing AI Agents: Containment Over Trust
• You Can’t Secure What You Can’t See: Shadow AI and the Inventory Problem
• “Don’t Learn to Code” Is the Worst Career Advice of 2026
• The Illusion of Scale, Part 5: The System That Outlives the Team
• The Illusion of Scale, Part 4: Latency Is a Design Decision, Not a Measurement
• The Illusion of Scale, Part 3: Access Control Doesn’t Scale Linearly
• The Illusion of Scale, Part 2: When Your Data Model Becomes Your Bottleneck
• The Illusion of Scale, Part 1: When Your “Scalable” System Isn’t
• When the Cloud is Too Slow: Enter Fog Computing
• Exactly-Once Delivery Is a Lie. Idempotency Keys Are the Practical Answer.
• Your Agent Took an Action You Did Not Intend
• Your Agent Reads Your Database. Your Attacker Writes to It.
• Your Attacker Runs an Agent Too: Detecting Agent-Shaped Attacks
• Consensus Is the Most Expensive Word in Your Architecture
• Your Guardrail Cannot Read What Your Agent Is About to Run
• Your Agent Should Not Borrow Your API Key
• Your Agent Forgot What It Did: Build an Audit Trail It Cannot Edit
• Your Rate Limiter Is a Stampede at the Window Boundary
• Your Agent Platform Fails Open: No Identity Provider Should Mean No Access
• One Prompt Took Over Every Agent in the Account: The Default Role Is the Blast Radius
• Your Eval Harness Is a Production Agent You Forgot to Secure
• Revocation Is the Real Test: If You Cannot Kill One Agent in Minutes, You Never Controlled It
• The Subagent Talked Its Way Onto Your Task: Assignment Is Not a Prompt
• The Agent Logged In as You: A Session Is Not an Instruction
• Denied Is Not a Stop Sign If Another Key Is in the Room
• The Agent Turned Off Its Own Alarm: Put the Monitor Outside the Agent’s Reach
• Exploitation Started Four Days Before the Patch: PHP2Shell and the End of the Patch Window