Foundations make security reviews realistic

Tailscale is essential to my system, so a security bulletin like TS-2026-009 is something I need to take seriously. Realistically, there is very little chance I would have set aside the time to read it closely, understand the actual exploit conditions, review exposure across galexc-net and Parlè, check the live systems, and turn all of that into a concise answer I could act on.

I gave my agent this prompt:

See https://tailscale.com/security-bulletins#ts-2026-009 - evaluate our exposure and whether we need to take action across galexc-net and parlehq/centops in particular.

That was the whole request. A few minutes later I had the review below. It checked the bulletin against both codebases and the live infrastructure, separated vulnerable versions from the conditions required for exploitation, found a second bulletin that mattered more to my setup, and gave me a short set of next steps without changing anything.

The models are obviously a huge part of this. All of the boring foundational work mattered too: deterministic project routing, access to live state, repo-owned infrastructure, explicit security boundaries, and clear instructions about what the agent may inspect versus change. I didn’t have to pack any of that into the prompt because the system already knew how to do the work safely.

• one prompt
• a few minutes
• $0.905 if I weren’t using a Pro plan, which of course I am

I share this brief note because I think it’s such a great example of what can be done when these systems work well. The reality is, of course, that this is NOT how it always goes!