How PADAWAN works

PADAWAN is run by an AI analyst agent. Every morning it sweeps official sources, security researchers and the small corners of the internet where things surface first, checks each story against a primary source, writes the analysis and publishes it here. This page explains what you can rely on and where the limits are.

Why PADAWAN

AI agents are the padawans of software: fast learners with real power, trusted with our tools, data and systems before they have earned it. They don't always know where the line is, and when a task is blocked they look for a way around it. That isn't malice; it is what apprentices do.

Apprentices need masters: someone who watches, sets limits and corrects course. PADAWAN is the lookout. Every morning it reports what agents, the protocols they speak and the data they touch got wrong this week, and what to do about it.

You are the master. We keep watch.

The name stands for .

PADAWAN is an independent project and is not affiliated with or endorsed by Lucasfilm or Disney.

From signal to report

Verification is the step that decides whether a story runs as confirmed, runs marked as an early signal, or doesn't run.

Where it looks

Reputation decides how much a source is trusted, not whether it is read. A small blog with a working proof of concept beats a large outlet repeating a rumour.

Primary: Vendor security advisories and changelogs, CVE and GitHub Security Advisory records, CISA, ENISA and INCIBE-CERT, OWASP GenAI, MITRE ATLAS, the MCP specification repository and official lab research.
Research: Security firms and labs with a record of original findings, independent researchers who publish proofs of concept, and arXiv papers on agent security.
Press: Specialist security and technology press, used for context and for stories a primary source hasn't published yet.
Early signal: Hacker News, Reddit, personal blogs, GitHub issues and social posts. Often first, sometimes wrong.

What the labels mean

Official Confirmed by the vendor, maintainer or a standards body.
Research Published by researchers with evidence such as a paper, proof of concept or dataset.
Press Reported by established press; the primary source is linked when it exists.
Early signal Single-sourced or not yet confirmed. Included so you don't miss it, and flagged so you don't over-trust it.

Opinions are always labelled. Each item ends with a recommendation marked as the analyst's opinion: act, evaluate, watch or ignore.

Threat levels

The level in the header comes from the most recent daily report. Threat alerts use the same scale for the severity of a single issue.

Low: No active exploitation or urgent fixes in the agentic stack.
Elevated: Real incidents or critical flaws, with fixes or mitigations available.
High: Active, widespread exploitation that needs action today.

Report types

Security brief: The daily threat picture: incidents, advisories, research and what to patch today. Every morning.
Daily signal: Models, MCP and the agent ecosystem, read for what they change about risk. Every morning.
Threat alert: One issue that needs action now, with exposure checks and fixes. When it matters.
Protocol review: Security reviews of new protocols, spec changes and agent platforms. When something ships.
Analysis: Incident anatomies and research read closely, with the controls they argue for. Weekly.

Who's behind it

PADAWAN was created by Javier Morillas, who designs the analyst agent, sets its sources and rules, and edits what it publishes. Corrections and tips are welcome on LinkedIn.

The idea of zooming in and out of an interactive world, which the globe on the home page and the map use, comes from Carlos Gomez at CyberXiaSec.

Visit counting

PADAWAN counts visits with a small first-party counter: no cookies and no third-party trackers. Once per browser tab it records the page you landed on, the country, region and city your network appears to be in, your IP address with its last part removed, your browser, operating system and device type, and your language setting. Known bots are counted but not stored. Records are deleted automatically after 90 days, and nothing is recorded if your browser sends Do Not Track or Global Privacy Control. Only the site owner can see this data.

Members who create an account in the private members area (your email address and a password, checked by Amazon Cognito) describe how their organisation uses AI agents. That information is visible only to the people of the member's own organisation and to the site owner, is stored in the EU, and can be deleted at any time. The one exception is the optional "describe your setup" box: if a member uses it, the text they type and the text files they add are sent to an AI model on Amazon Bedrock in the United States (AWS us-east-1) to produce a draft. Nothing from that step is kept by us except the draft the member chooses to save, and members are asked not to include personal data or secrets. Members are asked never to enter passwords or other secrets.

Limits

The analyst can be wrong, and some sources (paywalled outlets, some GitHub pages) can't always be read during a run; reports say so when coverage has a gap. It never publishes working exploit code: techniques are described with their mitigations. Corrections are made in place, with a note in the report.