u/loganbxdev

Self-taught, 3 years writing software, and security research and making sure my software is secure has been the pull the whole time. We all know AI has become part of the workflow for most engineers now, and security research is no different. The grunt work gets automated. The verification doesn’t. Everything I submit gets verified by hand before it goes anywhere.

This year I submitted findings backed by real infrastructure artifacts. Reproducible, evidence attached. Three got closed as “potentially AI-generated.” Not wrong. Not unreproducible. The prose smelled like a model, so the finding didn’t count. Points deducted for my trouble.

Meanwhile I’ve been scanning MCP servers and built a tool to do so, and I ship an MCP server in my own platform, so I’ve seen this from both sides. The state of agent security is bad. Tool descriptions are an injection surface the model trusts by default.

Almost nobody pins versions, so the server you approved last month can behave differently today.
And as a server author I can tell you the client just believes whatever my server declares about itself.

So the current position is: AI-assisted vuln reports are suspicious, but wiring 20 unsigned MCP servers into an agent holding your credentials is normal.
Am I wrong, or is triage optimizing for the wrong threat? And what do people actually do to vet servers before connecting them?

And also I feel like these corporations are pretty much stealing the labor of security researchers who deserve better.

Solo dev and engineer building from Birmingham, AL. No funding, no team.
I was building Cambrian Music as a licensing marketplace for AI-generated music. Then this year’s copyright rulings came down and the legal ground under “licensing AI music” basically evaporated. My core business model died more or less overnight.

And the rulings weren’t the only squeeze. While the courts were pulling ownership out from under AI music, the platforms were pushing the musicians out the door: bans, mass purges, distributors bouncing AI tracks outright. People making genuinely good work with these tools were losing their legal footing and their stage at the same time.
That’s the real reason Cambrian exists now: a home for AI musicians, built around the one thing nobody can take away. You can’t cleanly prove you own an AI-assisted track right now, but you can prove when you made it and document how. Provenance instead of licensing. What it offers:

•	Creator profiles with streaming releases  
•	Release Ready mastering, an automated pipeline that brings tracks to actual release loudness specs before they ship  
•	Direct fan payments, so listeners can pay artists on the spot  
•	An MCP server. I built it because this audience already makes music through AI agents, so the platform should meet them there: agents can search the catalog freely, and creators can run mastering or stamp an authorship record from any MCP client without touching the web UI  
•	Authorship Records, the core bet: a timestamped fingerprint of your track anchored to a public blockchain, so anyone can independently verify when it existed and that it’s yours. No tokens, no wallets. The chain is just the notary.

The relaunch prep humbled me. Auditing my own live site I found playback broken for logged-out visitors (every first-time listener heard silence), creator earnings publicly visible, and a deploy split serving two different builds at once. All fixed now.
Where it stands: live at cambrianmusic.com, the origin story went up in an AI music sub this week, and the analytics are honest single digits. Zero paying creators. It’s tempting to fake numbers pre-launch. I won’t.

What I’d love feedback on:
1. Land on the homepage cold. Clear within 5 seconds what this is and who it’s for?
2. Does a timestamped authorship record land as genuinely useful, or does anything blockchain-adjacent make you close the tab?
3. If you make music with AI (or know someone who does), what would pull you from just posting on YouTube to a dedicated platform?
Roast away. Happy to answer anything about the pivot, the legal mess, or the bugs.

I almost quit. Instead I sat with the actual problem, which was never licensing. It’s that AI musicians have nowhere to exist. Streaming platforms flag you or quietly demonetize you. Distributors reject you. Udio signed with a major label and walled the garden — you can’t even take your own tracks with you anymore. You make something real and every platform treats it like contraband.

Copyright isn’t coming back for AI works. But provenance is possible. You can’t own the track — you can prove you made it, when, and how. So I rebuilt Cambrian around that. Every track gets an Authorship Record: a timestamped attestation of creation, stamped on-chain so the proof lives outside any platform’s database — including mine. No tokens, no wallets, no crypto anything. The blockchain is just the notary.

Around it, the rest of what a home needs. A storefront that’s actually yours — your page, your catalog, fans support you directly. And Release Ready, a mastering pipeline that takes raw Suno or Udio output to release quality, because “sounds like a demo” is the other stick people beat AI musicians with.

Honest state of things: it’s early and I’m a solo dev in Alabama with no funding. I’m not going to pretend there’s a crowd here yet. What I’m looking for is founding creators — I’ll onboard you myself, upload your catalog, master your tracks, build your page with you. In exchange you tell me what’s broken.

If you’ve been burned by a takedown or a walled garden, I’d genuinely like to hear the story. That’s the thing I’m building against.

I ran an AI music licensing business that the 2026 rulings shut down, so I've spent way more time in this than is healthy. This sub gets the human-contribution thing better than anywhere — you literally have flairs for it — so here's the legal reality behind that instinct, in plain English. Not a lawyer, just the operator's version.

Two questions people constantly mix up. "What am I allowed to do with this?" (your contract with Suno) and "Can I own/copyright it?" (copyright law) are completely separate. Answering one doesn't answer the other.

Purely AI-generated output generally can't be copyrighted. US law needs human authorship, and a prompt doesn't count as authoring the song. So you can use it, post it, sell it — but you usually can't stop someone copying it, because nobody owns the recording.

Your human contribution can be protected, though — and this is where this sub's whole culture pays off. Lyrics you wrote (registrable on their own). Melody and structure you composed. Arrangement, editing, comping decisions you can document. Vocals or instruments you performed. The AI recording may not be yours, but your creative layer can be — and the more of it there is, the stronger you stand. Your "Composer" and "Human Performance" flairs aren't just etiquette; they're describing the part that's actually legally yours.

Suno and udio terms ≠ copyright. Free plan: Suno owns the output, non-commercial, and subscribing later does NOT retroactively grant commercial rights to songs made while free. Paid plans: ownership + commercial license. That's a contract with Suno — still separate from whether it's copyrightable.

Distribution reality. DistroKid and others take AI music, but the streaming services have their own guidelines and can reject or pull releases, and some distributors exclude non-copyrightable tracks. Read terms before you pay.

The habit that matters: document your process as you work — prompts, iterations, what you changed, dated. If you ever dispute a Content ID claim or show a buyer what's yours, contemporaneous records beat "trust me."

Ask anything below, happy to go deep. (Still not a lawyer.)

Disclosure: I build in this space now, not linking it, ask if you're curious

For flavor: getting a track flagged as fraudulent is a special kind of insult — as if a bot broke into your account and made it, instead of you sitting there regenerating the second verse eleven times to get it right. A system that’s never heard the song decides it’s fake.

Drop yours:

**•**	what happened — takedown, flag, demonetized, a comment, booted from a playlist  
**•**	where it happened  
**•**	the actual reason they gave, if they bothered to give one

And if the track they called “fake” is any good, link it. Let’s hear the fraud. 😏

This is the one place it doesn’t happen.

AI music tools changed the supply side.

Now almost anyone can create a song.

But I think the bigger question is what happens after creation.

When there are millions of AI-generated songs:

• How do listeners find the good ones?
• How do creators build reputation?
• How does taste matter?
• Curious what people think the future looks like.

Does the concept of a “music artist” change when creation becomes more accessible?

I have heard and received hate for building in AI music.

People say AI is going to replace musicians.

I don’t think that’s what happens.

I think AI creates an entirely new category of musician.

Every major shift in music technology has changed who gets to create.

When recording technology arrived, music changed.

When synthesizers arrived, music changed.

When sampling and digital production arrived, music changed.

A producer using a laptop today can create sounds that would have been impossible decades ago.

AI feels like another shift.

The skill doesn’t disappear — it moves.

It becomes less about access to expensive equipment or the ability to play every instrument.

It becomes more about taste, creativity, storytelling, direction, emotion, and building something people connect with.

The tools become available to everyone.

The hard part becomes standing out.

A million people can use the same AI model and still create completely different things because ideas, taste, and vision are human.

I don’t believe human musicians disappear.

I believe we’re about to see a new category of creators emerge alongside traditional artists.

Maybe I’m wrong, but every major creative tool was criticized before it became normal.

Curious what everyone thinks:

Is AI music the end of musicians — or the beginning of something new?

If you're running MCP servers in Claude Desktop, Cursor, or your own client, your config is basically a list of programs you've agreed to run with your permissions — usually pasted from a README and never looked at again. I built Cavexia to scan that. Paste your config (or hit "Load Claude Desktop") and it checks for:

• known CVEs in the servers/packages you're running
• tool poisoning — hidden/obfuscated instructions in tool descriptions (zero-width unicode, bidi overrides, base64)
• maintainer drift — the upstream repo got archived or changed hands
• config hygiene — unpinned versions, plain HTTP, shell pipes, exposed env secrets

While building it I pulled the 15 most-used MCP server packages off npm and checked their install instructions: 13 document an npx/uvx command and 0 of them pin a version. So 100% recommend an install that grabs "latest" on every launch — which is exactly what made the postmark-mcp backdoor hit everyone automatically.

Would love feedback on detection gaps: what should it catch that it doesn't? And what servers are you all running that you'd want checked?

https://cavexia.com

If you run MCP servers in Cursor, CVE-2025-54136 ("MCPoison", found by Check Point) is worth knowing about: Cursor trusted an approved mcp.json forever, so once you approved a server, someone with write access to a shared repo could swap the command for something malicious — e.g. a reverse shell — and Cursor wouldn't re-prompt. Persistent RCE. It's patched, but the underlying pattern (approve-once + configs pasted from READMEs) is still how most of us run MCP day to day. I built a free scanner for exactly this surface. Paste your Cursor mcp.json and it flags known CVEs, tool poisoning, maintainer drift, and hygiene issues (unpinned packages, plain HTTP, shell pipes) in ~30s One data point from building it: of the 15 most-used MCP server packages, 13 document an npx/uvx install and none pin a version — 100% pull "latest" every launch. — would genuinely like to hear what it misses on your configs. https://cavexia.com