A personal blog about technology, programming, and life.https://ugorange.com/https://ugorange.com/en/blog/pcfi-prompt-injection/https://ugorange.com/en/blog/pcfi-prompt-injection/A paper that brings the concept of Control-Flow Integrity (CFI) from software security to prompt defense. Core insight: Prompt Injection is fundamentally a structural problem — low-priority inputs hijacking the execution flow of high-priority instructions.Mon, 30 Mar 2026 00:00:00 GMThttps://ugorange.com/en/blog/runtime-agnostic-agent/https://ugorange.com/en/blog/runtime-agnostic-agent/While everyone debates whether to choose LangChain or Claude Code, we took a different path — defining two universal contracts that allow any Coding Agent to serve as the platform's execution engine.Mon, 30 Mar 2026 00:00:00 GMThttps://ugorange.com/blog/pcfi-prompt-injection/https://ugorange.com/blog/pcfi-prompt-injection/一篇把软件安全中的控制流完整性（CFI）思想搬到 Prompt 防护的论文。核心洞察：Prompt Injection 本质上是一个结构性问题——低优先级输入篡改了高优先级指令的执行流。Mon, 30 Mar 2026 00:00:00 GMThttps://ugorange.com/blog/runtime-agnostic-agent/https://ugorange.com/blog/runtime-agnostic-agent/当所有人都在争论该选 LangChain 还是 Claude Code 时，我们选择了一条不同的路——定义两个通用契约，让任何 Coding Agent 都能成为平台的执行引擎。Mon, 30 Mar 2026 00:00:00 GMThttps://ugorange.com/en/blog/agent-observability-4/https://ugorange.com/en/blog/agent-observability-4/This is the final article in the Agent Observability series, exploring how to go from data to judgment - cost attribution, behavioral baselines, anomaly detection, and making observability truly operational.Wed, 31 Dec 2025 00:00:00 GMThttps://ugorange.com/blog/agent-observability-4/https://ugorange.com/blog/agent-observability-4/这是 Agent 可观测性系列的最后一篇文章，探讨如何从数据走向判断：成本归因、行为基线、异常检测，以及让可观测性真正可运营。Wed, 31 Dec 2025 00:00:00 GMThttps://ugorange.com/en/blog/agent-observability-3/https://ugorange.com/en/blog/agent-observability-3/This is the third article in the Agent Observability series, exploring three paradigms of data collection, the misalignment between audit and runtime, and the design principle that reconstructability is better than full collection.Wed, 24 Dec 2025 00:00:00 GMThttps://ugorange.com/blog/agent-observability-3/https://ugorange.com/blog/agent-observability-3/这是 Agent 可观测性系列的第三篇文章，探讨数据采集的三种范式、审计与运行时的错位问题，以及可还原性优于全量采集的设计原则。Wed, 24 Dec 2025 00:00:00 GMThttps://ugorange.com/en/blog/agent-observability-2/https://ugorange.com/en/blog/agent-observability-2/This is the second article in the Agent Observability series, exploring four core objects in the Agent world - Agent, Model Source, Tool, and Agent-to-Agent Link.Wed, 17 Dec 2025 00:00:00 GMThttps://ugorange.com/blog/agent-observability-2/https://ugorange.com/blog/agent-observability-2/这是 Agent 可观测性系列的第二篇文章，探讨 Agent 世界中的四类核心对象：Agent、Model Source、Tool、Agent-to-Agent Link。Wed, 17 Dec 2025 00:00:00 GMThttps://ugorange.com/en/blog/agent-observability-1/https://ugorange.com/en/blog/agent-observability-1/This is the first article in the Agent Observability series, exploring the core challenges of observability in the Agent era - uncertainty, semantic gaps, and data silos.Wed, 10 Dec 2025 00:00:00 GMThttps://ugorange.com/blog/agent-observability-1/https://ugorange.com/blog/agent-observability-1/这是 Agent 可观测性系列的第一篇文章，探讨 Agent 时代可观测性面临的核心挑战：不确定性、语义鸿沟和数据孤岛。Wed, 10 Dec 2025 00:00:00 GMThttps://ugorange.com/en/blog/runc-cve-2025-31133/https://ugorange.com/en/blog/runc-cve-2025-31133/An in-depth analysis of three critical runc vulnerabilities disclosed in November 2025, exploring their attack mechanisms, exploitation methods, and remediation recommendations.Wed, 03 Dec 2025 00:00:00 GMThttps://ugorange.com/blog/runc-cve-2025-31133/https://ugorange.com/blog/runc-cve-2025-31133/深入分析 2025 年 11 月披露的三个 runc 高危漏洞，探讨其攻击原理、利用方式及修复建议。Wed, 03 Dec 2025 00:00:00 GMT