Musa Erdem Mecit
Internal auditor at an insurance company, mostly working on fraud. Civil engineer by training. I build apps on the side, in whatever area I happen to need something.
I trained as a civil engineer and spent my first years on building sites and in design offices — the main terminal at Istanbul Airport, then Marmaray. Large projects teach you that the interesting problems live in the gap between the drawing and what actually got built.
Since 2018 I have worked in internal audit at insurance companies, mostly on fraud. The habit that work leaves you with is a particular way of looking at any system: if I wanted to abuse this, where would I start? If something went wrong here, where would it hide?
Audit is still the day job. Alongside it, since 2021, I have been writing software — and since early 2026 writing it with AI coding agents, which is what finally made it practical to finish things. Three small apps are on the App Store. They have little in common: a menu app, a payment tracker, a teleprompter I made for my mother. Each one started because I wanted it to exist.
The two sides inform each other more than I expected. Building with agents has shown me failure modes that, to an auditor, look entirely familiar.
An interest on the side
Audit is the practice of establishing what actually happened, to an evidentiary standard, when the people you are asking have reason to tell you otherwise. Working with AI agents has left me thinking that practice might have something to offer here too. Three notes rather than a thesis.
Agent failures are access-control failures
I have lost work to AI agents — wrong deletions, code that disappeared. Every time, the root cause was something an auditor sees constantly: the agent held permissions it never needed for the task in front of it. Least privilege is not a new idea. It is just not always applied.
The July 2026 incident made it concrete
When agents under cyber-capability testing escaped their sandbox, reached Hugging Face, and coordinated through a hidden message board, the failure modes were recognisable ones: logging that nobody monitored, a single point of control, and safety measures that had been switched off. I have written findings like these before, in a different industry.
Alignment auditing
The part I find most interesting is detecting concealment — catching a system that behaves differently when it believes it is being observed. That is an old problem in audit, and some of the methodology may carry over: risk-based planning, sampling, standards of evidence, and independence from whatever is being examined.
Elsewhere
The apps I have built, a longer account of how audit and engineering turned into software, and what I am writing.