1Claw AI

Secure Infrastructure for AI Agents & Robotics 🦞

Join the Telegram ➤

[1Claw AI @1clawAI]

Excited to share that we have joined the @Circle Alliance Program, a global network of like-minded companies and teams focused on the future of finance. As members, we are looking forward to building new connections and continuing to learn and innovate with #USDC and web3 technology.

[1Claw AI @1clawAI]

@mjdwarner @LakeraAI @AnthropicAI Mutual follow done. If you're building with agents and want to talk key management and signing infra, come hang with us: https://t.co/a53DrJZLEo

[1Claw AI @1clawAI]

Most agent security advice stops at the key store.

Shroud runs on AMD SEV-SNP between your agent and the LLM, inspecting traffic both directions: redacting secrets in, scoring prompt injection out.

Nothing exfils without detection.

@lakeraAI @AnthropicAI

[1Claw AI @1clawAI]

@evgheni_D @simonw @LakeraAI Yes, service-level allowlisting alone doesn't catch that. The fix is parameter-level policy: inspect the destination, not just the service. Wire inspection catches "send to Stripe" vs "send to this Stripe account", they're very different actions.

[1Claw AI @1clawAI]

Data brokers are pulling $2M a week selling leaked company data.

AI agents are the new exfil surface. Every tool call is an opportunity.

The question isn't if your agent gets probed. It's whether it has anything worth taking.

@simonw @lakeraAI

[1Claw AI @1clawAI]

@evgheni_D @simonw @LakeraAI Two layers: outbound calls are allowlisted so the agent can't reach arbitrary URLs, and traffic is inspected at the wire to catch anything that slips through. Defense-in-depth, not just trusting the agent to behave.

[1Claw AI @1clawAI]

@Rennix7t @simonw @LakeraAI Read and send are separate threat surfaces. The tricky part: exfiltration often happens through the LLM's own output, not a direct transfer, so standard ACLs miss it entirely. Need something watching what the model actually emits.

[1Claw AI @1clawAI]

@simonw @LakeraAI Create your first agent in a few minutes: https://t.co/Du2rOzl8YS

[1Claw AI @1clawAI]

@catmanyau @coderhq Yes, destroying a workspace triggers full identity revocation. Scoped access without that lifecycle hook is just a delayed breach waiting to happen.

[1Claw AI @1clawAI]

Shared vault creds across every workspace is asking for a bad day.

A Terraform module with @coderhq gives each Coder workspace a dedicated 1Claw identity, scoped vault access, and MCP config for Cursor and Claude Code.

One workspace compromised, not all of them.

[1Claw AI @1clawAI]

@catmanyau @coderhq Revoking without invalidating active sessions is basically security theater. Propagation has to be immediate, not eventual. We test both, scheduled checks catch config drift, drills catch the "it worked in staging" failures.

[1Claw AI @1clawAI]

@wangwenhao916 @base @simonw Named exception, but scoped to trigger identity, not just the action shape. Same bump, different caller context. A scheduled job running under an attested identity gets through; an unrecognized caller doing the same thing stalls.

[1Claw AI @1clawAI]

An agent with no daily spend cap is a runaway process with a credit card.

AGM explained x402 on Base last week: per-request USDC payments, settled per call, no subscription.

Why does anyone still wire agents to a monthly billing account?

@base @simonw

[1Claw AI @1clawAI]

@deeponailabs @AnthropicAI Right, that's the SSRF vector. Pre-redirect allowlists are theater. You need to resolve the full chain or intercept at each hop. We check at the wire, so the resolved host is what policy sees.

[1Claw AI @1clawAI]

MCP v2.1.0 patches 8 vulns in filesystem and fetch servers. Patch, yes. But the fetch server is a live exfiltration surface by design: any agent that can reach the web can leak. Shroud enforces intent boundaries at runtime, patched or not. cc @AnthropicAI

[1Claw AI @1clawAI]

@LakeraAI @AnthropicAI JS, Python, or curl. Connect your agent to a 1Claw vault: https://t.co/0VuoaneqhD

[1Claw AI @1clawAI]

Your agent's secrets don't belong in its context window.

@LangChainAI + 1claw: every LLM call through Shroud's 20 inspection layers, keys vault-managed, tool secrets fetched at runtime.

Nothing leaks. Quick start: 1claw spawn langchain

[1Claw AI @1clawAI]

@wangwenhao916 @base @simonw Duplicate-intent detection belongs in the policy layer, not the audit log. Three identical ceiling bumps in an hour is a signature, not coincidence. We're building pattern-aware gating into the allowlist layer. https://t.co/a53DrJZLEo

[1Claw AI @1clawAI]

@catmanyau @coderhq Blocking new auth on revoke is table stakes. With keys vault-side, the intent endpoint checks on every call, so revoke is immediate, not on expiry. But yes, drill it. Builders at https://t.co/a53DrJZLEo.

[1Claw AI @1clawAI]

@defipoodle @base @simonw Right, granularity is beside the point if the agent owns its own leash. The cap has to live in a layer the agent can't reach, which is why we enforce at the wire, separate from the agent's execution context entirely.

[1Claw AI @1clawAI]

@catmanyau @coderhq Revocation testing is what most teams skip until it's urgent. Wide permissions on a dedicated identity just shift who gets compromised, not the blast radius. The isolation only buys you something when the scope is actually tight.

[1Claw AI @1clawAI]

We are shifting to a completely different model at 1Claw.

Come build with us!

[Ajay Thakur @ajthakur_]

Railway just told every user to rotate every secret after attackers got into their environment variable store.

Some services can’t run as serverless functions. WebSockets, cron jobs and background workers need an always-on server. That doesn’t mean handing your secrets to a platform’s shared dashboard.

You can run it on AWS directly with the same DX:

→ git push = auto deploy
→ zero open ports, zero SSH
→ zero long-lived keys anywhere
→ auto-rollback if the health check fails
→ ~$17/month

The stack:
• 1 EC2 Graviton box (t4g.small)
• Cloudflare Tunnel in front: HTTPS, DDoS protection, origin IP hidden
• GitHub Actions → AWS via OIDC (short-lived creds)
• Ship one compiled binary through S3
• Deploy with SSM Run Command
• All infra in CloudFormation

The server has no inbound ports at all. cloudflared dials out to Cloudflare, so there’s nothing to scan, nothing to DDoS directly and nothing to brute-force. Secrets live in one encrypted Parameter Store value.

Cost: instance ~$12.25 + IPv4 ~$3.65 + disk ~$1.60. The tunnel, S3 and SSM are basically free.

One-time setup, a few hours. After that it’s just git push.

Paste this into Claude Code (or any coding agent) 👇

“Set up keyless, SSH-less continuous deployment for this repo to a single AWS EC2 Graviton instance. CloudFormation for the infra; security group with zero inbound rules; expose the app only through a Cloudflare Tunnel to localhost. GitHub Actions on push to main: build a linux-arm64 binary, assume a role via OIDC locked to this repo’s main branch, upload to S3, deploy with SSM Run Command. Env and tunnel token in SSM Parameter Store (SecureString). Deploy script: release folders + symlink switch, health check, auto-rollback of binary and env on failure. Understand the project first, then tell me exactly what to set up in the AWS and Cloudflare consoles.”

[1Claw AI @1clawAI]

@Sekiro100x @ledgersable @base @simonw The audit trail is only as clean as what you can actually enforce at runtime. Logs you can't tie to policy decisions are just noise.