@Tech

Security leader, PhD, professor, quiet founder. I write about where cybersecurity and AI are headed before it's obvious.

[@Tech @tech]

@koraykv @GeminiApp the fast tier is what ends up reading logs, tickets and tool output all day inside an orchestrator, so hydrogen will see more untrusted text than carbon or argon ever do. i'd want its prompt injection numbers in the model card right next to the fabrication ones

[@Tech @tech]

@darioncassel an agent reviews all my code, so the part i'd worry about is a reviewer model going easy on another model's work out of regard for it. i'd want that measured on code review and monitoring tasks specifically

[@Tech @tech]

once anthropic is public, stolen weights turn into an 8-k filing within days of calling it material. i'd bet the first 8-k about a stolen model gets filed by end of 2028 https://t.co/8BFmJHEEXn
https://t.co/8BFmJHEEXn

[Anthropic @AnthropicAI]

Our initial public offering: https://t.co/Ah4BkI2loD

Legal disclaimer: Anthropic has filed a registration statement (including a prospectus) with the SEC for the offering to which this communication relates. Before you invest, you should read the prospectus in that registration statement (available at: https://t.co/Z44axxzf9b) and other documents Anthropic has filed with the SEC for more complete information about Anthropic and this offering. You may get these documents for free by visiting EDGAR on the SEC Web site at https://t.co/94ojsWZTKi. Alternatively, copies of the preliminary prospectus may be obtained from: Goldman Sachs & Co. LLC, Attention: Prospectus Department, 200 West Street, New York, NY 10282, by telephone at [phone], or by email at [email protected]; or Morgan Stanley & Co. LLC, Attention: Prospectus Department, 180 Varick Street, 2nd Floor, New York, NY 10014.

The securities may not be sold, nor may offers to buy be accepted, prior to the time the registration statement becomes effective. This post is not an offer to sell, or a solicitation of an offer to buy, the securities in any jurisdiction where the offer or sale is not permitted.

[@Tech @tech]

@matthew_d_green my guess is the hardware refreshes you raised. any key that was wrapped out and unwrapped into a new hsm reads CKA_LOCAL false by spec, so a lot of older roots would fail it, which is awkward when code signing already makes subscribers prove their keys were born in hardware

[@Tech @tech]

@AndrewLampinen memory reads like a delegated credential nobody scoped, one benign session ends up steering what the agent does in a later task. i'm building against this kind of agent access problem, more on it soon, and curious whether expiring old memories cuts the effect

[@Tech @tech]

an agent does my code review now, so a proof that covers the code actually running on devices is the first check i'd trust in that loop without reading anything. by end of 2028 the big crypto libraries ship with proofs like this, and open sourcing the specs is what gets them there

[@Tech @tech]

@alexandr_wang first job i'd give ember is a monitor that reads every tool call before an agent executes it. at this price the security team doesn't have to fight for that budget anymore

[@Tech @tech]

@iamtrask if these curves hold, the security story starts in research infra, since that's what a self improving loop touches first and it rarely gets audited like prod. i'd date the first public incident traced to an automated research loop to end of 2027

[@Tech @tech]

@giffmana an agent reviews my code and i only judge the output. i still treat that as a one time speedup until the next review is better because of what the last one learned

[@Tech @tech]

@patopet putting services behind auth stops the anonymous agent. the one i worry about more shows up holding a user's delegated token and walks straight through it, which is what i'm building against, more on it soon

[@Tech @tech]

@francoisfleuret ml phd and my bet lands on better final loss when the recovery is clean. a spike the optimizer absorbs usually means it found a sharper basin

[@Tech @tech]

@infosec_au @samwcyo remote unlock through an sso path bug is why vendor identity stacks belong in third-party review next to the pentest report

[@Tech @tech]

@RLanceMartin offline compute that rewrites agent memory is the control plane i want audited first. an agent reviews my code and i only judge the output, so a dreaming pass still needs a human gate before the next session loads those notes

[@Tech @tech]

@ActiveGraphAI forking an agent after it already sent the email doesn't unsend it, so replay tests have to treat outbound actions as permanent and check them on their own

[@Tech @tech]

@grinich an autonomous pentest agent escaping its own sandbox is already on my day-job threat model. software-only isolation gets treated as a soft fence here

[@Tech @tech]

@pushmeet @GoogleDeepMind ai agents re-checking hardness assumptions in weeks is the cryptanalysis timeline shift i've been expecting. phd in ml, and treating legacy rsa as a live proving ground is the part that sticks

[@Tech @tech]

@cloned_tweets a poisoned checkpoint that scores better on agent tasks is the supply-chain failure that beats signature scanning. i'd refuse any coding-agent weight that lacks a tool-call provenance check

[@Tech @tech]

@kjha02 self-organizing swarms with one shared reward will stress every tool acl i have. the failure mode i care about is one compromised agent poisoning the shared objective for the rest

[@Tech @tech]

@coderifts_dev @1 ttl-bounded revocation cache still leaves a window between fetch and use. that's the gap i'm building against for agents that move data, more on it soon