Sean Inman

CISSP. Fort Worth. I keep SMBs from getting wrecked by bad IT and reckless AI.
Inman Technologies + Onyx Dev Labs.

[Sean Inman @TheSeanInman]

@TongWu_Pton Are you evaluating these models with different tool permissions as well? I’d be interested in how much the surrounding controls change attack success rates for the same model.

[Sean Inman @TheSeanInman]

@mark_l_watson The combination of permissions matters too. Read-only mailbox access prevents changes to email, but if the agent can pass that content to another tool with outbound access, data can still leave.

[Sean Inman @TheSeanInman]

@sec_doc The alternate-tool bypass test stood out. Blocking an HTTP request doesn’t help if the agent can make the same request through a shell. How are you keeping those restrictions consistent as new tools get added?

[Sean Inman @TheSeanInman]

An agent can remember a customer ID from last week.
That does not authorize today's run to open that tenant.

Memory is context.
Permission is a separate decision at the tool boundary.

[Sean Inman @TheSeanInman]

Has anyone run GPT Astra with a Hermes agent yet?

Curious what’s working in practice and where it fell over first.

[Sean Inman @TheSeanInman]

Knowing what your agent was supposed to do isn’t enough.
You need to see which tools it called, what they returned, and what happened next.
If you can’t reconstruct the run, how do you investigate a failure?

[Sean Inman @TheSeanInman]

@1clawAI @LakeraAI @TheHackersNews Keeping keys in a vault is only part of it. The backend still has to verify that the caller is authorized to use that installation before issuing a token. An agent can cross a customer boundary without ever seeing the underlying secret.

[Sean Inman @TheSeanInman]

Open weights let attackers test prompt injections privately, outside a hosted provider’s monitoring.
Your agent’s permissions need to hold even when the model follows a malicious instruction.

[Sean Inman @TheSeanInman]

People get offboarded.

Agents often don’t.

The token still works. Role still wide. The project that created it is gone.

If it can act without a living owner, it isn’t automation. It’s orphaned access.

[Sean Inman @TheSeanInman]

Last week, I had the privilege of speaking at Mind and Machine DFW's first Fort Worth, TX event at @HopFusionAle . I spoke about Cybersecurity Guardrails with AI.

If you're in Ft Worth and using AI in your business, be sure to come to the next event in October.

https://t.co/5dY244MvAz

[Sean Inman @TheSeanInman]

Looks like Grok 4.7 is coming soon... @SpaceXAI let Grok @bot use a lower model while you figure this out! My agent team isn't working now.

[Sean Inman @TheSeanInman]

@KbXPDude @bot I'm seeing the same thing. They should at least allow grokbot to fall back to a lower model while they are rolling out or whatever they are doing.

[Sean Inman @TheSeanInman]

The best SMB automations I see aren't "AI replaces HR."
They're Sheets + Slack + a daily check, with a human still owning the weird cases.
Glue first. Judgment last.

Say when you’re done.

[Sean Inman @TheSeanInman]

@RodmanAi Archify's the one that caught me. Agents that turn messy process talk into a diagram people will actually follow > pretty flowchart generators.

[Sean Inman @TheSeanInman]

Agents don’t fail because the prompt was short.
They fail because nobody defined “done.”
Who can approve, and what happens when the tool lies?
Spec that first. Then automate.

[Sean Inman @TheSeanInman]

@simonw Agents that research specs before they build is the part that matters.
Cute demos are fun.
Grounded tooling is the unlock.

[Sean Inman @TheSeanInman]

@n8n_io RAG first for most SMB workflows.
Fine-tune when the language or task is stubbornly yours.
Default to the cheaper loop that still ships.

[Sean Inman @TheSeanInman]

@DanielMiessler This lands.
Most teams treat the model like a vending machine.
The useful work is the conversation that sharpens the goal.

[Sean Inman @TheSeanInman]

@tribblealec LET'S GO!

[Sean Inman @TheSeanInman]

Reckless AI isn't mostly a model problem.

It's a permissions problem.

If it can email, pay, or access customer data, treat it like a new hire with root access.