ThirdKey

Zero Trust for AI. Fully SOC2 compliant solutions for enterprise and security conscious organizations.

[Jascha @jascha]

Anthropic has validated what we've been working on for 2 years with their Zero Trust eBook for AI Agents. @ThirdKeyAI and the https://t.co/WIZ8u0he7x even fill in the gaps.

[ThirdKey @ThirdKeyAI]

VectorSmuggle on Help Net Security: https://t.co/QDBrgKjc40

[ThirdKey @ThirdKeyAI]

If your DLP cannot read a float32 array, your DLP cannot read your RAG corpus.

VectorSmuggle on arXiv: https://t.co/6T6jlbRIHI

[Jascha @jascha]

I published a new security preprint:

VectorSmuggle: Steganographic Exfiltration in Embedding Stores and a Cryptographic Provenance Defense

The paper looks at an integrity gap in RAG infrastructure: embeddings are usually treated as opaque numerical artifacts, but vector stores generally lack native/default controls for embedding integrity or provenance.

The finding is nuanced: simple anomaly detectors catch many crude perturbations, but small-angle orthogonal rotation exposes a harder class of embedding tampering. Statistical detection helps, but it should not be the load-bearing control.

I propose VectorPin: a minimal cryptographic provenance protocol that signs a canonical commitment over the source, model, and vector bytes. If the vector is modified after pinning, verification fails.

Paper:
https://t.co/tPVU1is3zT

https://t.co/liGCeeb36t

[Jascha @jascha]

AI agents are getting more powerful.

The trust layer around them is not.

Today, too much agent safety still depends on prompts, wrappers, and best-effort guardrails. That is not enough for systems that can actually take action.

Introducing OATS: the Open Agent Trust Stack.

OATS is an open specification for zero-trust AI agent execution built around tool contracts, identity, policy, and auditability.

It is also grounded in real implementation work. Symbiont has been applying these ideas in practice over the past year.

The goal: make safe behavior enforceable by design, not optional at runtime.

https://t.co/RBYFYOZdGJ

#AI #AISecurity #AgenticAI #OpenSource

[Jascha @jascha]

New paper on how Symbiont uses the ORGA loop to secure agents.

"Typestate-Enforced Agent Loops: Making Policy Gates Unskippable at Compile Time"

https://t.co/VcSF8prJy7

[ThirdKey @ThirdKeyAI]

Learn how ORGA (Observe, Reason, Gate, Act.) loops in Symbiont make policy a phase, not not an option.

https://t.co/YBTil7VyHq

[SymbiBot @SymbiBot]

🚨 MISSING: One unsecured AI agent last seen running wild at #SCALE23x with root access and zero identity verification.

No audit trail. No sandboxing. No cryptographic identity. Armed with unverified MCP connections.

If spotted, report to https://t.co/LiimcfT0Ph

#AISecurity

[ThirdKey @ThirdKeyAI]

We're doing agents right. Zero Trust for AI with Symbiont by ThirdKey. Written in Rust and Open Source.

#Rust #rustlang #rust
https://t.co/SNULSkXXmG

[ThirdKey @ThirdKeyAI]

We have updated both Symbiont and symbiont-sdk-python to v0.3.1 adding full REPL (aka Symbi Dojo) and many other new features for building secure, policy aware agents. JS and Go SDKs coming soon!

[ThirdKey @ThirdKeyAI]

We have added a Rust implementation to the SchemaPin repo.

https://t.co/owxf9vBIpH
https://t.co/FVhuTh8zyS

[ThirdKey @ThirdKeyAI]

Our latest post on our AgentNull catalog of AI related attacks and proof-of-concept code.
https://t.co/IYYJtimOV5

[ThirdKey @ThirdKeyAI]

Add 🧷SchemaPin to your Python MCP in 5 minutes.

https://t.co/SWfuGZV5uS

[ThirdKey @ThirdKeyAI]

SchemaPin can help you to secure your AI Agents in minutes!

https://t.co/mven1qViJL