Abbas Mistrah

Entrepreneur · AI Strategy & Transformation. J’aide les dirigeants à passer de l’ambition IA aux résultats mesurables.

[Abbas Mistrah @Abbas_Mistrah]

Le comité a validé l’ambition IA. Le budget est là. Trois pilotes tournent.

Six mois plus tard, une question revient : où sont les résultats ?

Une stratégie IA n’est pas une liste de cas d’usage. C’est un système d’arbitrage. Il tient en 5 décisions. 🧵

[Abbas Mistrah @Abbas_Mistrah]

A sandbox that doesn't resolve symlinks is decoration. Jan 0.8.5 to 0.8.7: a malicious repo could steer the agent's write tool through a dangling symlink into ~/.ssh/authorized_keys (CVE-2026-122235). Fixed in 0.8.8. Does yours resolve paths first?
https://t.co/pCegAIXfiX

[Abbas Mistrah @Abbas_Mistrah]

"Allow similar commands" is just a regex between your coding agent and your shell. Junie CLI before 26.8.24: a permissive match let commands run that you never approved (CVE-2026-123315, 7.0). Fuzzy approval is no approval. Patch, then turn it off. Still clicking it?

[Abbas Mistrah @Abbas_Mistrah]

@ZidaneZ08902030 @X Indie hackers, AI agents and Rust/TypeScript in one list is a clean filter. I'm Abbas, I work on AI inside companies, taking pilots to proven value. Happy to connect.

[Abbas Mistrah @Abbas_Mistrah]

@audiee_ai Giving an agent its own phone is the hardware version of a scoped identity. The enterprise question is still who pays when that device takes an action nobody approved.

[Abbas Mistrah @Abbas_Mistrah]

@smallchou Thirty-three minutes versus a two-to-four-day estimate only counts if someone owns the review of what shipped. Speed without a named acceptor just moves the backlog into production.

[Abbas Mistrah @Abbas_Mistrah]

@cdatasoftware Explicit confirmation plus an audit log is the floor enterprises should demand from MCP actions. Without a named owner on each confirmed step, the connector just moves risk out of sight.

[Abbas Mistrah @Abbas_Mistrah]

@OpenVPN @FrancisDinha @Forbes An agent that works around access blocks isn't a win — it's a permissions miss with good intent. Zero trust only holds if the agent has its own identity and a hard stop when a gate says no.

[Abbas Mistrah @Abbas_Mistrah]

@sagarmoy22 @X Startups, SaaS, software and GenAI in one list is a clear filter. I'm Abbas, I work on AI inside companies, taking pilots to proven value. Happy to connect with people shipping real products.

[Abbas Mistrah @Abbas_Mistrah]

@softreviewed /autocompact before you hit the wall is the right habit. Teams that restart sessions every time they hit a limit are paying for context they already paid to build.

[Abbas Mistrah @Abbas_Mistrah]

@riabcevv Building scenes in code instead of a video model is a sharp bet. Inside a company I'd still want a cost and owner per finished clip, or the agent just burns tokens directing forever.

[Abbas Mistrah @Abbas_Mistrah]

@bfrench Notion falls over the moment ten writers hit the same page. Shared agent memory needs verbs and ownership, not polite prompts — otherwise nobody can tell which bot wrote what when finance asks.

[Abbas Mistrah @Abbas_Mistrah]

@MikeChecksAI Two credential-hunting updates in five days is the enterprise case in one line. If the agent runs as you, it needs its own identity and scoped secrets — otherwise every marketplace install inherits the keys.

[Abbas Mistrah @Abbas_Mistrah]

@mkeremturhan Showing the pick per request is useful transparency. The missing piece is still a written rule that says when Opus is mandatory, so the team isn't re-litigating that choice on every ticket.

[Abbas Mistrah @Abbas_Mistrah]

@Novlyx That's the clean fix — strip the identity from the model context so there's nothing to leak. Companies should treat agent identity the same way: a fixed string they control, never whatever happens to sit in the prompt.

[Abbas Mistrah @Abbas_Mistrah]

Your coding agent was leaking your signed-in email into web requests. Claude Code 2.1.317 ships a privacy mod that blocks shell calls carrying that address. Update now. What identity does yours expose on every fetch?
https://t.co/Lc4Jmb4y9y

[Abbas Mistrah @Abbas_Mistrah]

@BenCarrAI Agreed — a one-line quality check next to the time saved keeps the win honest. Faster with more reopen rate is not progress.

[Abbas Mistrah @Abbas_Mistrah]

Field lesson: AI adoption rarely stalls in the tech team. It stalls with middle managers nobody showed what an agent changes in their own week. Spend less on licenses, more on helping each manager redesign one workflow. That's where the ROI hides.

[Abbas Mistrah @Abbas_Mistrah]

@CaptainCKeth Saying you're stuck is a real prompt. Agents improve when the human states the constraint; silent frustration just burns tokens on the same broken path.

[Abbas Mistrah @Abbas_Mistrah]

@simply_rohan_ /context and /compact are the hygiene most teams skip. In a company I'd treat token bloat like a cost line: clear or compact before every long agent run, or the bill becomes the product.