Mark Manning

Process isolationist, k8s hacker, ᴎo-prem pusher, syscall denier, guarder of chains
🔸Chainguard - Product Security
🔸Rochester 2600
🔸Former: Snowflake, NCC

[Mark Manning @antitree]

I'll be there. Whether you want me or not. Should be warm enough for some other tom foolery.

[Rochester 2600 @roc2600]

It's that time. Time to hack and complain about the state of the industry. Join us Friday, the day before @BsidesBuffalo , for another installment of Rochester 2600 where everything's synthesized and the tokens don't matter.

https://t.co/GrvhFwEOPN

[Mark Manning @antitree]

Check out that secion 4 doubling down on computer fraud and abuse act...

https://t.co/4k6kSvu0Iz

[Chainguard ⛓️ @chainguard_dev]

Chainguard customers are unaffected by today’s wave of Mini Shai-Hulud, which impacts 32 redhat-cloud-services projects and 90+ versions.

Get the details: https://t.co/e4efgThHjm

[Mark Manning @antitree]

@AppSec_Village @defcon Just to confirm, the website says submissions closed but sessionize is still open, you are still open till midnight right?

[Mark Manning @antitree]

When major exploits are going to be a dime a million, old school exploits will rule. I'm investing my research time into how to make the CAP locks light on your keyboard appear on.... BUT IT'S NOT!

[Michael Weber @BouncyHat]

The post covers a Claude skill which was used to shed static signatures on these WASM-ized binaries. While the tool isn't live yet, the skill which helped shield it is live right now.

https://t.co/DiyEcFcQCE

[Mark Manning @antitree]

Yes this is my employer but yes I agree with it. I don't care about your money just read the article

[Chainguard ⛓️ @chainguard_dev]

AI models like Mythos can find hundreds of vulnerabilities overnight — across thousands of projects with one maintainer and no obligation to patch anything. We're not ready for that.

More on the hardest fork yet: https://t.co/8f7yut6sDk

[Luke Hinds @decodebytes]

https://t.co/ihPg1bKOZj often ends up in comparison articles where its pitched against microVMs, within a very loose rag-tag bunch known as "Agent Sandboxes" - but the truth is, this is like comparing the fly-by-wire limits built into an aircraft control system to an end-of-runway concrete barrier - one governs every control input from within, in real time; the other stops things outside from going wrong when the plane runs out of runway.

A microVM guards the host. What happens inside, is not really its concern or duty to protect . If data is exfiltrated to unknown endpoints, destructive tool calls are made, an agent malfunctions and racks up eye-watering LLM api costs, and then deletes your database - you can't really blame the VM. You got what you signed up for - strong, monolithic, isolation. Not internal governance.

So nono operates at a completely different point in the security model: inside. It enforces capability-based, fine-grained policy, to intercept sensitive or destructive operations, and it audits what the agent is actually doing with tamper resistant , cryptographic claims (the blackbox recorder!). The question isn't "how contained is the damage" - it's "does the agent get to do this at all, in this particular context."

They answer different questions entirely: A VM answers, "if malicious code executes, how do we contain the blast radius from breaching the host and adjacent tenants?" nono answers, "how do I give the agent some authority to use a tool to access AWS credentials and call its APIs, but not allow the same access when its curl using the POST method to send your production credentials in a payload to a public github issue.

Docker not long back announced "we launched Docker Sandboxes with a bold goal: to deliver the strongest agent isolation in the market." That's Great! However, it's not really what your AI weary CISO needs to sleep better at night. Instead, it's resolving a problem that's already mostly solved - in a claimed, much stronger way. AI agents aren't highly focused on breaking isolation, something very difficult to achieve; they want to steal keys and cause wreckage from the inside. Want to see what the future malicious agent looks like? Go check out TeamPCP and their recent pursuits - they aren't bypassing hardware-level isolation with a zero-day, they're letting npm install do the job by executing a post-install scripts to exfiltrate your CI tokens.

BUT - they also harmonise and are formidable when combined - which is why teams and orgs are now deploying nono directly onto AWS Fargate / Firecracker, and hardened Kubernetes bound images - one holds the perimeter; the other governs what runs inside it. You get to sleep a bit easier at night.

If you interested in learning more and working with us to help shape a new approach for a new threat - we are now accepting a limited number of design partners to help us shape the future of AI Agent Security.

[Aaron Grattafiori @dyn___]

https://t.co/2RhuRWOHrZ

151... with 137 by Google.

Hopefully they'll share more about their technique at some point. Even if it's via Glasswing/Mythos although they might not say so if that's the case.

[Clint Gibler @clintgibler]

📚 tl;dr sec 330

🧑🏻‍💻 AWS Pathfinding Labs,
🤖 Running Codex Safely at @OpenAI,
🛡️ Glasswing Updates

https://t.co/SGgrNYs01U

[Mark Manning @antitree]

@GabrielLandau After Mythos, they will be even more laughable. "You mean you emailed them, then waited for a reply, and then sent them a GPG encrypted message over a two week period?" LOL

Imagine doing this 1,000 times a week.

[solst/ICE of Astarte @IceSolst]

The sole purpose of disclosure is letting the vendor know, and communicating the risk well enough that they can make the right call around remediation

Everything else is theater, I don’t give a shit about CVEs
Imagine pentesters asking for a CVE for each of their findings

[Mark Manning @antitree]

I still can't get over some of the people that are going to be leading the world in a post-mythos world are still meme'ing on main like they're 15 years old

[Chainguard ⛓️ @chainguard_dev]

Thrilled to be recognized in @Redpoint's 2026 InfraRed 100 list, highlighting 100 of the most promising private companies in AI infrastructure.

Congratulations to all the companies featured this year!

[Mark Manning @antitree]

When you get a message from your CTO "COME AT ME BRO" you know you work for an awesome company

[Mark Manning @antitree]

I'm not aligned with the phases here but the intent is correct. The bigger point is you will be working with all 4 of these phases of people at any given time and figuring out how to communicate and collaborate with them is your task.

[Florian Roth ⚡️ @cyb3rops]

I think AI coding hype follows roughly four stages:

1. Amazement

You try it and can’t believe how much code it generates from a few prompts.

2. Expansion

You start more and more projects because shipping suddenly feels cheap and fast.

This is also the phase where people start convincing everyone around them:

- coworkers
- management
- friends in other companies

because nobody wants to “fall behind” in 6–12 months.

That creates a massive snowball/FOMO effect.

3. The grind phase

You realize the generated code has architectural issues, sloppy mistakes, weird abstractions, duplicated logic, broken edge cases, etc.

So you start:

- re-prompting
- switching models
- increasing reasoning effort
- reviewing fixes
- generating fixes for previous fixes

And suddenly you spend your days reviewing AI-generated pull requests instead of building software.

4. Realization

You realize AI coding increases output much faster than it increases certainty.

The code still needs:

- review
- testing
- ownership
- architectural understanding
- long-term maintenance

Usually by expensive senior engineers.

And the interesting thing is:
this whole cycle can take many months or even more than a year because people become socially and professionally invested in the narrative themselves.

Once teams, managers, and entire companies have been convinced that this is the future, it becomes psychologically and politically very hard to later say:

“Actually, the ROI is much lower than we expected.”

[Florian Roth ⚡️ @cyb3rops]

I think AI coding hype follows roughly four stages:

1. Amazement

You try it and can’t believe how much code it generates from a few prompts.

2. Expansion

You start more and more projects because shipping suddenly feels cheap and fast.

This is also the phase where people start convincing everyone around them:

- coworkers
- management
- friends in other companies

because nobody wants to “fall behind” in 6–12 months.

That creates a massive snowball/FOMO effect.

3. The grind phase

You realize the generated code has architectural issues, sloppy mistakes, weird abstractions, duplicated logic, broken edge cases, etc.

So you start:

- re-prompting
- switching models
- increasing reasoning effort
- reviewing fixes
- generating fixes for previous fixes

And suddenly you spend your days reviewing AI-generated pull requests instead of building software.

4. Realization

You realize AI coding increases output much faster than it increases certainty.

The code still needs:

- review
- testing
- ownership
- architectural understanding
- long-term maintenance

Usually by expensive senior engineers.

And the interesting thing is:
this whole cycle can take many months or even more than a year because people become socially and professionally invested in the narrative themselves.

Once teams, managers, and entire companies have been convinced that this is the future, it becomes psychologically and politically very hard to later say:

“Actually, the ROI is much lower than we expected.”

[Mark Manning @antitree]

Ansel Adams angry about AI art generated using his photos is next level 2026.

https://t.co/2eCFDxrRWz

[Mark Manning @antitree]

There's going to be a couple of deaths in a post-Mythos world. One of them is Wordpress -- the entire ecosystem, it's plugins, their developers and probably their next of kin just to make sure it's finished the job.

[ᴅᴀɴɪᴇʟ ᴍɪᴇssʟᴇʀ 🛡️ @DanielMiessler]

https://t.co/Z9PifrRfTW