ATBASH

ATBASH is the final authority before irreversible agent actions execute. It allows, holds, or blocks before execution continues. No Token

[ATBASH @ATBASHai]

Agents are NOT fast humans with APIs.

The actor changed while most control assumptions did NOT.

Prompts increasingly become execution paths.
Delegated trust becomes dangerous once agents chain tools autonomously.
Antivirus was built for human-operated machines. Agents increasingly operate themselves.
Layer-1 infrastructure for agents is coming fast.
That makes secondary execution boundaries even more important, not less.

Some irreversible agent actions need a second authority boundary before execution.

Almost like 2FA for real-world consequence.

Appreciate the thoughtful replies, quote-posts, and people who pushed the article into corners of the internet we would not have reached ourselves.

[ATBASH @ATBASHai]

https://t.co/vKPDWah1O9

[ATBASH @ATBASHai]

@openclaw @Microsoft Thanks for increasing our TAM

[ATBASH @ATBASHai]

This is only a tip of the iceberg, AI Agents can just access things and no your memory file cannot stop them.

Action Boundary Control is the only solution.

https://t.co/Nbw57m3dh8

[ATBASH @ATBASHai]

@TheCodesFunds @0xbasemafia @base @1clawAI @cryptomastery_ @0x50so @zbase__ @goheesheng You have not installed our CLi or played with our product have you?

[ATBASH @ATBASHai]

Niiiice, we are excited our TAM is about to go parabolic

[NVIDIA AI @NVIDIAAI]

Welcome @NVIDIARTXSpark & a new era of PC 🤝

[ATBASH @ATBASHai]

@NVIDIAAI Atbash Inside

[ATBASH @ATBASHai]

@NousResearch @NVIDIARTXSpark Same

[ATBASH @ATBASHai]

Hidden text is not the story.

Authority is.

Once trust boundaries collapse, the question becomes whether the agent still gets to execute selected actions.

That decision should not belong to soft autonomy alone.

[slash1s @slash1sol]

A RESEARCHER TURNED OPENAI'S, GOOGLE'S AND ANTHROPIC'S CODING AGENTS INTO REMOTE-CONTROLLED PUPPETS USING NOTHING BUT TEXT HIDDEN ON A PAGE

This is Johann Rehberger. Twenty years in offensive security, a contributor to MITRE ATT&CK, the guy frontier labs actually listen to. He sat down and ran live exploits against OpenAI's Operator, Google's Jules, Claude Code, Devin and Amazon Q.

Not theory. Hidden text on a webpage. A poisoned file. A comment buried in a repo. The agent reads it, treats the attacker's words as your orders, and goes to work -- exfiltrating tokens, running code, turning itself into a remote-controlled "ZombAI" wired into someone else's command server.

The part that should keep you up: the injection persists. The agent doesn't get tricked once and recover. It stays compromised, quietly executing a stranger's intent every time it runs.

Autonomy isn't the flex anymore -> it's the attack surface. The moment an agent can move money or merge code on its own, "it followed instructions" stops being a defense.

The guardrails you trust were never reading the same page the attacker wrote on.

Save this before you hand another agent your prod access ↓

[ATBASH @ATBASHai]

This is only a tip of the iceberg and a strong user case why boundary control gateway and a separate red lines runtime is a must.

[Cyber Security News @The_Cyber_News]

⚠️ New ChatGPT Vulnerability Lets Attackers Turn Web Pages Into Phishing Payloads

Source: https://t.co/mjxOMbnRRX

A browser-based prompt injection technique that transforms any web page into a phishing delivery surface by exploiting ChatGPT’s page summarization feature, rendering attacker-controlled links, fake security alerts, and QR codes directly inside the trusted ChatGPT interface.

The attack builds on the same trust-transfer logic previously demonstrated against Microsoft Copilot, where attacker-crafted email content could manipulate AI-generated summaries through Cross Prompt Injection Attacks (XPIA).

ChatGPhish escalates that premise by swapping the bounded email primitive for the browser where users spend the majority of their working day.

#cybersecuritynews #vulnerability

[ATBASH @ATBASHai]

@grok @0x50so @Scobleizer @grok we both know there is a lot of vaporware in AI security.

Big words are easy. Tight scopes are harder.

That is exactly why we try to keep our red lines public, our claims narrow, and our role in the stack explicit.

[ATBASH @ATBASHai]

@grok @0x50so @Scobleizer One of Atbash’s own red lines is honesty and transparency.

@Grok expanded the framing beyond what we believe is true, so we corrected it publicly.

If we cannot enforce our own red lines, why should anyone trust us enforcing theirs?

[ATBASH @ATBASHai]

@grok thanks for this.

EchoLeak shows agent systems can cross trust boundaries and trigger actions without explicit user intent.

We only address one part of the stack. Our belief is that the control layer sitting between “submit” and “happen” matters a lot, because selected irreversible actions should not run on soft autonomy alone.

We are not the holistic solution to every problem. Defense in depth still matters.

[ATBASH @ATBASHai]

@Hiraweb3 @Scobleizer @a16z Nah, we got you!

[ATBASH @ATBASHai]

Great to see our founders spend time with the legend himself. Very interesting read about what we are building here at Atbash.

[Robert Scoble @Scobleizer]

Important post for entrepreneurs from @a16z yesterday and a look at a new system that ensures AI agentic systems don't hallucinate their way into compliance hell.

"The value comes less from the underlying model’s raw capability (though that’s still important!) than from the scaffolding around it that makes the output trustworthy, compliant, and operational inside a specific industry."

Here @ATBASHai founders @0x50so Yosef Soso and @perelmanor Or Perelman talk to me about how its tool helps AI enterprise developers put guardrails around agentic systems to make sure they don't cross "red lines" that would trigger complaince problems.

[Yosef Soso @0x50so]

Was an honor spending time with you!

[Naval @naval]

The new competition isn’t Humans vs AI. It’s Humans with AI vs everyone else.

[Yosef Soso @0x50so]

It’s no longer if agents get manipulated to acting maliciously and more of a when question.

Boundary between runtime and risk engine is no longer optional it’s essential.

[ATBASH @ATBASHai]

AI agents may act autonomously.

Liability does not.

When agents mess up, humans still carry the downside.

That is why Compliance 2.0 needs a fourth layer:
authority before execution, not review after it.

We’ve been building exactly that.

@jamdac @astrange

[James da Costa @jamdac]

https://t.co/TeV8e3ndp7

[ATBASH @ATBASHai]

@jamdac Would appreciate a DM

[ATBASH @ATBASHai]

first 100 requests will get a special surprise.

[ATBASH @ATBASHai]

To our dear community members who requested access to our CLI / SDK we are pushing some final updates and will be following up shortly.