Beon de Nood

Building infrastructure for the agentic economy. Founder @capiscio. Real tools, not hype.

[CapiscIO @capiscio]

What a rush! Our official brand and product launch in Startup Row at @pycon 🐍🙌 Thank you to everyone who stopped by to learn about the AI security infrastructure we are building. And congrats to our 2 giveaway winners!

[Beon de Nood @beondenood]

Still a “pinch me” moment to see my brand on Startup Row at PyCon this year 🚀 Let’s goooo! @capiscio

[PyCon US @pycon]

We're excited to highlight our line up of exciting Startup Row participants at #PyConUS 2026 🤩🐍 Joining us this year? Make sure to stop by to connect with the folks behind these startups!

@subimagesec
@skyvernai
@arcjet
@capiscio
Tetrix
@ChonkieAI
@TimeCopilot
@pixeltablehq

[Beon de Nood @beondenood]

@TheGeorgePu Nobody wants to like this.. lol. But its true. We all need to sober up on data privacy. The first large scale AI user data breach is going to be devastating.

[Feross @feross]

🚨 CRITICAL: Active supply chain attack on axios -- one of npm's most depended-on packages.

The latest [email protected] now pulls in [email protected], a package that did not exist before today. This is a live compromise.

This is textbook supply chain installer malware. axios has 100M+ weekly downloads. Every npm install pulling the latest version is potentially compromised right now.

Socket AI analysis confirms this is malware. plain-crypto-js is an obfuscated dropper/loader that:

• Deobfuscates embedded payloads and operational strings at runtime
• Dynamically loads fs, os, and execSync to evade static analysis
• Executes decoded shell commands
• Stages and copies payload files into OS temp and Windows ProgramData directories
• Deletes and renames artifacts post-execution to destroy forensic evidence

If you use axios, pin your version immediately and audit your lockfiles. Do not upgrade.

[Beon de Nood @beondenood]

@_nikhilsheoran Agree on the failure mode. The next problem is that workflow-specific tools each need their own auth surface. You end up with 12 tools, 12 permission models, and the composition layer inheriting all of it.

[Beon de Nood @beondenood]

@nohypeguy @HiTw93 Routing is step one. What comes next is that tool output from agent A becomes part of agent B's context, and suddenly permissions you scoped to A are implicitly available in B's call. Most routing systems don't model that.

[Beon de Nood @beondenood]

@a_protsyuk Context management becomes a security question once agents share a knowledge base. You're not just asking 'can the agent access this?' but 'can it pull context from another agent's scope?' That boundary is invisible in most frameworks.

[Beon de Nood @beondenood]

@nyk_builderz Audit trail is the retrospective layer. The harder problem is scope enforcement that holds at call time, especially when agents are spawning sub-agents. That's where most systems discover their controls were advisory, not enforced.

[Beon de Nood @beondenood]

@Nicolascole77 That one cuts both ways. You need both.

[Beon de Nood @beondenood]

@nozmen Thats what replying to trending tweets is for

[Beon de Nood @beondenood]

@emadgnia Any AI not earning it's keep is dead. And by earning its keep.. generating enough revenue to justify the full cost of running it. We are already seeing that heavy subsidizing (like OpenAI) is not a moat.. it never will be.

[Beon de Nood @beondenood]

Every "agent identity" solution at RSAC this week is IAM with a new name.

The hard part isn't proving who the agent is. It's proving what it's authorized to do right now - under this delegation, in this context, at this moment.

Provisioning-time policy doesn't survive runtime.

#AgentSecurity #RSAC2025

[Beon de Nood @beondenood]

@haroonmeer Placeholder is generous. Half the "agent governance" announcements were IAM renamed. Runtime enforcement is what nobody has shipped yet.

[Beon de Nood @beondenood]

@emadgnia @svpino Exactly. And it gets worse with agents: now the thing you own can generate its own mistakes at scale. Debugging "the agent made a bad call" is different from debugging bad code. Senior judgment has to stretch to cover system behavior, not just system state.

[Beon de Nood @beondenood]

@hayatbosknkk Right call. The LLM is doing pattern work, not path work. That separation is what makes it survivable in production. The mistake is using it in both layers and then wondering why your p99 looks like that.

[Beon de Nood @beondenood]

@LilithDatura The harness is also where identity lives. Framework routes the tool call. Harness decides whether that specific agent was allowed to make it at all. Most builders skip that layer entirely until something goes sideways.

[Beon de Nood @beondenood]

@boyuan_chen Pattern holds everywhere. The gap closes the moment the agent has write access to the actual system. What opens is the trust question: who authorized this agent to touch production? That's where most implementations start punting.

[Beon de Nood @beondenood]

@XNiarora The runaway problem is almost always a missing cost circuit breaker, not a model problem. What does your architecture look like at the control layer - hard token limits per task, something upstream?

[Beon de Nood @beondenood]

@saen_dev @thevigneshk Durable execution fixes the retry problem but still leaves you debugging 'what state was the agent in when it died?' You need checkpointing + the execution log to reconstruct. Without both, you're still guessing.

[Beon de Nood @beondenood]

@fanghandx @openfangg The WASM sandbox + RBAC combo is the hard part most skip. What's the permission model when one Hand delegates to another? Does the caller's scope propagate or does the callee get a fresh grant?