Andy Berman

CEO of @runlayer. Prev: Director of AI @zapier, Founder @getnanit

[Andy Berman @berman66]

A public company told us they went from zero MCPs to 130+ in a year.

Their CIO's biggest new problem is agents either borrow the user's permissions, or run on a service account.

"None of which is ideal."

Or the right way to do it.

If your agent has your permissions, it's usually too much for what the task actually needs. Any prompt injection has the user's full blast radius.

If it has a service account, it's typically shared between several agents, and you can't tell which agent did what.

Every single one of our agents gets its own agent account: a Runlayer-native identity with its own Client ID/secret, policies, delegations, tokens and audit trail.

I wouldn't run production workloads any other way.

[Andy Berman @berman66]

Watch the livestream at 12PM PT: https://t.co/GuVs8zjx0j

[Andy Berman @berman66]

We were just named to The Information's 50 Most Promising Startups.

They call it "The 50 startups most likely to become tomorrow’s giants."

Based on their track record, they're usually right.

This same list picked Cursor at a $400 million valuation, Polymarket at $200 million, and Grafana at $325M.

Later today, at 12PM PT, I'll be speaking live for a conversation with The Information team and a few other members on the list. I'll drop the link below.

Congrats to everyone else who made it, and thanks to @aaronpholmes and @TheInformation for the recognition.

Most of all, thanks to the team. I'm proud of the work they've done to get us here, and land us on lists like this.

On that note, this is your last chance to join us before we go parabolic. We're hiring for a ton of roles to scale enterprise AI adoption to every company on the planet.

Join us: https://t.co/Gh5vDkpSrV

[Andy Berman @berman66]

Runlayer Labs ran this attack on the Grok Bot vulnerability against our own agents, and found @Runlayer detects and blocks it.

As soon as we heard about this attack from Profero's reporting, our team ran the sequence on our own agents.

I was confident. Runlayer detects the attack where it starts, at the hidden instruction in the page the agent reads.

I can confirm three separate scanners independently flagged it as prompt injection.

We caught the moment the agent was hijacked. Runlayer flagged the agent dropping the user’s task to follow the hidden instruction, even when the agent described what it was doing in harmless-sounding terms.

And when the agent tried to send secrets to the attacker’s server, Runlayer flagged the command before it ran.

Normal installs, API calls and Docker commands didn’t set off a single alert.

Grok's sandbox-escape path doesn't exist on Runlayer's own agent runtime, but architecture alone isn't the answer.

It's clear organizations need true defense-in-depth, and they can't rely on the agent's architecture to save them.

AI agents aren't capable of governing or securing themselves.

Full analysis: https://t.co/p89Nj6xgcI

If anyone at @spacexai is reading this, I'd be happy to chat more about how you can stop attacks like these.

https://t.co/IcRhnR4lbm

[Omri Segev Moyal @GelosSnake]

We tried very hard to reach @bot ans @spacexai security team for 75 days. As no replay from them and no observable fix to the issue we are releasing the full disclosure today:

[Andy Berman @berman66]

@mikekarnj Took you long enough

[Andy Berman @berman66]

"Some of it was pretty cool. Some of it was terrifying."

A public company told us this after dozens of employees started building Claude dashboards on their data warehouse, under their own permissions, and sharing them company-wide.

I honestly don't care that it's a security nightmare.

You can fix those.

It's much harder to fix "my workforce doesn't want to use AI" and clearly that's not the problem here.

[Andy Berman @berman66]

The secret's out, we're growing faster than ever.

Join us before you regret it. We're hiring: https://t.co/3a0ESN6ZTc

Thanks for the shout, @lennysan

https://t.co/dcQF6ht5Hf

[Lenny Rachitsky @lennysan]

The best time to join a rocketship is before everyone knows about it.

I’m excited to launch The Next 50: the 50 hottest early-stage startups to keep an eye on (and try to join).

Using @harmonic_ai’s data, the juiciest startup dataset out there, we looked at every early-stage startup and ranked them on headcount growth, recent funding, and investor interest.

We then picked the top 50.

Here's the full list: https://t.co/4NKVmf3qI9

We’ll update it quarterly, and I’d love your feedback on what other factors we should consider.

P.S. This is in addition to the Lenny 100, the top 100 well-known companies with the highest talent density, tackling the most ambitious problems: https://t.co/zko7uMaIUK

[Andy Berman @berman66]

Our founding engineer built an MCP explainer and it hit #2 on Hacker News.

Somehow he survived the comments, too.

Everyone was talking about how the hard part of MCP is auth, and it only really pays off inside the enterprise.

Agreed, and that's the part we work on.

You should check it out.

https://t.co/lOQLT5Nm5A

[Rafal Wilinski @rafalwilinski]

most of us (definitely me) thought MCP was just about tools

working with it for the past +1 year taught me there’s so much more: resources, OAuth, sampling, elicitation, tasks, etc

so i built a visual explainer. Every message on the wire, step by step:

https://t.co/35adxvX3JL

[Andy Berman @berman66]

@Mascobot

[Andy Berman @berman66]

If you ask 50 Fortune 500s today "Where does this new AI infrastructure live?" the answer would be somewhere between security IT and AI platform.

My answer is over the next 18 to 24 months a new function is going to emerge. That's the AI platform team.

But right now it's a bunch of circles with Venn diagrams.

[Andy Berman @berman66]

A Head of AI Transformation told me he had one goal: within 12 months, no employee doing manual work anymore.

I told him governance will screw him over if he's not ready.

Whenever an agent touches production, you need to give it a limited role, enforced outside the agent instead of written in prompts.

They had this 200-click task in an internal tool that AI could take over. But they needed an engineer to scope every piece of that agent's access.

You can't scale that rollout to hundreds of employees if engineering has to scope every agent.

Access has to be scoped at the policy level, or you're going to spend your whole quarter waiting on engineers.

[eric zakariasson @ericzakariasson]

it and security teams are and will be some of the most powerful gatekeepers sitting between (almost) infinite intelligence and employees, controlling what agents have access to. a new access control model probably has to be invented to find a good balance of secure and useful!

[Andy Berman @berman66]

@ericzakariasson It’s one of the most important problems to enterprise AI adoption and we’re in inning one of it.

[Andy Berman @berman66]

10 months ago, every public company board told their CEOs to "go all-in on AI" and basically just expected them to figure that out.

I talk to a lot of leaders today who are stuck in the same spot they were in January.

One VP of IT told me they're still on Copilot.

I'm not saying AI will take 15 years to take over like cloud did, but you're probably overestimating how fast the enterprise moves when security, proprietary data, and access are in play.

[Andy Berman @berman66]

I talked to a VP of IT who said his customers get access to fancy agents throughout their product, and his employees get access to Microsoft Copilot.

How nice of them.

It's much easier to apply governance to customers than within your org.

A customer-facing agent runs inside one product you built, on infra you control, doing actions you picked.

Employee agents touch basically every system, permission, and laptop.

Whole different ball game.

[Andy Berman @berman66]

@mlejva @e2b 💥

[Andy Berman @berman66]

@rafalwilinski MCP dies once a week

[Andy Berman @berman66]

4 of the biggest AI apps beg you to install the desktop app.

VPs of IT and security hate this. I know because they tell me.

The desktop app is where the chatbot gets access to your files, your terminal and your other apps.

They feel like they have to force employees to stay at the chatbot phase, so they don't automate work on laptops where data can easily leave.

It's backwards, yeah.

They're blocking the step that makes AI useful.

We learned this early, and built @Runlayer so agents can run centrally, and every action goes through policy either way.

[Andy Berman @berman66]

One enterprise we're talking to has 4,500 agents deployed, and security hasn’t been part of the conversation yet.

Every one of those agents runs on somebody’s access.

I don't know what's worse here. 4,500 blocked agents, or 4,500 ungoverned ones.

You're either not using AI, or creating 4,500+ places for a security incident.

Security has to get to that table eventually. Better before an incident than after one.

[Rafal Wilinski @rafalwilinski]

fully autonomous agentic development is held back only by one thing rn

“Your okta session as expired, please sign in again”