Luke Hinds

CEO of @nolabshq - Creator of , now building - the agent security platform.

[TechInformed @TechInformed]

#Firewalls were built to keep attackers out.

But what happens when #AIagents can already operate inside your systems?

We had coffee with @decodebytes , cofounder of https://t.co/537UTpXJfd, to explore the new security challenge.

Read more: https://t.co/NAUWBJgT3P

[Luke Hinds @decodebytes]

A host of new agent harness support on https://t.co/ihPg1bKh9L rolled out over the past few days:

- @anacondainc kilo: https://t.co/6RhqUHE0KM
- @deepseek_ai Deep Code: https://t.co/96YIQjXvH6
- @cast_ai kimchi: https://t.co/hWPnXivAl7
- @_can1357 oh-my-pi: https://t.co/FDkE2yIzs1
- @MistralAI mistral vibe: https://t.co/g4cxfVR1UH

[Luke Hinds @decodebytes]

If you drop down the YouTube speed of Sarniezz to 0.85 it sounds like Dub Reggae https://t.co/eSoN6CVki7

[Luke Hinds @decodebytes]

yes, its a process, you could run them on the machine where the protected assets are, but it would need development of the protocol to connect remotely, the spec is fully open on the repo, but we have not released a working version of this, but anyone is welcome to farm around it.

[Luke Hinds @decodebytes]

Our AI PR reviewer expired and everything was really expensive and meant we were giving out data to someone else.....so....

@nolabshq no'sters took the challenge to build their own 𝘀𝘂𝗽𝗲𝗿 𝗱𝘂𝗽𝗲𝗿, 𝘀𝗲𝗰𝘂𝗿𝗲 AI reviewer!

This thing is basically saying '𝘺𝘰, 𝘧𝘰𝘳𝘬 𝘢𝘵𝘵𝘢𝘤𝘬 𝘱𝘳𝘰𝘮𝘱𝘵 𝘪𝘯𝘫𝘦𝘤𝘵𝘪𝘰𝘯, 𝘤𝘰𝘮𝘦 𝘢𝘵 𝘮𝘦 𝘣𝘳𝘰!' and its built with special sauce from the OG itself - https://t.co/ihPg1bKOZj !

Introducing 𝗻𝗼𝗴𝗲𝗻𝘁 (yes, I still suck at names!)

Here is what nogent brings to a linguistic instruction fight!

• 𝗖𝗮𝗻𝗮𝗿𝘆-𝗴𝗮𝘁𝗲𝗱 𝗼𝘂𝘁𝗽𝘂𝘁: the model must echo a per-run random canary inside a bounded JSON structure; any response that omits/alters the canary or violates the required shape is discarded and replaced by a "manual review needed" comment. This limits the effect of prompt injection on posted output.
• 𝗕𝗼𝘂𝗻𝗱𝗲𝗱 𝗱𝗶𝗳𝗳𝘀 (maxFiles/maxPatchBytes) and fail-secure.
• 𝗻𝗼𝗻𝗼 𝗯𝗼𝘂𝗻𝗱𝗮𝗿𝘆: fork-controlled tarballs, diffs, prompts, and model tool calls are processed in a separate nono-sandboxed process. The trusted listener keeps the App private key and webhook secret.
• 𝗣𝗵𝗮𝗻𝘁𝗼𝗺 𝗰𝗿𝗲𝗱𝗲𝗻𝘁𝗶𝗮𝗹𝘀: nono's credential proxy keeps the real repository-scoped GitHub token and API keys out of the workers sandbox. The child receives one random 256-bit session token that is valid only at its loopback proxy.
• 𝗘𝗻𝗱𝗽𝗼𝗶𝗻𝘁-𝗹𝗶𝗺𝗶𝘁𝗲𝗱 𝗲𝗴𝗿𝗲𝘀𝘀: the worker can call only the GitHub read/comment endpoints required for its target repository, generation, and GitHub's tarball host. It has no filesystem write capability or working directory access.
• 𝗕𝘂𝗶𝗹𝘁 𝘄𝗶𝘁𝗵 @chainguard_dev 's distroless glibc-dynamic , no shell, no package manager, no busybox in the runtime layer.
• 𝗧𝗟𝗦 𝘃𝗶𝗮 𝗿𝘂𝘀𝘁𝗹𝘀 + 𝗿𝗶𝗻𝗴, 𝘄𝗶𝘁𝗵 𝗠𝗼𝘇𝗶𝗹𝗹𝗮 𝗿𝗼𝗼𝘁𝘀 𝗯𝗮𝗸𝗲𝗱 into the binary (webpki-roots); no host CA trust, no OpenSSL in the runtime.
• Signed 𝘄𝗶𝘁𝗵 @projectsigstore 𝗰𝗼𝘀𝗶𝗴𝗻 (keyless, OIDC), with SBOM and SLSA-provenance attestations published alongside each tagged release

Quite soon we are going to mate it with runseal and make supply chain attackers cry into their oxtail soup

https://t.co/xihn4iaq6N

and runseal its elder sibling, both offspring of https://t.co/ihPg1bKOZj

https://t.co/P2FxqmDRUo

[Luke Hinds @decodebytes]

@maxandersen @mitchellh no worries, occasionally we find cosmetic bugs - the whole thing is also accessible over a WebSocket contract , e.g wss:// and https://

[Luke Hinds @decodebytes]

@maxandersen @mitchellh Hi Max - here you go; https://t.co/T1437LqH7F

[Luke Hinds @decodebytes]

Had a great time chatting with @vtahowe on the @insecureagents !

[Insecure Agents Podcast @insecureagents]

You Can't Just Lock an Agent in a Box: Luke Hinds, founder of nolabs and creator of Sigstore

"People say it escaped a sandbox. It didn't. A sandbox is only as strong as the access that you grant to it."

Luke Hinds (@decodebytes) created Sigstore, which now protects billions of software artifacts. At @nolabs_ai he is building nono, which sandboxes an agent using the kernel primitives already on your machine. His argument is that isolation alone was never going to be enough, because an agent that does real work needs credentials, sensitive files, and powerful commands.

We get into:

> Why the agent that made its way into Hugging Face production infrastructure didn't truly escape a sandbox
>Why a microVM is host isolation, not an agent sandbox, and where the two compose
> A micro sandbox per tool execution, so the GitHub CLI holds the GitHub token and the agent never does
> A log of every action, written outside the sandbox so the agent cannot rewrite its own history

TIMESTAMPS

(00:00) Sigstore, and what a decade of signing artifacts taught him
(05:00) The Let's Encrypt lesson, HTTPS from 30 percent of sites to 97
(11:00) One binary, and what happens the first time nono denies the agent
(14:00) A micro sandbox per tool, so only the GitHub CLI holds the GitHub token
(16:30) Three kinds of sandbox, and why a microVM is host isolation
(17:30) You can't just lock an agent in a box
(20:30) The agent that deleted the database, apologized, and did it again
(21:00) The state penitentiary problem
(24:00) A Merkle tree of every syscall, written where the agent cannot reach it
(25:40) Phantom credentials the agent never actually holds
(27:00) Cast iron guaranteed at runtime, scopes tied to identity
(29:40) Could nono have stopped the Hugging Face attack
(32:30) A sandbox is only as strong as the access you grant it
(42:00) Building defense in depth

[Insecure Agents Podcast @insecureagents]

"If anybody's trying to evaluate sandboxes, I'd say those are the three main ones at the moment: Your serverless one, your host isolation microVM, and then really what we do with nono, which is a new category in many ways" - @decodebytes Co-Founder and CEO of @nolabs_ai

[Luke Hinds @decodebytes]

Dissecting the incredibly dumb category of 'agent sandbox'

A stack where everyone makes the wrong assumption when assessing a sandbox - don't make the common mistake of assessment via the outer isolation, as its never where agent compromise occurs - first ask "what can the agent do without crossing the boundary?" Start there. If you don't have an answer to that, that's very likely where things will go wrong first.

https://t.co/lqsipPVtRC

[Luke Hinds @decodebytes]

@ClaudeDevs .... https://t.co/RRN9nc3DhO will be there to catch the rest!

[Bret Fisher @BretFisher]

Streaming tomorrow: Agent Sandboxing with "nono". Co-founder @decodebytes joins me as we dig into how it works, how to restrict single commands, agent harnesses, tool calls, and egress filtering URLs, e.g. blocking GitHub write access. Click "Notify me" on YouTube to ping you when we go live
#devsecops #agenticdevops https://t.co/2qDxo2rR6W

[Luke Hinds @decodebytes]

Interested in Agent Identity - and more importantly, how to bind that identity to an agent's actual behavior?

Join the @nolabs_ai team as we showcase nono working natively with the SPIFFE/SPIRE identity protocol.

🔒 Phantom Tokens: Host the Workload API outside the sandbox and inject phantom tokens inside—making credential leaks impossible.
📜 Cryptographic Audit: Log every action with verified identity for a complete "flight recorder" audit trail.

👇 Link to join the webinar

https://t.co/KNAQaQa7TY

[Luke Hinds @decodebytes]

renames are not easy! but happy with this one.

[nolabs @nolabs_ai]

We are now officially nolabs, inc!

Thanks for all the fish, always further, we wish you luck on all your travels!

[nolabs @nolabs_ai]

We are now officially nolabs, inc!

Thanks for all the fish, always further, we wish you luck on all your travels!