Chris Romeo

Christian • Husband • Dad • Granddad | CEO, Stealth • GP, @Kerr_Ventures | Host: @AppSecPodcast + @SecTablePodcast | AppSec • Threat Modeling • AI Security

[The AI Security Table @AISecurityTable]

"Make no mistakes" is not a pragma.

LLMs are not compilers.

Stop treating them like one.

#AISecurityTable #AppSec #Shorts

[The AI Security Table @AISecurityTable]

Claude writes the code, the patch, and the proof.

Does compounded mistrust ever equal trust?

#AISecurityTable #AISecurity #Shorts

[The Application Security Podcast @AppSecPodcast]

Teaching privacy works. People understand it.

But as Avi Douglen puts it, "there's a world of difference between understanding it and getting it."

That gap is why he and Kim Wuyts built Context & Cringe.

#AppSec #Privacy
https://t.co/68ZWX51R0x

[The AI Security Table @AISecurityTable]

Regex was everything. Then ASTs. Now tokens.

Are LLMs the real thing or the next oversold scanner?

#AISecurityTable #AppSec #LLM
https://t.co/DocbiFdpHj

[The AI Security Table @AISecurityTable]

Altman: We can't just patch all the bugs.

Izar: The team said "security debt" on top of that. We stood there anyway.

#AISecurityTable #AppSec #Shorts

[The Application Security Podcast @AppSecPodcast]

AI can draft your privacy threat model.

It can't feel the cringe.

Kim Wuyts and Avi Douglen on Context & Cringe, APVS, and why the human gut still matters in privacy.

#AppSec #Privacy
https://t.co/balFGMfj7U

[Chris Romeo @edgeroute]

Ever wanted to be a guest on The Application Security Podcast? Here's your chance.

We're recording a live episode at Global AppSec in San Francisco, and this time the audience is part of the show.

First, an Ask Me Anything. You bring the questions on AI and security, and we (plus a few special guests) answer them live.

Then we flip it. Reverse AMA: we ask you the questions, and the audience becomes the guest. (Fair warning: we've been saving up some good ones.)

Thursday, November 5
10:15 to 11:00 a.m. PT
Regency Room

Can't make it to SF? Drop your question in the comments. We might use it on the mic.
#AppSec #OWASP #AISecurity #ApplicationSecurity

[The AI Security Table @AISecurityTable]

You don't trust AI. So why ship its code? Altman says we can't patch all the bugs.

Claude is writing its own proofs. Who checks the checker?

#AISecurityTable #AISecurity #AppSec
https://t.co/OPXH5wWens

[The AI Security Table @AISecurityTable]

Scion is infrastructure rebuilt for agents first, people second.

When your tools are optimized for agents, who's still checking what the agents did?

#AISecurityTable #AISecurity #AgenticAI
https://t.co/thapmDERI7

[The Application Security Podcast @AppSecPodcast]

Can you still trust the CVE process when the exploit shows up before the CVE does?

Hannah Foxwell and Chris Romeo on why exploitability is the wrong thing to wait for.

#AppSec #VulnerabilityManagement
https://t.co/H5ezm5u7mJ

[The AI Security Table @AISecurityTable]

Anthropic hit 30,000 merges a day and ditched Git for Scion: centralized, always online, built for agents.

Innovation, or SVN with a better publicist? We argue it out.

#AISecurityTable #AISecurity #AppSec
https://t.co/9t1xvvWtcA

[The AI Security Table @AISecurityTable]

Yell at your model, get the conspiracy theory instead of the encyclopedia.

Tone steers output.

#AISecurityTable #PromptEngineering #AISecurity

[The Application Security Podcast @AppSecPodcast]

Jim Manico told us that human code review is on its way out.

Ahmad Sadeddin's data says agents are already addressing the security findings.
Catch up on Jim's episode.

#AppSec #CodeReview
https://t.co/8Y1ytYe4q8

[The AI Security Table @AISecurityTable]

Anthropic now bans sustained cruelty toward Claude. Model welfare, cleaner training data, or something else?

#AISecurityTable #Claude #AIEthics
https://t.co/t4AxfP9i5Q

[The AI Security Table @AISecurityTable]

Step 1: Rename AI to SI. Step 2: spend 60 days deciding what SI means.

#AISecurityTable #SuperIntelligence #AIPolicy

[The AI Security Table @AISecurityTable]

AI is now SI, at least in federal agencies.

Nobody has defined SI yet.

Also: Anthropic says stop being cruel to Claude.

#AISecurityTable #AISecurity #SuperIntelligence

https://t.co/t4AxfP9i5Q

[The Application Security Podcast @AppSecPodcast]

A security review on a PR can run $5 to $25 once you scan every push. Some teams run 100,000 a month.

Ahmad Sadeddin on why AI AppSec budgets are about to get a hard look.
#AppSec #AISecurity
https://t.co/sl1EKyw3U6

[The Application Security Podcast @AppSecPodcast]

In May, 2.5 percent of developer replies to Corgea's security comments were written by an agent. Now it's about a third.

Ahmad Sadeddin breaks down the data with Chris Romeo.

#AppSec #AISecurity
https://t.co/sl1EKyw3U6

[The AI Security Table @AISecurityTable]

Anyone can build a bridge with enough steel. AI just handed everybody the steel.

Where are the engineers?

#AISecurityTable #AISecurity

[Chris Romeo @edgeroute]

@manicode Had an interesting conversation on this week's @AppSecPodcast about this, and came to the conclusions that humans aren't deterministic either. Made me go hmmmmmm.