Eilon Elhadad

Founder & CEO @Follow_our_Echo Forbes 30U30.
Making OSS Vulnerability Free.

[Eilon Elhadad @EilonElhadad]

First OpenAI’s AI hacks Hugging Face. Now an OpenAI employee goes old school.

Humans are still in the game.

[OpenAI Newsroom @OpenAINewsroom]

We discovered a sophisticated recording device that was hidden inside one of our offices. We used our models to understand the device and where it had come from, identifying that a specific employee had planted it a few days earlier. We referred the matter to the FBI, and we’re grateful to the agents and prosecutors who moved quickly to make an arrest. The FBI’s investigation is ongoing and we will continue to support their work.

At this time, we have no indications of this individual inappropriately accessing or exfiltrating model weights, source code, or customer data. The employee was terminated.

We take protecting our technology, data, and people seriously, and as a matter of national importance. Our security program is designed to protect against a wide range of threat actors, from insider risks to cybercriminals to nation states, and this case is an example of how AI can help address these sophisticated security threats.

[Eilon Elhadad @EilonElhadad]

2010: Hackers sabotage Iran’s nuclear centrifuges.

2026: Hackers defrost French supermarket freezers.

What a time to be alive.

[GeoInsider @InsiderGeo]

UPDATE: The cyberattack on French supermarket refrigeration systems has affected far more stores than initially reported.

The Les Mousquetaires group confirmed to BFMTV that 300 Intermarché and Netto stores were affected double the initial estimate of 150 outlets.

Meanwhile, fewer than 100 stores belonging to Coopérative U were also affected.

[Eilon Elhadad @EilonElhadad]

@zivchenking במיוחד בסטארטאפ בשלב מוקדם, כשהכול זז כל כך מהר, לא תמיד אפשר לחכות כמה ימים עד שתפגוש את הבן אדם ��אתה צריך. אני רואה את זה אצלנו כל יום. זום והמציאות זה לא אותו הדבר.

[Eilon Elhadad @EilonElhadad]

You'll never convince me that 5 days in the office isn't what's best for the company.

[Eilon Elhadad @EilonElhadad]

@GalElmalah Why go home when you can just sleep at work?

[Eilon Elhadad @EilonElhadad]

@IdanBenTovim בעד בעד. מה לא?

[Eilon Elhadad @EilonElhadad]

@IdanBenTovim סליחה שהחזרתי אותך לתק��פת הפסיכומטרי 😂

[Eilon Elhadad @EilonElhadad]

@omerholz Fair point. If our R&D were in the US, I might think differently. but especially at an early stage startup, I believe the value of having everyone in the same room

[Eilon Elhadad @EilonElhadad]

@ronbmp The truth isn't always popular

[Eilon Elhadad @EilonElhadad]

@matedecoca1 מאחל להם שימכרו ב-10 🫶

[Eilon Elhadad @EilonElhadad]

עתידות: דקארט יסרבו כי הכריחו אותם לאכול במסעדה לא כשרה

[Eilon Elhadad @EilonElhadad]

⚠️ Let me break this down, because this matters.

npm and PyPI make it easy to install open source packages. But just because a package is available doesn't mean it's safe.

The problem: by the time a security scanner detects a malicious package, it may have already been installed.

That's why we built Echo's vetted repository.

Every package is vetted before it's made available, including provenance checks, malware analysis, suspicious maintainer and dependency changes, and continuous monitoring after approval.

Stop malicious packages before they reach your environment.

[Echo @Follow_our_Echo]

“Vetted” libraries - what’s actually being checked?

If you’re comparing hardened npm and Python libraries, that’s a question worth asking. A closer look at what vetting means for software supply chain security: https://t.co/N2oaSFn6rE

[Eilon Elhadad @EilonElhadad]

They say good marketing plays on people's fears.

Apparently...we didn't have to make anything up.

[Eilon Elhadad @EilonElhadad]

Because what open source maintainers really needed was more code to review…🙄

[Anthropic @AnthropicAI]

To secure open-source software, we’re launching OSS Scanner.

We���ll use our frontier models to periodically scan opted-in open-source projects for vulnerabilities, at no cost. Our reports will provide a proof-of-concept, explanation, and suggested fix.

https://t.co/UFFrLUd25U

[Eilon Elhadad @EilonElhadad]

Ironic.

Tensorlake builds sandboxes to safely run untrusted AI-generated code.
You can isolate every AI agent in the world.
But who's securing the code that runs the infrastructure?

[The Hacker News @TheHackersNews]

🛑 Removing the npm package may not remove the malware.

Compromised tensorlake v0.5.144 shipped a Shai-Hulud worm designed to steal GitHub/AWS credentials, persist on hosts, and republish infected packages.

It's off npm. Installed it? Remove it and rotate credentials.

Read - https://t.co/EmlxyJBg5u

[Eilon Elhadad @EilonElhadad]

This problem is only going to get worse. Not just because agents are writing more code and introducing more vulnerabilities, or because AI makes exploit development easier.

We’re entering a world of vulnerabilities before they even have a CVE, with models like Mythos and Daybreak finding them at scale.

I’m obviously biased, but the direction is clear: frontier-hardened software. We can’t expect every company to find and patch vulnerabilities themselves. They need to consume infrastructure that’s secure by default.

That’s what we’re building at https://t.co/R9NM28ulXR

[Eilon Elhadad @EilonElhadad]

AI can rewrite a compiler.
Cool.
Now who maintains it?

It’s funny how obsessed people are with making software cheaper to create, while barely talking about what it costs to own it.

More code means more dependencies, more vulnerabilities, more patches, more upstream changes.

Maintenance doesn’t magically scale with it.

So are we really about to flood the ecosystem with software nobody wants to own?

[Theo - t3.gg @theo]

Announcing tsc-rs (aka ts-rust), my complete rewrite of the Typescript compiler, type checker, and LSP, all in Rust.

This is a project I've had agents working on for 5 months now. I burned ~$400k of Codex tokens and got nowhere. Burned ~$20k of Opus and got there in 2 weeks.

I have not read a single line of the code.

tsc-rs is an open source drop-in replacement for tsc, and it's available now.

[Eilon Elhadad @EilonElhadad]

Security teams shouldn’t have to guess what their tools are doing for them.

Echo customers can now see exactly what they’re using and how many vulnerabilities they’re avoiding.

Proud of the team for again making the impact visible.

[Echo @Follow_our_Echo]

With Echo, you can see exactly what your team is building and the vulnerabilities you’ve avoided along the way.

As teams use more secure-by-default artifacts, the Overview page now provides a clearer view of both usage and security impact.

It shows the vulnerability reduction across artifacts pulled from Echo compared with their open-source equivalents, alongside a complete inventory of the container images, libraries, Helm charts, and other artifacts in use!

You can see which versions were pulled, when they were last used, and how often – then search, filter, or export the data when needed.

Everything is based on existing pull activity, so there’s nothing additional to configure.