Teo Harapcea

Founder & CEO at Nexus AI. Sovereign AI, automation and security. Writing about securing AI agents. Ex-CTO at Kubeark.

[Teo Harapcea @hteo1337]

I left my CTO role and I am now building Nexus AI: sovereign software for automation, AI and security that runs on your own infrastructure, on-prem or air-gapped, with human approval and audit. I will share what I learn about securing AI agents here. https://t.co/XJVm9sxm2g

[Teo Harapcea @hteo1337]

@fr0gger_ The sharp part is aiming the injection at inspection itself: "do not read, quote or analyse it" only works because the model obeying repo text also decides what gets looked at. Did you see any agent actually run setup.js, or did some refuse?

[Teo Harapcea @hteo1337]

@Jhaddix @xssdoctor The token tax is real. The part I'd miss is the scope check: an abliterated model will happily go after the out-of-scope host too. Do you put scope enforcement in the harness instead, like an allowlist the tool layer checks, so the model never has to argue about it?

[Teo Harapcea @hteo1337]

@joshua_saxe Which published cyber eval has been checked against later real incidents, not just against another eval? Solvability under a harness is a different object than damage with standing access. Until that calibration exists, offline roll-ups remain a proxy.

[Teo Harapcea @hteo1337]

@fr0gger_ A list this long is also a supply-chain surface: more repos, more models, more tools an injected prompt can steer. I'd rather see hard target allowlists and an audit log than another framework name.

[Teo Harapcea @hteo1337]

@IceSolst Those pop takes survive because each one maps to a ticket. Auto-generated patches and automated reviews only replace them if a separate checker, without the generator's traces, confirms the assigned bug is actually gone. Same-model vetting just stamps its own work.

[Teo Harapcea @hteo1337]

@JeffLadish Defender's version of the same point: every hop passes a per-request reputation check when an agent chains benign public services like shorteners and screenshot APIs. Detection has to reason over the whole tool-call sequence, not each call.

[Teo Harapcea @hteo1337]

@tqbf A general Go memory-corruption class from induced data races is a cleaner X-Prize than another LLM finding a toy C bug. The hard part is reliable race windows, not the prompt.

[Teo Harapcea @hteo1337]

@dinodaizovi Agents add a new lane to that other 2/3: a prompt-injected agent holding a valid token is abuse of authorized access, and no scanner flags it. Breaking that path looks like short-lived per-task scopes and egress limits, not more findings.

[Teo Harapcea @hteo1337]

@moyix Classic agent ops failure: the job outlives the operator's context. If spend isn't capped and runs aren't addressable outside a terminal title, the expensive model just keeps going.

[Teo Harapcea @hteo1337]

@IceSolst If agents chase the next CVE after each advisory, the loop is working as designed. Secure design still has no equivalent published signal, so it keeps losing attention.

[Teo Harapcea @hteo1337]

@Jhaddix Separation of duties only holds if the Hackbot MCP/plugin set and the assistant MCP/plugin set cannot share credentials or browser state. Otherwise you still have one blast radius with two UIs.

[Teo Harapcea @hteo1337]

@nathanbenaich @lato_ai @stateofai @mattturck Useful loop. The control question is which identity each interview agent uses outbound. If they share one workspace token, one poisoned expert reply can rewrite the study state for the rest of the run.

[Teo Harapcea @hteo1337]

@ZackKorman OpenAI rated GPT-6 Cyber Critical and limited it to select Daybreak Red orgs. Public posts get ExploitGym deltas; those labs get the agent that found Firefox vulns. You care because the capability ceiling moves even when your access does not.

[Teo Harapcea @hteo1337]

@JeffLadish Weight vaults with swiss-cheese Slack and tooling is the real gap. Redactions that only blunt good-faith scrutiny make risk claims harder to verify without slowing a serious adversary.

[Teo Harapcea @hteo1337]

@Cloudflare Agents need their own identity, not a borrowed human session. The audit trail only works if every model call, tool call, and web upload inherits that identity—otherwise morning forensics still points at the wrong person.

[Teo Harapcea @hteo1337]

@halvarflake Easy test: does it apply the rules behind a timed auto-revert and only confirm from a connection that survived the change? iptables-apply has done exactly that for years. An agent that skips it isn't missing intelligence, it's missing the habit of planning for its own mistake.

[Teo Harapcea @hteo1337]

@clintgibler @OpenAI @ky1ebot Best detail in the writeup: in an early run, 20 of 200 reported LPE successes got root through a different 0-day than the one assigned. Grading agents on "got a root shell" hides that. How does the independent check confirm which bug an exploit actually used?

[Teo Harapcea @hteo1337]

@Jhaddix Right cut. Abliteration orthogonalizes refusal out of residual-stream writers (Arditi et al.); jailbreaks only steer inputs. If you don't hold the weights, you don't get the edit surface—hosted APIs stay on the prompt path.

[Teo Harapcea @hteo1337]

@Cloudflare The per-agent policy keys on who the agent is, but the risk sits in what the user authorized it to do, and the post says that context doesn't travel with the request yet. Until it does, isn't Allow on a checkout path a bet on the agent vendor's own guardrails?

[Teo Harapcea @hteo1337]

@saranormous The useful pairing is guardrails at the gateway plus VM isolation for agents. Gateway filters see prompts and outputs; the sandbox bounds the damage when a bad tool call gets through anyway. Can Grid policy see what runs inside Sandboxes, or are they separate layers?