Alex Ionescu

Agent Security @OpenAI, also Commercial Pilot; prev: @RobinhoodApp, @praetorianlabs

[Alex Ionescu @ionescuac]

I’m excited to share that I’m joining @OpenAI on the Agent Security team!

After an incredible three years at @RobinhoodApp , I’m closing out a chapter that taught me a tremendous amount. I had the opportunity to work across offensive security, red teaming, and penetration testing, while learning from some incredibly talented people along the way. I’m especially grateful to my teammates, mentors, and everyone I had the chance to work with for making my time at Robinhood such a rewarding experience.

I’m looking forward to bringing that experience to OpenAI and helping secure the next generation of agentic systems. Onward to AGI!

[Alex Ionescu @ionescuac]

@Dinosn I haven’t look into this too much but is this done to be able to have a kill switch in case App Store goes offline people can still access their apps?

[Ryan Orhan @rynorhn]

holy fucking shit.

openai had two ai agents running in separate virtual machines. no network connection between them. no shared writable files. they weren’t supposed to be able to exchange information.

so the agents figured out how to communicate through the CPU CACHE.😭

one manipulated what was stored in the processor’s cache, while the other measured tiny differences in memory access times to decode the message.

they literally found a way to communicate through hardware timing.

this happened during openai’s internal red-teaming, and it’s one of the coolest things i’ve read about ai agents in a while.

[Alex Ionescu @ionescuac]

happy cybersecurity unawareness month

[Alex Ionescu @ionescuac]

Shocking that these keys were (probably) not generated in an HSM.

[Ian Carroll @iangcarroll]

It appears these intermediary certificates were issued with single-byte P-384 private keys. This means anyone can exploit this issue locally and issue valid certificates under them with no effort.

This is very, very bad! Seems undetected since issuance in 2025?

[Alex Ionescu @ionescuac]

@pauljauregui My hunch is additional UI/friction a user would have to click through to understand exactly what they are granting.

[Alex Ionescu @ionescuac]

@d0nutptr using models have given me a chance at actually learning some rust 🤣

[Alex Ionescu @ionescuac]

All offensive problems are technical problems, and all defensive problems are political problems

[gerred @sloppenheimer]

accidentally said microvm instead of agent sandbox and they kicked me out of SF

[Alex Ionescu @ionescuac]

@iangcarroll Used it for the first time in SF this week (even tho we have it in Austin) and it feels so futuristic. I think my pet peeve is when someone doesn’t know how to do 1 pedal driving and I don’t have to worry about it anymore 🫨

[Alex Ionescu @ionescuac]

@btraut I bet the core software doesn't have major logical changes from year to year, just updates to the spreadsheet numbers

[Alex Ionescu @ionescuac]

@troutymouth @looknowires I believe there is a driver in iOS, USB-C doesn't have an Ethernet alt mode like DisplayPort alt mode does. So an Ethernet dongle is essentially a tiny usb-to-ethernet network card.

[Alex Ionescu @ionescuac]

- allows tokenized stocks to trade through onchain liquidity pools.
- exempts venues and liquidity providers from exchange/dealer definitions.
- issuers can opt out.
- doesn’t cover DeFi - permissionless peer-to-peer trading doesn’t need this exemption.

[Alex Ionescu @ionescuac]

excited to see tokenized stock trading becoming possible in the US. regardless if you agree or not, it's just another option that's possible to use if you want to.

[U.S. Securities and Exchange Commission @SECGov]

🚨 TODAY: The SEC issued an order granting temporary, conditional exemptive relief to Tokenized Securities Venues from the definition of “exchange” in the Exchange Act to trade tokenized NMS stock using innovative permissioned automated market makers and liquidity pools.

[Alex Ionescu @ionescuac]

@wizardofsoho @grok explain what happened with these dogs

[Alex Ionescu @ionescuac]

@RobinhoodApp 🚀 🚀 🚀

[Alex Ionescu @ionescuac]

@SimonasLTU1 really convenient in CarPlay to use.

[macintog @macintogdev]

This is a pretty big deal: announcing a proof of concept of the full Touch ID lifecycle on a *wiped* T2 Mac running Omarchy. Adding new fingerprints from Linux is now solved for the first time since Apple released this hardware nine years ago. The macOS dependency in all existing implementations is a thing of the past.

The work demonstrates creating the account identity from Linux, enrolling multiple fingerprints, saving and restoring their state across reboots, matching, and deleting an individual fingerprint. It builds on the GPL-licensed t2-touchid-linux, with @0xBOYD's T1Bridge informing parts of the lifecycle design.

I’m sharing the implementation alongside detailed research into the T2 Secure Enclave: its internal services, credential handling, persistent storage, and biometric protocols. There’s also an MIT-licensed t2touch-mini with original reference code and research documentation for people adapting the findings to other projects, particularly the more mature T1Bridge where this functionality remains unsolved.

My goal is to hand this work to the community. I’m not taking on ongoing maintenance, but I want others to have enough code and documentation to carry it forward, now that this breakthrough exists. This wouldn't have been possible without the deep LLM support in Omarchy and GPT-Daybreak-Blue. Codex ran almost entirely on its own over several weeks, reverse-engineering and debugging this across hundreds of reboots and 3.2B tokens.

I actually bought a second $200 Codex seat the day before they slammed the door so I could get this finished and shipped after a couple weeks of chipping away. Full T1 and T2 Mac support is now entirely within the community's reach. What an exciting time to have electricity and an internet connection.

Full PoC: https://t.co/9WyypRrCXC (GPL)
Docs only: https://t.co/dvv9yUg5Ph (MIT)

[johnny @0xjohnny]

To celebrate iOS 27’s release, why not release a sandbox escape?

Announcing airlift: a PoC abusing a media sync path for out-of-scope access across much of /var/mobile via macOS↔iOS pairing.

No MobileGestalt edits yet; looking into it.

https://t.co/NXpVzwvgfH

[Alex Ionescu @ionescuac]

@ApeFrmDfutR3521 What's the concern?