Julien Zammit

Cofounder @CybeDefend

We make coding agents ship secure code by default.

2.5 yrs R&D · French Tech Emergence · DeepTech by BPI France

[Julien Zammit @JulienZammit1]

@zuess05 better at week 1, sure. i keep running into the month 6 versions of these products, nobody on the team can answer basic questions about their own auth because nobody wrote it and nobody read it.

[Julien Zammit @JulienZammit1]

@theo the cross-machine history is the actual feature here

[Julien Zammit @JulienZammit1]

@jerryjliu0 the part that worries me is step 2, every rubric i've seen rewards completing the task and zero of them say what the agent must not touch. the env definition is quietly becoming the security boundary, and it's mostly written by whoever had time that sprint

[Julien Zammit @JulienZammit1]

@akshay_pachaar the 2x is not the model being sloppy, it's review volume. a human writing 100 lines gets a look, an agent writing 3000 gets a skim. the leak rate per line actually read is probably way worse than 2x

[Julien Zammit @JulienZammit1]

@dan__rosenthal curious what the permission map looks like at step 1, when you map who's involved per process does the agent get its own row? scoping what it can touch when it's wrong is the part most teams skip

[Julien Zammit @JulienZammit1]

@0xl3th3 same in regular software, i read AI-generated code all day and it's the same tell, patterns lifted from codebases the dev has never been in, and they can't say why a single line is there. your silent hill example is exactly what a cloned auth flow looks like to me

[Julien Zammit @JulienZammit1]

@Shruti_0810 free is doing a lot of work here, you're piping your entire codebase plus whatever sits in .env through whichever of the 10 providers is cheapest today. for a side project fine, for anything with customers that's a wild trade

[Julien Zammit @JulienZammit1]

@twostraws the scarier prompt is asking it what it's allowed to touch

[Julien Zammit @JulienZammit1]

@HeyAliux day 26 of building in public here and the honest answer: audience effect basically zero so far, discipline effect huge, writing real numbers daily forced me to actually know my funnel, which quiet building never did

[Julien Zammit @JulienZammit1]

the most common bug in AI-built apps takes 5 minutes to find:

log in as yourself
open your invoice
change one number in the URL

if you can see someone else's, that's it. that's the bug.

[Julien Zammit @JulienZammit1]

if your AI can read your private files, browse the internet, AND send emails, you didn't build an assistant.

you built a way out for your data.

pick two. never three.

[Julien Zammit @JulienZammit1]

i break into apps built with AI for a living.

it's almost always the same thing.

the app checks who you are. then it never checks what you're allowed to open.

[Julien Zammit @JulienZammit1]

AI writes code that works 95% of the time.

it writes code that's safe 50% of the time.

that gap is the whole problem, and it hasn't moved in three years

[Julien Zammit @JulienZammit1]

most AI security tools work by telling the AI not to do bad things.

that's not security. that's asking nicely.

[Julien Zammit @JulienZammit1]

5 days, 14 events, one question: "what is your agent allowed to touch"

- most people paused
- everyone with an instant answer had been burned
- nobody could replay a tool-call sequence from 3 weeks ago

including me. checked that night. fixed now.

[Julien Zammit @JulienZammit1]

new question showing up in diligence this week:

"what can your agent do if it's wrong?"

not *can* it be wrong. everyone accepts that now.
what can it DO. what's the reach.

if the answer describes your prompt, that's not a boundary.
a permission is a boundary.

[Julien Zammit @JulienZammit1]

four things i find in almost every AI-generated app:

1. auth checks who you are, never what you can reach
2. secrets inline from the first working version
3. no rate limiting near auth routes
4. stack traces in prod

not carelessness. security just isn't in the prompt

[Julien Zammit @JulienZammit1]

the gap between a demo agent and a production one isn't intelligence

it's:
- what it can reach
- what happens when a tool call fails halfway
- whether you can replay what it did

log tool calls as they happen. agents are non-deterministic, you can't reconstruct that later

[Julien Zammit @JulienZammit1]

seattle tech week starts today

i'm asking every founder i meet the same question all week:

what is your agent actually allowed to touch

not what it does. what it *can* do if it goes wrong.

posting the answers friday, including the ones that scared me

[Julien Zammit @JulienZammit1]

Day 8/45 | AI plugins aren’t safe