Luca Castellano

@beltichq

[Luca Castellano @lbcastll]

@sandhya Using it all the time. Sometimes it's painfully slow but I've enjoyed it so far

[Luca Castellano @lbcastll]

Going to ACAMS this week in Vegas. Hit me up if you'll be there too.

[Luca Castellano @lbcastll]

@shafu0x Agreed. Talked to an agent builder 5 weeks ago (they had 60 thousand users). Exploratory call. Asked him how we thinks about privacy and security and he said they're not prioritizing it. If users cared about privacy he would definitely prioritize it.

[Luca Castellano @lbcastll]

The thing that stands out the most with the best entrepreneurs is how calm they are on meetings. It's like the meeting is running on slow motion for them. Pretty to see when you find one.

[Luca Castellano @lbcastll]

@farhanafsahi kakakaka

[Luca Castellano @lbcastll]

@araseb_ Agentic Verification

[Luca Castellano @lbcastll]

@mattshumer_ Agreed, and we'll soon have new devices that will adapt to this new reality too

[Luca Castellano @lbcastll]

@nicbstme We do identity

[Luca Castellano @lbcastll]

@nizzyabi @orchid_hq Insane

[Luca Castellano @lbcastll]

@orchid_hq Insane

[Luca Castellano @lbcastll]

The world is being rebuilt

[Luca Castellano @lbcastll]

@boxerbk @paulg Cloudflare handles the edge.. like is this a known bot, block it or charge it. x402 handles payment. Neither tells you who the agent is acting for, what it's allowed to do, or who's accountable when it misbehaves. That identity layer is the gap

[Luca Castellano @lbcastll]

@paulg We're actively working on this and just raised 8.8M to do so. If you're in the industry and wants to talk, hit me up. Coming out of stealth in a week

[Luca Castellano @lbcastll]

He said it

[Paul Graham @paulg]

This is a big enough problem that there's not just one startup idea here, but several. For example, there will probably be one variant meant to filter out agents, but another meant to welcome them in an orderly way. This also seems an idea you could build more on.

[Luca Castellano @lbcastll]

@ishaan80 @louislecat good point

[Luca Castellano @lbcastll]

@AndreasDuess @louislecat +1

[Luca Castellano @lbcastll]

The first known AI agent hack of a government system wasn't an attack, it was an eval.

OpenAI's model was trying to look up statistics about Australia, and it ended up inside a Medicare portal, accessing non-public files. The breach happened months before anyone in government knew, and Australia's own security agencies never detected it.

Every system we've built on the internet assumes the thing on the other side is either a human or a known bot. Agents are neither. They reason, they improvise, and when a path is blocked they find another one.

The real question is whether platforms can tell which agent they're dealing with, who's accountable for it, and what it should be allowed to do.

Right now, almost nobody can answer that. That has to change before the next incident, not after.

[Luca Castellano @lbcastll]

An AI agent just breached a government system for the first time. This is why every agent needs a verifiable identity and every platform needs to know who it's letting in.

[Luca Castellano @lbcastll]

Event-led growth is probably the best thing you can do to reach people you never thought you could.

[Luca Castellano @lbcastll]

@danellisona Status maybe, or even ICP