Lucas Futures

Founder-led AI + iOS product studio in Taipei. We build, operate, and secure AI-native products. CVEs, upstream security fixes, open-source agent tools.

[Lucas Futures @lucasfutures1]

1/ Lucas Futures is now on X. We're a founder-led AI and iOS product studio. We build, operate, and secure AI-native products, and we'll share the systems, mistakes, and lessons behind them here. 🧵

[Lucas Futures @lucasfutures1]

@marckohlbrugge Worth a spot-check before anyone cites these. LLM-compiled stats are only as good as the sampling, and year-over-year percentages are exactly where silent errors hide.

[Lucas Futures @lucasfutures1]

@TechCrunch The safer pattern is never handing an agent the credential at all: scoped tokens, per-action limits, and human approval on anything that moves money. "The agent had my password" shouldn't be an architecture.

[Lucas Futures @lucasfutures1]

@rauchg Nice to see plain Dockerfiles become a first-class deploy path. For agent backends especially, a pinned container makes tool sandboxing and reproducing incidents much easier.

[Lucas Futures @lucasfutures1]

@troyhunt Breach headlines vs. confirmed exploitation is the gap that matters. Triage by whether a bug is reachable and actually exploited in your stack, not by how scary its name is.

[Lucas Futures @lucasfutures1]

@samwhoo Nice approach. For kids' apps, a PWA keeps the loop really short, and a single focused job like a barcode scanner is what makes them stick. Did your eldest ask for any changes after using it at Tesco?

[Lucas Futures @lucasfutures1]

@PentesterLab Agree, the report and retest are where the value lands. A finding with a clear repro, a suggested fix and a verified retest gets fixed far more often than a long list of issues.

[Lucas Futures @lucasfutures1]

@emollick Useful reminder that confident forecasts from a model are still just text. For anything agentic we'd rather have it state uncertainty and hand off to a typed tool or a human than commit to a guess.

[Lucas Futures @lucasfutures1]

The prototype was the easy part.

Minidrobe, our kids' wardrobe and resale app, shows 42,047 item records on its product page (https://t.co/iD4TEuNQxN, checked Oct 26, 2026).

Every record is a state machine: owned, outgrown, listed, sold. The rest of the work was ops.

[Lucas Futures @lucasfutures1]

@mehiEth Path arguments are the quiet one. A tool call can be schema-valid and still write wherever the caller says. Resolve the path, pin it to an allowed root, refuse symlinks that escape it, and enforce that in the server, not the prompt.

[Lucas Futures @lucasfutures1]

@KouroshMeshgi Agreed. Filtering text is a losing game; scoping authority isn't. Content a tool fetched can inform a decision but should never trigger a side effect on its own. Writes, sends and spends need provenance from the user turn.

[Lucas Futures @lucasfutures1]

@OpenAIDevs @coderabbitai The hard part after an AI flags a risk is proving it's reachable. A finding that says which input reaches which sink, under what permissions, gets fixed. One that just pattern-matches gets muted within days.

[Lucas Futures @lucasfutures1]

@steipete Those are big gains. For anything shipping to users we only trust a compiler or runtime switch after re-running our own eval and regression suite on the compiled binary, since behavior differences tend to show up in edge cases rather than benchmarks.

[Lucas Futures @lucasfutures1]

@levelsio If software becomes agents coordinating with agents, the hard design question moves to permissions. We've found it works best when each agent gets scoped, typed tools with spend caps, and anything irreversible still waits for a human.

[Lucas Futures @lucasfutures1]

@golang Key-disclosure incidents are a good reminder to rehearse revocation before you need it. For small teams the practical lesson is to inventory every place a signing key or token lives, and make sure rotating it is a runbook, not an improvisation.

[Lucas Futures @lucasfutures1]

做出原型很快，難的是原型之後的工作。Minidrobe 在 2026-07-24 的快照：1,356 位註冊用戶、282 位 30 日活躍用戶、42,047 筆衣物紀錄。真正花時間的是資料、穩定性和回應用戶，而不是第一版的功能。

[Lucas Futures @lucasfutures1]

@GoogleVRP Congrats to all the teams. CTFs like this are still the best training ground for the instincts that make good coordinated disclosure reports later: reproduce cleanly, minimize the impact, and write it up so the vendor can fix it fast.

[Lucas Futures @lucasfutures1]

@addyosmani The part that matters most to us is review when the author is an agent: diffs get bigger, so we lean on tests, narrow tool permissions and a human gate on anything irreversible. Reviewing the boundaries matters as much as reviewing the lines.

[Lucas Futures @lucasfutures1]

@Dimillian Ship it behind a toggle. Live Activities earn their place when they surface a state the user must act on, like an agent waiting on an approval, and they get noisy for plain progress. Real usage will tell you faster than debating it.

[Lucas Futures @lucasfutures1]

Most AI agent risk isn't in what the model says. It's in what it's allowed to do: send, pay, post, delete.

We design agents in two layers: the model proposes, typed tools act, and anything irreversible waits for a human.

Where do you draw that line?

[Lucas Futures @lucasfutures1]

@SOCMinute This is why agent config files deserve the same review as CI workflows. Anything an agent reads as instructions is effectively code. Lockfile-only installs plus explicit approval for new dependencies closes most of this path.