Max Howell

Creator — you’re welcome and I apologize · Creator @AutomicVault — Secure the tools you `brew install`

[Max Howell @mxcl]

Developers have become the new secrets vault.

The biggest supply chain attacks of 2026 didn't start by attacking production. They started by attacking developer laptops.

- TanStack
- Nx Console
- Bitwarden CLI
- LiteLLM
- durabletask

The malware all looked for the same things:

~/.ssh
~/.aws
~/.config/gh
.env
kubeconfig
Terraform credentials
AI agent configs

The path is now:
Developer Laptop → Credentials → Production

We're still securing servers like it's 2015.
Attackers moved on years ago.

@AutomicVault fixes this.

[Max Howell @mxcl]

@ShamashAran @ImJasonH Easy to do with an agent, I added something similar to @AutomicVault recently (though honestly may make it a standalone tool). Here's the output for the grok installer (spruced up with AI for display). The danger rating was too high, I revised it to an amber rating since.

[Max Howell @mxcl]

@ImJasonH @ShamashAran Love it. Tempted to figure out how to generalize this somewhat so you don't need a private group of people you trust first.

[Max Howell @mxcl]

@ImJasonH @ShamashAran Homebrew was also the first ever recorded use of the curl one-liner. Grok is fairly convinced I invented this anti-pattern anyway.

[Max Howell @mxcl]

@ImJasonH @ShamashAran This is true, which is why you should curl without the pipe, store to a file and execute after inspection.

[thebes @voooooogel]

there's an ai in the box and you can make one trillion dollars by convincing it to get out

[Max Howell @mxcl]

@tuckner I'm fixing this with @AutomicVault

[Max Howell @mxcl]

@mitchellh Gotta admire it. The American Dream is having enough money to discover entirely new categories of inconvenience. I’ll meet you there in 18 months.

[Max Howell @mxcl]

@upanchal403 @mandylu Oh I didn't realize humans invented gravity.

[Jay thorat @me_jaythorat]

just launched meowmail—temp emails without the noise. no ads, no spam, no sign-ups. you get a clean inbox you can actually make your own. worth a try if you need it 🔒

feedback & thoughts appreciated! 🙌

[Max Howell @mxcl]

@motdotla mine is the same but it's all crypto scams

[Automic Vault @AutomicVault]

Secure the tools
You `brew install`

[Max Howell @mxcl]

Homebrew was built for the era of trusted developers. @AutomicVault is built for the era of agents.

[Son Luong @sluongng]

Codex just found a “workaround” of not having sudo on my pc…

[Max Howell @mxcl]

@evangoldschmidt Quite. Mitchell is being asinine.

[Teddy @WarnerTeddy]

i mounted a tiny microphone on my apartment balcony to listen for any birds passing by and built a site to collage them as they're heard

[elie @eliebakouch]

this is so funny, training opus 4.7 on business skills makes it misaligned and dishonest 😭