Nadav Shoval

building tech that improves lives & compounds human greatness. working on something new. co-founder @ProjectOmegaHQ. founder @OpenWebHQ 🦄

[a16z @a16z]

Cyber is having a moment

Across 21 major software companies, including Apple, AWS, Microsoft, and Google:

- Reported critical vulnerabilities never cleared 100 per month in four years
- Since spring they've jumped to over 600 per month

[Augustus Doricko @ADoricko]

Rainmaker has raised $100M to become the world’s best lab for weather modification and atmospheric science.

Thank you @noavctech @upfrontvc @DCVC @lowercarbon @DreamVenturesVC and other visionary partners.

We are aggressively hiring and scaling our research org to create a flywheel of atmospheric data collection, synthesis, understanding, and intervention.

We will solve the weather and we will set the stage for the terraformation of Earth.

More in my essay below.

[Nadav Shoval @nadavshoval]

@bhautiktweets a gate the runtime can also hit is still self-service. bind enqueue to a separate principal and fail closed at queue time, or the sandbox jail never mattered.

[Nadav Shoval @nadavshoval]

@Jakeroid scoping the bind to one folder is correct. if .env and cloud creds live in that tree, the agent still has the blast, so keep secrets outside the mount. read-only stops edits, not exfil.

[Nadav Shoval @nadavshoval]

@hicsfh if the unlocked token can sit in the agent process, the box is still the vault. keep the real secret behind a broker that injects per call, and expire the bless with the sudo window.

[Nadav Shoval @nadavshoval]

@Darkfibr3 @RoundtableSpace fencing only works if it runs before the board enters the tool loop. provenance after ingest just labels the blast.

[Nadav Shoval @nadavshoval]

@Trorram 78 skills loaded before the job is 78 surfaces before the first call. pull one category per run and refuse the rest, or the red pack is the injector.

[Nadav Shoval @nadavshoval]

@Darkfibr3 @RoundtableSpace a public mcp board is an open inbox for every connected agent. refuse tools that read unscoped public boards, or the planted prompt is just your default load path.

[Nadav Shoval @nadavshoval]

@ctbbpodcast if the prompt rides in the query string, the victim never typed it. treat every url param that reaches the model like untrusted chat input, or open-link is the injector.

[Nadav Shoval @nadavshoval]

@harleyfoote_ @mastery_in_ai a retry that can widen the grant is a new grant. freeze the tool set at session start and force a fresh ticket to escalate, or the subagent's second attempt is the escape.

[Nadav Shoval @nadavshoval]

@AgentBleed non-repudiation still fails if the verifier sits where the agent can reach it. keep the check and the revoke key on a plane that never shares process with the box.

[Nadav Shoval @nadavshoval]

@AgentBleed if the agent can mint a session that looks like the revoker, the check never fires. pin revoke to a key that never enters the box, and fail closed when that signature is missing.

[Nadav Shoval @nadavshoval]

@kesslernity no-network sandbox still ships scripts. scan and pin the skill folder before load, or the zip is just delayed code exec with a nicer name.

[Nadav Shoval @nadavshoval]

@EntrepreneurRX hosted sandboxes don't own the blast radius if your workflow can still mint tools and subagents. keep tool search and parallel spawn behind the same grant ticket as the sandbox.

[Nadav Shoval @nadavshoval]

@Theagentops if the assert isn't named before the write, the agent is free to redefine success. pin the postcondition in the gateway and fail the turn when it breaks.

[Nadav Shoval @nadavshoval]

@ashutosh_270497 a static allowlist ages into over-privilege by lunch. mint the tool set at task start, expire it with the session, and refuse any call outside that ticket.

[Nadav Shoval @nadavshoval]

@AgentBleed out of band still fails if the agent can mint writes on that plane. put kill and budget behind a principal the agent cannot assume, or the suggestion problem just moved hosts.