Niki Aimable Niyikiza

Sharing ideas and memes about security, AI and markets! Currently working on Security at @Snap. 🇷🇼🇰🇷🇨🇦🇺🇸🌍 Created

[Niki Aimable Niyikiza @Ni_Aimable]

The AI agent security model is broken.

We trust LLMs to self-police, then act surprised when prompt injection works.

Shipped Tenuo: cryptographic warrants that enforce limits regardless of what the model "decides" to do.

Even fully compromised, the agent can't exceed its authority.

https://t.co/U4BEb041eG

[Niki Aimable Niyikiza @Ni_Aimable]

@edwardbenson @pranshu_369 I like the tool but I’m not so sure about the share-ability part. Not always intuitive to send via email for example. Unless I’m missing something

[Stephen Sims @Steph3nSims]

Please join us for the next @offby1security stream at 11AM PT this Friday, May 29th with @Ni_Aimable for a session on "AI Agents as Confused Deputies!"

https://t.co/zZt7I5ZDnc

[Niki Aimable Niyikiza @Ni_Aimable]

@Freyy_is You are exactly right. The load bearing part is the short sentences.

[National Cyber Security Authority @Cybersec_Rwanda]

Under the Rwanda Digital Acceleration Project, @RISARwanda and NCSA have concluded the second cohort of the #cybersecurity training program for 100 judicial operators in #Rwanda, held at CyberHub Rwanda and HangaHub Muhanga.

This program reinforces efforts to strengthen national capacity to effectively address cyber-related cases, through targeted and comprehensive skills development in key areas of cybersecurity and digital investigations.

[National Cyber Security Authority @Cybersec_Rwanda]

Under the Rwanda Digital Acceleration Project,
@RISARwanda in collaboration with NCSA, today concluded the first cohort of a cybersecurity training program for 100 judicial operators held at CyberHub Rwanda and HangaHub Muhanga.

Participants including judges, prosecutors, investigators, and lawyers strengthened their capacity in handling cybercrime investigations, digital evidence management, and digital forensics, among other key topics essential for addressing cyber-related cases.

[Niki Aimable Niyikiza @Ni_Aimable]

This actually touches on something we've been building. Cryptographic capability tokens that attenuate on delegation so each agent can only narrow permissions, never escalate. Every action produces a proof of provenance linking back to the delegation chain / human approval. Open source, works across LangGraph, A2A, CrewAI, Temporal and others. https://t.co/U4BEb04z4e

[Niki Aimable Niyikiza @Ni_Aimable]

Finally, some clear thinking on authority flow in delegation chains (§2.1, §4.7). We’re already shipping this in Tenuo (https://t.co/5Yw89LO42k) : treating authority as cryptographic warrants that attenuate as they move from orchestrator to tool. It turns 'vibes' into deterministic safety. Great read.

[Niki Aimable Niyikiza @Ni_Aimable]

https://t.co/ksTTmx0hPb

[Zvi Mowshowitz @TheZvi]

https://t.co/m2QplCiAor

[Niki Aimable Niyikiza @Ni_Aimable]

@Tiny_Fish Thanks. For more on why I think capabilities are the right primitives: https://t.co/tcBqlwnOQA

[Niki Aimable Niyikiza @Ni_Aimable]

@dair_ai ...And flowing authority

https://t.co/A9JcVOPb5b

[Niki Aimable Niyikiza @Ni_Aimable]

😂 'Emergent behavior' = 'We built it this way and can't fix it.' Nailed it.
This is exactly why prompt-based defenses fall apart. Authorization needs to live outside the LLM entirely. Architectural separation via capability tokens (like monotonic attenuation) blocks escalation even if the agent is fully compromised. Open-source take: https://t.co/X6jfdBKsZG

[Niki Aimable Niyikiza @Ni_Aimable]

@gdb Right on. Would love to hear your thoughts on capabilities-based authorization model for agents

https://t.co/mdLNOfTwop

[Greg Brockman @gdb]

rust is a perfect language for agents, given that if it compiles it's ~correct

[Niki Aimable Niyikiza @Ni_Aimable]

@slatestarcodex @dagsen We can't even write the reason why we can't write it down down

[Niki Aimable Niyikiza @Ni_Aimable]

7/7 I wrote a deep dive on why Context Isolation needs Authority Isolation.
Covers the Decomposition Paradox, the Rule of Two, and why static IAM breaks down for agentic systems.
https://t.co/k3PTnmihiq

[Niki Aimable Niyikiza @Ni_Aimable]

I don't trust AI Agents with IAM Roles (yet).
IAM was built for software that follows a script. Agents improvise. They pick tools at runtime. They make decisions you didn't foresee.
We're securing probabilistic software with deterministic tools. It's a fundamental impedance mismatch.
1/7

[Niki Aimable Niyikiza @Ni_Aimable]

6/7 Google's new CaMeL paper tackles a related problem: tracking data provenance to block exfiltration. They solve it with a custom interpreter.
That protects within an agent. We also need this across agents, at the protocol layer, without requiring a shared runtime.