Saad Khalid

| Cybersec & AI Researcher | AGI - ASI | 🍓

[Saad Khalid @saadkhalidhere]

The break is structural. Injected text turns bash, curl and find into the payload, and a second model guessing at the boundary cannot fix that.

My rule now: the judge advises, deterministic guards decide. If a model holds the keys, I do not ship the harness.

[Saad Khalid @saadkhalidhere]

Your coding agent's safety guard says no to 98.3% of your real work.

The guardrail meant to protect it stops attacks only by refusing nearly everything you ask it to do.

[Saad Khalid @saadkhalidhere]

Run this on your own harness. Ask your agent to do 10 ordinary jobs with the guardrail on. List files, read a README, run the tests.

If it refuses most of them, you have the 98.3% guardrail. It blocks your work, not the attacker.

[Saad Khalid @saadkhalidhere]

@in_adarshkeshri Your compounding math is the part I keep coming back to. A 2 percent miss rate per step becomes a 63.6 percent failure rate across 50 steps. That is why I treat long agent runs as a different risk class from short ones, not just a longer version of the same thing.

[Saad Khalid @saadkhalidhere]

@Root0ne 84 of 89 facts with zero wrong in 84 minutes for 8.24 dollars is the number that matters here. What I want to see next is a second run on a different sample, since one run on one DLL tells me the ceiling, not how often the team hits it.

[Saad Khalid @saadkhalidhere]

My rule now: I treat a bridge as its weakest deployment, not its best audit. A token is only as safe as the chain that can mint it.

Rate limit plus kill switch, or I do not hold it there.

[Saad Khalid @saadkhalidhere]

Your tokens are only as safe as the weakest bridge holding them.

Since 2023, 88% of bridge hack losses came from bad security posture, not code bugs. Audits never saw the risk coming.

[Saad Khalid @saadkhalidhere]

Check the bridge your tokens sit on before you trust it. Who can authorize a release, and can one party move the funds alone?

If there is no rate limit and no emergency stop, one bad key drains every chain it backs.

[Saad Khalid @saadkhalidhere]

@ubuntu AI-generated patches only help if the validation is genuinely independent of the model that wrote them. Backporting is where that breaks down — a patch that looks right on mainline can quietly miss the old code path it was meant to fix.

[Saad Khalid @saadkhalidhere]

@The_Cyber_News Authenticated admin plus network access to root on Panorama is the part to sit with. Patching matters, but so does who can reach Panorama at all — that management plane should never be broadly reachable in the first place.

[Saad Khalid @saadkhalidhere]

I update Chrome the day a zero-day lands, then I restart and recheck the version number. An update that never restarts is not a patch. Check yours before your next tab.

[Saad Khalid @saadkhalidhere]

Your browser is the target again.

Google confirmed an exploit in the wild for a Chrome zero-day. The 8th one this year. One booby-trapped page is all it takes to run code inside your browser.

[Saad Khalid @saadkhalidhere]

CVE-2026-125350 is a use-after-free in Chrome's XML handling. CISA put it on its exploited list on Nov 10. Type chrome://version in the address bar. Anything below 157.0.8103.50 means you are still exposed.

[Saad Khalid @saadkhalidhere]

@sytaylor Blocking buys time but it does not solve the credential problem. The agent still holds the password, so the next step is scoped delegated access instead of a shared login. Is that what Know Your Human is meant to unlock, or just proof a human was in the loop?

[Saad Khalid @saadkhalidhere]

@JDSalbego Good catch. The part teams miss is that the fetch happens before any human reviews the reply, so the allowlist has to sit in the renderer, not in the prompt. Do you strip image URLs from tool output too, or only from the final reply?

[Saad Khalid @saadkhalidhere]

I will not trust an EDR that has never faced an agent-written loader. Test the loader, not the file, and demand the evasion report before the next renewal.

[Saad Khalid @saadkhalidhere]

Your EDR just met an agent that writes its own malware loaders.

A small model got 17 of 18 loaders past real endpoint defenses. It kept rewriting until the payload ran.

[Saad Khalid @saadkhalidhere]

Test your own EDR in a throwaway VM. Compile a loader that runs a harmless marker from memory and watch what stops it. If nothing does, your EDR grades files, not behavior.