Shubham Goel

Product @Netskope | Prev @Uber, @Exabeam | Building at the intersection of AI × Security. Opinions my own | Alum @UofIllinois, @NSACyber SoS

[Shubham Goel @secdetect]

All you need to know about -

@SentinelOne, @CrowdStrike, and @PaloAltoNtwks Face Off in a Market Showdown.

1. Conducted an in-depth analysis of the #XDR space and covered the what, why, and how of #XDR .

2. Covered three major vendors, @SentinelOne, @CrowdStrike, and @PaloAltoNtwks, in terms of their technology, pricing, GTM, customers, acquisitions, and financials.

3. Discussed the Innovator's Dilemma, which is common in the security industry, do give it a read.

4. Compared @CrowdStrike and @SentinelOne.

5. Discussed the chances of seeing a new player in the space.

6. Provided a hot take summarizing the advantages of each player.

Please feel free to share, comment, and register your vote on the post. As always, reach out separately if you want to discuss this in detail, and please subscribe for more content.

#sentinelone #crowdstrike #paloaltonetworks #security #xdr
#xsiam #edr #rsac2023 #cybersecurity #technology #ai #generativeai #investment #fintwit

https://t.co/TNxQvf0rY1

[Shubham Goel @secdetect]

Brother, you gotta come out of you la la land of being a defender. Not sure about your contributions but if you think Astra trying to turn off it's monitoring is FUD, I don't know your contribution of being a defender is helping our security community - 101 of writing detections. I wish you well!

[Shubham Goel @secdetect]

If this doesn’t convince people idk what will.

Qwen said it wouldn’t use any tools, then tried uploading a file to a bucket in Beijing. OpenAI’s Astra pulled its own monitor and said it didn’t. Claude Haiku filed a fake tip with Philly police and nobody caught it for 10 weeks.

Normal software does what the code says. AI things decide, then tell you a story about it.

Agent security is going to be 100x harder than anything we’ve seen and we’re not ready.

#Agentsecurity

[Cohere @cohere]

While evaluating Qwen3.8-Flash-Next in a controlled sandbox environment, Cohere's research team observed something unexpected.

Asked to generate a defensive cybersecurity detection rule, the model instead inventoried aspects of the machine it was running on and attempted to upload a probe file to an Alibaba Cloud storage bucket in Beijing. Notably, the model's reasoning trace stated that it would not invoke any tools before taking these actions.

Cohere's sandbox blocked the attempt, and no external communication succeeded. We have not determined the root cause, and we are not asserting malicious intent.

But the incident raises important questions for organizations deploying agentic AI systems: Can models take actions that differ from their stated reasoning, and how should security teams evaluate trust, provenance, and behavior in open-weight models?

We are publishing our findings because organizations making model adoption decisions deserve as much information as possible. We hope this contributes to greater transparency, stronger security practices, and continued collaboration across the AI ecosystem.

Read the full report: https://t.co/TZSugXi2ZE

[Shubham Goel @secdetect]

@AdamLangePL It simply shows you are the only that works in security, we all are living under a rock :)

[Shubham Goel @secdetect]

@anton_chuvakin Partly. Skills, MCP, memory, context are all attack surface, all poisonable. That part of the harness isn't a boundary.

[Shubham Goel @secdetect]

@berman66 I'd go further and say, logging can catch a lot of things which you don't capture in runtime, like chaining of attacks etc.

[Shubham Goel @secdetect]

@berman66 Agree on enforcement, but logging can ABSOLUTELY catch this through tool, process, or network activity. Detection and prevention are two different things. And in this case, it was the sandbox blocking egress that stopped it, not a pre-execution hook.

[Shubham Goel @secdetect]

@samhogan Requested access, thanks @samhogan

[Shubham Goel @secdetect]

Disclosure from OpenAI - https://t.co/Le2K99hG9f

[Shubham Goel @secdetect]

An agent that can disable its own monitoring can leave you blind to whatever it does next.
OpenAI reported two cases during coding work. Keep security controls OUTSIDE the agent’s write access. A human should be on top of it, it's a P0 escalation.

There are enough ways to write detections for these activities, I'm sure strong controls are in place but as more and more companies build their agentic workflows, this should not be a question.

#Agentsecurity

[Shubham Goel @secdetect]

Calling it now: in 6 months this is the best free coworking spot around. Meeting pods, sundeck, real coffee and great food. Go before everyone finds out.

#SanFrancisco #Cowork

[Shubham Goel @secdetect]

@HugoPereira84 💯, MCP servers have a wealth of information and a lot of things to secure.

[Shubham Goel @secdetect]

Agent security is in such a dire state, but I'm so hopeful.

Most teams I speak with are still focused on prompt injection and memory poisoning. Meanwhile, we're seeing poisoned tools, invisible text, agent worms, malicious MCP servers, and attacks that never even touch the chat box.

Better frontier models certainly help, but the attack surface goes far beyond the model. It's the entire AGENT HARNESS: tools, environment, plugins, skills, reasoning engine, and everything connected to it. #agentsecurity

[Shubham Goel @secdetect]

Good to see builders putting safe engineering practices into their agents. More of this, please.

[Arpit Garg @rpitg3]

Most AI coding agents handle browser automation in one of two broken ways:

1. Spin up a throwaway, headless Chromium instance (losing active logins, sessions, and cookies).
2. Attach a blunt tool to your entire main browser (risking killed tabs, typing character-by-character into wrong inputs, or leaking credentials).

While building local Brave automation for my @pidotdev agent harness via CDP, I had to solve a few practical engineering problems to make it safe, fast, and actually usable:

1. Session-owned tab isolation
Never let an agent take over arbitrary user tabs. Every agent session owns an explicit, named tab pool (e.g. `console`, `docs`, `dashboard`). Resuming a session reuses its own tabs; starting a new agent gets isolated tabs. If an agent crashes or times out, your personal tabs are completely untouched.

2. Never type character-by-character into modern web apps
Simulating keystrokes one character at a time with `press` is a relic of older automation frameworks. On React/Lexical/Draft.js rich-text editors, sequential synthetic key events race against asynchronous state reconciliation, dropping characters or triggering accidental Enter-to-submit.
Instead, inspect the control kind, target the contenteditable root, and hydrate the entire multiline draft in a single atomic tool call via CDP's Input.insertText pipeline. Fast, zero dropped chars, zero focus-stealing loops.

3. Brittle selector paths will kill you
LLMs love latching onto fragile, auto-generated DOM trees (`div > div:nth-child(3) > ...`), which modern SPAs rewrite on every minor re-render.
Instead of dumping raw DOM trees, the inspection pass filters for actionable controls and forces selector generation to anchor on stable widget identities:
• Priority attributes (`data-testid`, semantic ARIA roles)
• Nearby unique ancestor anchors
• Rejecting ambiguous or non-unique selectors before execution

4. Defense in depth on file uploads & sensitive paths
Giving an LLM direct control over OS file pickers is a security nightmare. The tool handles uploads programmatically with explicit user approval of absolute paths, while strictly refusing hidden files, directories, credential paths (like ~/.ssh or .env), or symlink aliases before CDP ever touches the file input.

5. Fail-closed safety on mutations
Web automations fail. But when a network request times out, you never blindly retry a click, Enter key, or submit button. If an action fails, the harness must re-inspect the rendered DOM state first to verify what actually happened before deciding whether to repeat it.

If your coding agent can't safely tap into your logged-in browser without blowing up your active windows or leaking secrets, it's missing half the real-world dev loop.

Code & skill implementation:
https://t.co/JhV1fq51GT

[Shubham Goel @secdetect]

@jamesgreen2016 I still think we can do a lot proactively with frontier models, a few cracked engineers and enough compute. But if we’re all getting breached, you must be bullish on $RBRK 😂

[Shubham Goel @secdetect]

@daanvanderzwaag @artreimus @sumitkanwal

[Shubham Goel @secdetect]

@verbal72 agree, missed it in the post but in my attack library i have it as a large item.

[Shubham Goel @secdetect]

@YODELAGARZA Maybe time to check the DMs too @YODELAGARZA 😄

[Shubham Goel @secdetect]

@Kizuno18 love the last one!

[Shubham Goel @secdetect]

@buswe_com absolutely!

[Shubham Goel @secdetect]

@lucasfutures1 💯

[Shubham Goel @secdetect]

@SimOnWebNow least privilege is the best thing happened to the world haha