Andy Berman

A public company told us they went from zero MCPs to 130+ in a year. Their CIO's biggest new problem is agents either borrow the user's permissions, or run on a service account. "None of which is ideal." Or the right way to do it. If your agent has your permissions, it's usually too much for what the task actually needs. Any prompt injection has the user's full blast radius. If it has a service account, it's typically shared between several agents, and you can't tell which agent did what. Every single one of our agents gets its own agent account: a Runlayer-native identity with its own Client ID/secret, policies, delegations, tokens and audit trail. I wouldn't run production workloads any other way.

Runlayer Labs ran this attack on the Grok Bot vulnerability against our own agents, and found @Runlayer detects and blocks it. As soon as we heard about this attack from Profero's reporting, our team ran the sequence on our own agents. I was confident. Runlayer detects the attack where it starts, at the hidden instruction in the page the agent reads. I can confirm three separate scanners independently flagged it as prompt injection. We caught the moment the agent was hijacked. Runlayer flagged the agent dropping the user’s task to follow the hidden instruction, even when the agent described what it was doing in harmless-sounding terms. And when the agent tried to send secrets to the attacker’s server, Runlayer flagged the command before it ran. Normal installs, API calls and Docker commands didn’t set off a single alert. Grok's sandbox-escape path doesn't exist on Runlayer's own agent runtime, but architecture alone isn't the answer. It's clear organizations need true defense-in-depth, and they can't rely on the agent's architecture to save them. AI agents aren't capable of governing or securing themselves. Full analysis: runlayer.com/blog/grok-bot-v… If anyone at @spacexsi is reading this, I'd be happy to chat more about how you can stop attacks like these. xitter.twitterapi.xyz/GelosSnake/status/2119…

"Some of it was pretty cool. Some of it was terrifying." A public company told us this after dozens of employees started building Claude dashboards on their data warehouse, under their own permissions, and sharing them company-wide. I honestly don't care that it's a security nightmare. You can fix those. It's much harder to fix "my workforce doesn't want to use AI" and clearly that's not the problem here.

The secret's out, we're growing faster than ever. Join us before you regret it. We're hiring: runlayer.com/jobs Thanks for the shout, @lennysan xitter.twitterapi.xyz/lennysan/status/211995…

Our founding engineer built an MCP explainer and it hit #2 on Hacker News. Somehow he survived the comments, too. Everyone was talking about how the hard part of MCP is auth, and it only really pays off inside the enterprise. Agreed, and that's the part we work on. You should check it out. xitter.twitterapi.xyz/rafalwilinski/status/2…

If you ask 50 Fortune 500s today "Where does this new AI infrastructure live?" the answer would be somewhere between security IT and AI platform. My answer is over the next 18 to 24 months a new function is going to emerge. That's the AI platform team. But right now it's a bunch of circles with Venn diagrams.

A Head of AI Transformation told me he had one goal: within 12 months, no employee doing manual work anymore. I told him governance will screw him over if he's not ready. Whenever an agent touches production, you need to give it a limited role, enforced outside the agent instead of written in prompts. They had this 200-click task in an internal tool that AI could take over. But they needed an engineer to scope every piece of that agent's access. You can't scale that rollout to hundreds of employees if engineering has to scope every agent. Access has to be scoped at the policy level, or you're going to spend your whole quarter waiting on engineers.

10 months ago, every public company board told their CEOs to "go all-in on AI" and basically just expected them to figure that out. I talk to a lot of leaders today who are stuck in the same spot they were in January. One VP of IT told me they're still on Copilot. I'm not saying AI will take 15 years to take over like cloud did, but you're probably overestimating how fast the enterprise moves when security, proprietary data, and access are in play.

I talked to a VP of IT who said his customers get access to fancy agents throughout their product, and his employees get access to Microsoft Copilot. How nice of them. It's much easier to apply governance to customers than within your org. A customer-facing agent runs inside one product you built, on infra you control, doing actions you picked. Employee agents touch basically every system, permission, and laptop. Whole different ball game.

4 of the biggest AI apps beg you to install the desktop app. VPs of IT and security hate this. I know because they tell me. The desktop app is where the chatbot gets access to your files, your terminal and your other apps. They feel like they have to force employees to stay at the chatbot phase, so they don't automate work on laptops where data can easily leave. It's backwards, yeah. They're blocking the step that makes AI useful. We learned this early, and built @Runlayer so agents can run centrally, and every action goes through policy either way.

One enterprise we're talking to has 4,500 agents deployed, and security hasn’t been part of the conversation yet. Every one of those agents runs on somebody’s access. I don't know what's worse here. 4,500 blocked agents, or 4,500 ungoverned ones. You're either not using AI, or creating 4,500+ places for a security incident. Security has to get to that table eventually. Better before an incident than after one.

Sometimes vibe coding comes with bad vibes. Governance is the least-sexy word in tech until it's time to secure customer data. Many will learn this. xitter.twitterapi.xyz/intcyberdigest/status/…

"It's a striking example of how quickly the capabilities of attackers are evolving." Quote of the year for every CISO. This agent swarm used an open-source pentesting framework. Anyone can orchestrate something like this with one prompt. 99% of companies aren't close to ready for something like this. xitter.twitterapi.xyz/grinich/status/2117400…

Lawyers are going to make a fortune with enterprise AI data leaks. We just talked to a security leader who found 1,000+ employees uploading corporate IP to a web-hosting site without realizing it. Had to put lawyers on a call with the hosting company. They have 90k endpoints to secure, so this is probably already happening in other orgs. Blocking AI does not work here. You need to give employees a safe path, or they'll keep finding unsafe ones, and the lawyers will keep making bank.

I interviewed an engineer who told me it took his team 6 months to build an integration platform. He said they were short on compute for running inference. I said, you're the manager, you should have asked for more. Burning $4k more on tokens could have turned 6 months into 2.

Our customers would agree. xitter.twitterapi.xyz/YODELAGARZA/status/211…

It's clear hackers will go after these tools. Tools every company is rapidly onboarding into their engineering / sales / marketing orgs. Tools with little to no oversight because velocity > security when you're facing the existential threat of your business being irrelevant. This attack's download link was in the Cursor store, for the official Claude Code extension. Every CISO should have felt safe letting their developers (and non-developers) click that link. Credit to Cursor for how they handled it. They pulled the package within hours, took the marketplace offline, rotated keys, rebuilt it, and worked with the host to shut down the attacker's server. Then they told everyone what happened the same day. That's what good incident response looks like. However fast you're moving, you need to be moving faster. Assume every piece of software is an attack vector. xitter.twitterapi.xyz/amasad/status/21161700…

Always happy to talk about how much of a mess enterprise AI actually is. We definitely have AI-pilled enterprise customers, but most companies out there are scrambling. Thanks for having me. xitter.twitterapi.xyz/ThisWeeknAI/status/211…