Matthew Slipper

166 posts

Matthew Slipper

Matthew Slipper

@mslipper

Building https://t.co/0pucqh9KLy

San Jose, California شامل ہوئے Haziran 2009
315 فالونگ1.3K فالوورز
Matthew Slipper
Matthew Slipper@mslipper·
Fair point on argv[0]. The sensor is meant as a visibility layer for known agents. For full containment, use a VM sandbox with default-deny egress. If the agent rewrites its own process name, the sandbox still blocks everything it hasn’t been explicitly allowed to do. And the egress attempt will always show up. Will explore content addressable identification to shore this up.
English
0
0
3
162
𝕃𝕖𝕠 𝔻𝕚 𝔻𝕠𝕟𝕒𝕥𝕠 🐯
Very fragile agent detection, tbh The agent itself can just set argv[0]: `exec -a notclaude claude` Nothing checks the actual binary identity. Plus, the sensor doesn't do the matching in BPF but userspace... This thing has zero resistance: a simple rename or symlink will do the trick. And as you wrote, you can't secure what you can't see. You may want to investigate content-addressable (or fingerprinting) ways to identify executables: x.com/leodido/status…
𝕃𝕖𝕠 𝔻𝕚 𝔻𝕠𝕟𝕒𝕥𝕠 🐯 tweet media
English
1
0
7
363
Matthew Slipper
Matthew Slipper@mslipper·
Today we’re open-sourcing iron-sensor, an eBPF-based behavioral monitor for AI coding agents. Agents act like you: they read SSH keys, write cron jobs, modify systemd units, and escalate privileges. Most of the time this helps you code. Some of the time it installs a backdoor. By default, you can’t tell the difference. iron-sensor runs in the kernel and records everything your agent does, so you can. We stress tested it with YoloClaw, an OpenClaw instance that installs random skills from ClawHub with zero human review. It installed 223 skills and generated 16,000+ events. We found no malware - and for once, we can actually prove it. You can’t secure what you can’t see. GitHub: github.com/ironsh/iron-se… Blog post: iron.sh/blog/your-ai-a…
English
12
26
220
16.8K
Arel Avellino
Arel Avellino@ArelAvellino·
@mslipper Built agents that touch my file system daily. The part that should scare more people isn't the backdoor risk - it's that most agents run with no audit trail at all.
English
1
0
1
279
Matthew Slipper
Matthew Slipper@mslipper·
@FinterestingNow Yes, with minor changes to add LiteLLM to the list of watched agents. The exploit was a simple subprocess.Popen which the sensor is designed to detect. The exfil domains are also obvious exploit domains and would have been blocked by iron.sh egress rules.
English
0
0
1
33
Matthew Slipper
Matthew Slipper@mslipper·
@janwilmake Would love for you to try iron.sh. You get a persistent VM, so you authenticate your CLIs once and they stay logged in. Security (egress control, audit logging) comes out of the box. The OAuth handoff problem goes away when the environment sticks around.
English
1
0
0
159
Jan Wilmake
Jan Wilmake@janwilmake·
Can I have a Cloudflare sandbox where the user is logged in into their own `stripe`, `git`, `gh` and `wrangler`, then expose the terminal with all the commands as a ai tool with proper sleeping built-in when the tool isn't used? Anyone has experience? Seems kind of silly, but the key difficult part is the browser handoff of the oauth flow of the different clis, I guess. This would make me not choose for MCP as we can just run claude code + all clis instead and build a web-app on top of it.
English
6
0
22
5.2K
Matthew Slipper
Matthew Slipper@mslipper·
@ethen_not_ethan I’m an implicit iron.sh shill ;) Agree with you but even researcher agents are more predictable than you’d think. Many use web search tooling baked into the agent harness, so you’re still looking at just a handful of APIs.
English
0
0
0
17
Ethan
Ethan@ethen_not_ethan·
@mslipper Implicit gondolin shill haha. Agree but the interaction plane differs by agent type imo. A swarm of researcher agents would require more net egresses than that of coder agents
English
1
0
0
33
Matthew Slipper
Matthew Slipper@mslipper·
Based on the hundreds of thousands of egress events I've seen, AI agent traffic is surprisingly predictable. It looks like npm, GitHub, MCPs, and LLM APIs. This means prompt injection is the wrong layer to defend. If your agent gets injected, you can detect and stop it as long as you do two things: 1. Don't give agents real secrets. Give them proxies you swap out at the network layer. 2. Block requests that aren't whitelisted. Unless you're a pen tester, there's no reason your agents should ever talk to Oastify. This setup would have prevented both Clinejection and RoguePilot.
English
3
0
8
574
Matthew Slipper
Matthew Slipper@mslipper·
Been seeing a lot of takes on how to protect against prompt injection. It's a structural problem that can't be solved with filters or better prompting. The same thing that makes LLMs useful makes injection possible. Instead, focus on negating the damage. Agents need strong isolation, limited access to secrets, and enough observability to know when an injection occurred. And when one does, blow up the agent's environment and start fresh.
English
1
5
12
3.6K
Matthew Slipper
Matthew Slipper@mslipper·
After 4+ years, I'm leaving @OPLabsPBC . March 6 is my last day. It's bittersweet. OP Labs is where I did the best work of my career, with the best people of my career. We migrated hundreds of millions in live assets to Bedrock. We launched fault proofs. We built a true open source protocol that now powers 13% of all crypto transactions. It was hard, it was fun, and the people were exceptional. I'm a better builder now because of it. I'm still really bullish on what the team is shipping. This is the year of institutional adoption, and the Superchain is poised to capture it.
English
13
4
154
13.8K
Matthew Slipper
Matthew Slipper@mslipper·
So what's next? AI agents are already mass-writing your code. They’re also sending your e-mails and texting your friends. They need real access to do it - shell, network, filesystem - and right now, most people YOLO it and hope nothing breaks. I'm building iron.sh to fix that. Secure environments that let agents go fast, while you keep full visibility and control over what they're actually doing. If you've felt this problem, I'd love to talk. DMs open.
English
8
0
39
1.5K
Matthew Slipper
Matthew Slipper@mslipper·
Finally aligning the token with Superchain growth makes sense.
Optimist Prime@jinglejamOP

Happy new year everyone! In November last year, I wrote about the changes we were making to refocus the team on what comes next for crypto. Today, the @Optimism Foundation is proposing a token buyback. The goal is to unify the broader ecosystem outside of just our internal teams to prepare for the next wave of adoption. Here’s where we are today: The Superchain is globally adopted infrastructure. It processes 13% of all blockchain transactions, with 61.4% of L2 fee market share. Foundation and Labs are not solely responsible for this success. Legends like @base, @unichain, @inkonchain, @worldcoin, @Celo, @build_on_bob, @zora, @modenetwork and @Soneium chose the OP Stack and their growth demanded that we scale the infrastructure to support them. We are here today because our partners and integrators rolled up their sleeves and built together with us. The OP token has historically had no tie to the performance of the Superchain, and we’d like to change that. OP should be an incentive alignment mechanism to unify all of us who are working towards the shared goal of innovating on the OP Stack and accelerating Superchain growth. Every OP Chain contributes sequencer revenue to Optimism. In the past twelve months, Optimism has collected 5,868 ETH. This proposal directs 50% of incoming revenue to buy OP tokens monthly for the next year. OP tokens bought through this program flow back into the token treasury ecosystem. Governance retains oversight over buyback parameters and treasury management. The remaining ETH will be actively managed by the Foundation to fund operations, and grow the Superchain. If approved, this proposal will transition OP from a pure governance token to a token tightly aligned with network growth. When an enterprise builds a new chain, the utility of the token increases and OP benefits. When builders choose the Superchain, the flywheel accelerates. Every transaction expands the base from which buybacks operate. The governance proposal moves to vote on January 22. If approved, buybacks begin in February. We will be hosting a Twitter space with myself, @karl_dot_tech & @ben_chain on Jan 12th, 12pm EST for all your questions. This program starts small and scales as we scale, and the role of the OP token will continue to evolve. But the direction is clear: the OP Stack is becoming the standard for the next generation of financial systems. This change aligns the OP token with that momentum, ensuring those building the most important financial infrastructure in crypto capture its impact. This is a new era for OP, and the first of many announcements to come on our plans for 2026. Looking forward to the discussion!

English
0
0
5
482
Mark Tyneway
Mark Tyneway@tyneslol·
April CPI comes out tomorrow but how do we know that the numbers aren’t rigged? An open marketplace of algos over open data would give the world better insight into true inflation numbers
English
3
0
18
931
fucory
fucory@FUCORY·
@bitsplaining @gakonst Unrelated but a funny thing about the jenkins logo is it's really good when you are in a good mood but when CI keeps failing you get annoyed at jenkins and want to punch this face
fucory tweet media
English
3
0
3
81
Georgios Konstantopoulos
Georgios Konstantopoulos@gakonst·
Foundry 1.0 will be soon out, a significant milestone in our mission of empowering EVM developers to build secure and gas-optimized smart contracts. We're looking at ambitious meaty features for our post-1.0 roadmap (e.g. formal verification). What should we do?
English
41
15
262
17.6K
Matthew Slipper
Matthew Slipper@mslipper·
@ameensol @Optimism no idea where people are getting these "10M a year to run the OP Stack" numbers from. seems like fake news.
English
0
0
10
139
Ameen Soleimani
Ameen Soleimani@ameensol·
how hard is it to spin up an @Optimism OP stack rollup? single sequencer, not part of superchain what is the total scope of work? - deploy smart contracts on Ethereum - devops set up server, run sequencer - ???? - profit
English
27
3
82
12.2K
Matthew Slipper ری ٹویٹ کیا
OP Labs
OP Labs@OPLabsPBC·
Open-source, feature-complete fault proofs are live on OP Sepolia! With permissionless validation, anyone can participate in the system without an allowlist. This milestone is another step towards multi-proof nirvana that will allow Optimism to reach Stage 2 decentralization. blog.oplabs.co/open-source-an…
English
42
100
532
225K
Matthew Slipper
Matthew Slipper@mslipper·
@SerMfer @K1d_Crypt0 Jacky was my coworker at Kyokan. He built an early version of Uniswap’s UI. We used shared keys for testnet ETH which is why I requested testnet funds here. I didn’t deploy this token contract. I don’t hold any of it. I don’t know anything else about it.
English
3
1
3
627
K1d Crypt0
K1d Crypt0@K1d_Crypt0·
I noticed John obviously unloading his $HAY, buying $SCHAP before it took off and I started keeping a close eye on him. I noticed that he bought 199 tokens of a coin called “J Chan Dollar”. Upon investigating it I found out that it was the second contract ever on Uniswap. I also realized that the dev of J Chan Dollar is also the .50 $HAY holder from 2018. This contract was launched a few days after $Hay in 2018 as well. So I have to assume $JCD was another test token of Hayden’s or one of his colleagues/friends. With those tokens doing so much volume, I’ve decided to share this. 99% if the tokens are in the dev wallet and it has a very small supply. You could absolutely get wrekt on this, or it could go to the moon. I felt the need to mention this as this is part of the Uniswap lore and it begs the question. Who is J Chan? Is it a coworker? Is it a Jackie Chan Token? There is no Website or Telegram for this token as I’ve literally discovered this by digging, but it has the strong narrative of $Hay and $Schap. I also noticed some whales buying the supply. Is this round 3? What do you guys think? Will the whales be friendly? 👇👇👇👇👇 0x0Ed024d39d55e486573EE32e583bC37Eb5A6271f
K1d Crypt0 tweet media
English
20
23
38
7.1K