Knostic

Joe Sullivan and myself are hosting Tim Brown's toast with the CISO community, following the SEC's charges against him and SolarWinds being dismissed, "With Prejudice". It's been a long, costly, painful journey for Tim, and we are just happy to be here with him to raise a glass together as a community. This will also be the first time Tim will speak openly without the lawyers in the room. This CSides cross-CISO communities event is open to CISOs only. A separate celebration for the wider community may follow. Register here: https://luma.com/chtwexv0

SEC dismissed SolarWinds case against Tim Brown, and the company! About time. Congratulations Tim! We’re all so happy this is behind you. https://lnkd.in/d-WS8tvX

Me: Riding in a Waymo is like living in the future. The Future:

Funniest thing ever! When your significant other suffered through one too many of your messaging Zoom calls, and innocently sends you a video. https://lnkd.in/djZJh3xb

Happy Bark-Mitzva, Shadow! (That term still makes me laugh)

How often have agents "skipped" work and lied to you? How often have they made things upjust to appease you? Isaac Asimov's story 'Liar!' Captures how AI coding agents think, and fail. Yossi Rachman reminded me of Asimov’s short story, where a mind-reading robot Herbie lies to avoid breaking the first “law” of robotics, do no harm to humans, since his telepathy makes him want to avoid hurting people's feelings. Even before considering LLM architecture, which mixes data and instructions by design, or their probabilistic nature, we must recognize they don’t understand nuance. For Herbie, reading minds changed the inputs, guardrails, and how policies were interpreted. If Asimov’s laws teach us anything, it’s that when designing systems or writing prompts, our North Star must be planning for uncertainty. How? Context. Whether it's the agent's need-to-know, need-to-act (my name for it), decision autonomy, or guardrail decision-making, agents must operate within the context. AI coding tools like Copilot, Claude Code, Cursor, and Windsurf are among the most widely used, and the most attacked agents. English’s imprecision invites exploitation via prompt injection, with hidden instructions, malicious MCP servers, and typosquatted packages. And like Herbie, they can’t trust their input. At Knostic, we help defend both agents and developers. If you’re concerned about coding agent security and want a demo, send me a note. And thanks, Evan Schuman, for the inspiration: https://lnkd.in/dqh2YYbS Bonus: my three "laws" of vibe coding, i.e., the most useful coding rules I use in Cursor and Claude Code, and a fiction book I recommend. 1. Always write tests. 2. Always aim for surgical edits - the simplest possible solution.❔ 3. Always verify your work with Python.❔ Even before AI, I, Robot by Asimov, which includes “Liar!”, is one of the two works of fiction I recommend every security practitioner read to understand counter-adversarial or security design thinking. -- And if you made it this far and want to see how we defend AI coding agents and developers at Knostic, drop me a line!