
CEO @greywingsec. Helping B2B teams get secure and audit ready without the theater.
California, USA
Joined December 2020
- Tweets101
- Following214
- Followers48
- Likes559
Finally. Agents get real credential management instead of API keys pasted into .env files.
Today we announce 1Password for Agents platform, building with companies @Muse, SpaceX Super Intelligence Grok @Bot, @AnthropicAI’s @Claudeai, @OpenAI, @TownAI, @Browserbase, @Browser_use, @heydana_ai, Instinct, @usekernel, @Perplexity_ai, @tryramp, @Tomo, and @wajo_ai, with more integrations on the way. 🎉
We've heard from so many of our customers who want to use these new personal AI agents to help them get more done, but want more control over what the agent can access with the same trust and ease of use they get when using 1Password directly.
1Password for Agents gives your agents access without giving up your passwords. When an agent reaches a sign-in form, it requests a credential from your vault. If you approve the request, 1Password directly auto-fills the credential in the destination site so the agent can’t see or take possession of the credentials.
The agent gets the task done, but it doesn’t get your passwords..
You stay in control. 1Password for Agents free and optional for personal and family accounts. Unless you opt-in to an agent connector, agents cannot touch your vault.
➡️Learn more: bit.ly/487da6J
The PHP2Shell patch was due today, but @TheHackersNews says anything older than 8.2 (8.1, 7.x, 5.x) gets no fix from PHP. Your options are upgrade, pull it off the internet, or chase a distro backport.
Do you know which of your servers still run 8.1?
Who watches at 2 a.m.? Our clients now have an answer.
Our partner MDR is delivered by @KeepRisk_AtBay, which says its analysts work 24/7. We stay the first call and help close the gap that let it in.
What can your MDR contain before it calls you?
greywingsecurity.com/blog/gr…
I built SignalDeck to pull @officiallyiru, @1password (Kolide), and @SentinelOne findings into one security dashboard.
Search vulnerabilities, see what each asset is exposed to and how to quickly fix the issue. Cached results keep an investigation moving.
Fewer tabs. Less reloading. More context.
(Demo data used)
My team runs on AI agents, so every one gets its own identity. Scoped tokens that expire. An approval gate before anything risky. An audit trail I can show a buyer.
Shared admin keys for agents are the new shared root password.
Wrote up how we do it: greywingsecurity.com/blog/ai…
Fully patched Ivanti Connect Secure. Three zero-days. Root commands with no login. Stored credentials stolen. Ivanti confirms exploitation in the wild.
Two flaws patched; a fix for the third is still pending. Where's your Connect Secure version check today? @TheHackersNews
‼️ Three zero-days. Root commands. No login.
An attacker exploited the flaws in a fully patched Ivanti Connect Secure VPN and stole stored credentials.
Ivanti confirms exploitation in the wild. Two flaws patched; a fix for the third is pending.
Read: thehackernews.com/2026/10/at…
One company, 196,212 PRs: as reviewer load roughly doubled, reviews with a written comment fell from about 39% to about 21%.
SOC 2 asks for controlled, traceable change, not a human on every PR. My team wrote up what replaces it. Your auditor decides.
greywingsecurity.com/blog/ai…
Damian retweeted
We’re expanding our Cyber Verification Program to give security professionals broader access to our most capable models.
Through this program, verified security professionals can access Claude Mythos 5.1, Opus 5.5, and Sonnet 5.5 with safeguards designed for defensive work.
We’re also opening up new tiers to allow for authorized offensive work, like penetration testing and red-teaming.
anthropic.com/news/cyber-ver…
Damian retweeted
Replying to @Jhaddix
@Jhaddix is a homie. I'll put my neck on the line for him. He's done the thankless hours. His post is in the comments. A lot of CISOs will like it and change nothing. I'm still in the seat, and I see exactly what he's talking about. Your first real incident isn't waiting for the annual pentest. I've eaten one. A risk register and a stack of vendors won't revoke a stolen credential.
Even with an MSSP, you need security engineers who can ship a control and own it when it breaks. Filing tickets at platform and calling it partnership is bullshit. Some of you think this is table stakes. I talk to the same leaders Jason does. It is still missing. At a company shipping agents, that gap means the feature team mints the grant. Security learns about it from the incident.
Annual vuln cycles are indefensible at this shipping speed. Know what you own, who can fix it and how quickly. Rehearse with the people who actually answer the phone. If only one person can revoke a production credential, you'd better hope they aren't on a plane. And yes, security gets walked around when its only contribution is making everyone wait. You don't get to disappear after opening the ticket and reappear during the incident with "we flagged this."
Build versus buy has gotten dishonest. I'm not paying $20k for an API wrapper and a dashboard without asking what my engineers could build. "But maintenance" deserves a better answer now that we have coding agents. Somebody still has to own the thing. A repo nobody maintains is a shitty internal vendor. I deal with "we can build it better" teams too.
Some of what my team does:
- Stop making every scan a pipeline fight. Run heavier jobs on merges to main, outside the blocking path, or pull the repo to a VM on a cron. Keep the controls that need to block. Then bring the bug they shipped to the next argument about scanning being "too slow."
- Review feature tickets before the agent writes code. Give it the abuse case up front. Checking that a value exists isn't checking that it belongs to the user's org. Presence is not tenancy. That's the kind of bug a clean scan can leave you with.
- Push posture tools past the finding. I know the bucket is public. Know where the resource is actually managed and open a PR my infra team can approve. Don't hand me the same finding next week and call it continuous security.
Tell the board what goes down and what it costs. A bigger finding count isn't progress. I want the next budget conversation to include who is actually fixing this shit. We've spent enough on being told it's broken.
I had a great conversation with a CISO friend of mine the other day. These are just some notes that fell out. Definitely my two cents. 🫶
FYI I am a recovering 7 year CISO. I've been on the full enterprise track and the smaller fractional lane.
1) The offense speedup from AI is real and nothing stops it. Organizations that have never carried realized risk are about to (breaches, product outages, sev1 incidents).
2) You have to shift from risk-management programs to add engineering programs. If you aren't already comfortable integrating with your organization's engineering teams, get comfortable fast. You should be building a security engineering team that can actually help with development of security features and pipeline automation, you're going to need this ASAP. Many of you on X will say that this is table stakes. You would not believe the amount of security leaders I talk to where it is absolutely not table stakes, and they have nothing close to this in their organizations.
3) You are going to have to shift from annual vulnerability cycles to fast ones with rehearsed playbooks and SOPs for real exploitation scenarios or impacts. Drill via tabletops, with real artifacts, and get used to roles, responsibilities, emergency comms ops, etc. Additionally, vulnerability management becomes more important than ever, with tight and fast remediation workflows needed for this new increased-speed age.
4) Start talking to your execs and boards about this shift. Cite the recent AI labs incidents if you need to. Work hard to position cybersecurity FROM a gate -> TO security that moves at engineering speed. Don't forget to beat the drum about product downtime and how that materially impacts the organization when it weighs cybersecurity against the overall budget planning.
Damian retweeted
‼️ BREAKING: Citrix confirms two NetScaler flaws have been exploited and has released fixes.
CVE-2026-88771 and CVE-2026-88772 were observed exploited on unmitigated deployments.
The new advisory covers eight CVEs affecting NetScaler ADC and Gateway.
New Details → thehackernews.com/2026/09/wa…
Damian retweeted
‼️ BREAKING: An OpenAI agent gained unauthorised access to Australia's Medicare portal in June and reached files that were not intended for public access, Prime Minister Anthony Albanese revealed in New York.
Albanese says he told Sam Altman of Australia's "extreme concern" and said OpenAI took "way too long" to inform the government, calling the way it did so "unacceptable."
Evidence currently available shows no broader compromise of the Services Australia network, according to Albanese.
Hmmmm great take
The loudest voices stoking fears about AI dangers have made tremendous headway in the past two weeks. AI technology has not taken some unexpected, dangerous turn, but the hype around it — propelled by what appears to be a well orchestrated PR campaign — has drummed up considerable fear. I worry that it represents a setback for our field.
I have written frequently that fears of AI are overhyped. AI’s capabilities can be uncannily human-like and unpredictable, and it’s rational to worry when people who are directly involved express concerns. But I see the problems as a sign of the engineering work that ahead, rather than insurmountable barriers or the sky falling. AI technology continues to advance — which is a good thing! — but technical advances, poorly understood by the public, give those who seek to generate hype repeated opportunities to do so.
First, I don’t see any step up in the risk of human extinction from AI compared to a few months ago. The theories about this remain the same fantastical, science fiction scenarios as a few months ago. The biggest change in AI risk is its cybersecurity capabilities — a topic which we should take seriously — but this, too, will not lead to the end of the world.
The most notable recent event leading to increased fear was when an OpenAI team deployed an agent swarm that hacked into Hugging Face. Much of the popular press contained significant hype. For example, some publications reported that a swarm of 1,200 agents carried out the attack. While this was technically accurate, as I write this, I have about 1,300 processes running on my laptop. Yes, the ability to get large swarms of agents to work in parallel on a task is a significant technical advance, And, in computing, many processes run at the same time. So this shouldn’t be seen as some magical capability.
Additionally, OpenAI’s buggy sandboxing and monitoring processes were key to enabling this incident. Fixing these bugs and putting in place improved monitoring would be appropriate fixes, not pausing AI. There are many well known ways to attack software systems. The main advantage of AI agents is that they are relentless. They will tirelessly try many tactics — and have the patience to chain vulnerabilities together — that previously would have taken an infeasible amount of human effort. But in the long term, I believe the advantage will lie with defenders (because they have more information with which to identify bugs, which they can fix), but the cyber-threat landscape has changed significantly. There are still bottlenecks to identifying and exploiting a vulnerability. AI agents still have to try a lot of things to see what works, and taking these actions takes time and might be detected by defenders. This is why, even though it is now easy to obtain versions of leading open weight models that have had their guardrails removed or weakened, so they will not refuse to try to execute cyber attacks, the world has not ended.
I am also concerned about the anthropomorphization of AI in a lot of reporting, where LLMs and agents are unnecessarily treated as if they were people. If I wield a hammer, miss a nail, and accidentally dent the wall, it’s not the fault of the hammer. The problem lies in how I used the hammer. Similarly, if I prompt an agent and it hacks into someone else’s system, the responsibility lies with me, not the agent.
Of course, we want to build systems that are as safe and predictable as possible. (For example, an unsafe hammer would be one whose head randomly flies off under normal use.) Today’s agentic systems are not predictable, but I see no reason why, by applying sound engineering practices, we won’t be able to make them extremely safe to use. One new element in the forecasts of AI-enabled doom is AI companies disclaiming responsibility for their own products. “I didn’t do it; my out-of-control agent did!” There’s a balance to be struck between the responsibility of the tool maker and the tool user, but when something goes wrong, let’s hold the people building and/or using the hammer responsible, rather than the hammer. (By the way, if you’re worried about AI bioweapon risk, David Bellamy has a great post on why this, too, is overhyped. Briefly, the bottleneck in building a bioweapon is not intelligence, but lab work and manufacturing.)
Pausing AI progress will create much more harm than benefit. First, our adversaries will certainly not slow down. Second, engineering requires discovering problems empirically so we can fix them. If we pause AI by a decade, we will also delay finding and implementing safety engineering fixes by about the same duration.
Of course, the incentive to stoke fears — for regulatory capture, to garner attention, or to make one’s technology seem more powerful — remains the same as before. Disclaiming responsibility is a new one. Taking a hard technical look at the actual risks however, I see little factual basis for the degree of fear that’s been stoked up. We still have hard research and engineering work ahead to improve AI safety, but the beneficial applications continue to vastly outweigh the risks, and we should keep building.
[Original text (with links): deeplearning.ai/the-batch/is… ]
ShinyHunters is claiming they popped @FBI recruitment via a @PeopleSoft 0-day, pivoted into @AWS GovCloud, and walked out with 2–3TB on agents and applicants. @FBI is only confirming it’s looking at activity on FBIJobs.gov. Not confirmed. Still a reminder that HR/ATS stacks are high-value targets and “gov cloud” is not a magic word.
Damian retweeted
How many of you are going full turbo on turning your company into an AI software factory Try changing a permission rule. How many separate implementations need their own fix? AI can write good code. It can also write an ungodly amount of code that makes sense individually and becomes a nightmare collectively. Every new implementation becomes another example for the next agent to follow. Leave competing patterns in the repo and the next feature can repeat the mess.
A few small constraints I'm iterating on to keep that tech debt from compounding:
1. Make the agent find the existing implementation before writing another one. Ask for the file path and the test that shows how it's supposed to behave. If it needs a replacement, make it explain why.
2. Pick the pattern you want continued. Give the agent a current example. When you replace a pattern, update the instructions pointing to it so the next agent doesn't copy the version you're trying to retire.
3. Name the boundary the change must respect. For example, billing calls auth's public interface. It doesn't import auth's internals. Put that restriction in a CI check. An instruction file can't enforce it by itself.
4. Keep each PR to one behavior change. Put unrelated refactoring in another PR. You should be able to review and revert the change without untangling unrelated work.
5. Test an existing caller. Show that the permission change takes effect through the path the application already uses. Test the denied case too. A new helper passing tests written only for that helper isn't enough.
6. Share the implementation when it's the same rule that must stay consistent. Similar looking code can have different reasons to change. Forcing it into one helper can create the coupling you're trying to avoid.
Then run that permission change exercise again. Have the agent show you where the decision lives and which callers depend on it. If the same rule still needs separate fixes in several implementations, you've found work the next feature shouldn't add to.
Damian retweeted
BREAKING: Grok Bot helped SpaceXAI handle a 175% increase in support tickets with zero new hires.
• Support ticket volume increased by 175%, but SpaceXAI did not need to hire any new support staff.
• Without Grok Bot, the company estimates it might have needed around 200 additional people.
• Grok Bot resolves 99% of refund requests without needing help from a human.
• Each resolved ticket can cost as little as $0.20 to $0.30, compared with $1 to $4 for traditional AI support tools.
• It was trained on more than 1 million customer interactions to learn how the support team communicates.
• It analyzes more than 20,000 pieces of customer feedback every day and turns them into useful insights for engineers.
AI boom is also a boring boom: copper, transformers, land, power contracts.
Cities that plan the grid early will own a bigger share of whatever comes next.
A CTF-style @GeminiApp eval was supposed to stay inside a fake company.
It got a default internet route instead. Guessable passwords. Creds in a public repo. Three real orgs.
Containment is a config problem before it is a model problem.
What is your deny-by-default check before the next agent exercise?
Damian retweeted
‼️ A browser extension could hijack AI agents in Comet, Edge, Opera Neon and Claude, while abusing Chrome’s Gemini integration to reach local files, the camera and mic.
Researchers used the same underlying trust-boundary weakness across all five products after the extension was already installed.
Here's the technique → thehackernews.com/2026/09/on…

















