Security for agents and the code they write.
Bay Area, CA
Joined August 2025
- Tweets312
- Following9
- Followers32
- Likes44
Pinned Tweet
If you're using Claude Code, Codex, OpenClaw—you need a security layer to make sure you don't get hacked.
If you're using AI to write code, drop the prompt into your agents right now.
Oh, and we're running a one-in-generation lifetime deal on AppSumo right now. Don't miss out.
Railway Security Incident, October 23 Update
Railway has released a preliminary report on its October 20–22 security breach, which exposed customer environment variables and potentially sensitive credentials.
Key findings:
- Up to 1.85% of workspaces (~100,000) may have had environment variables compromised.
- Attackers reportedly targeted AI provider API keys, potentially to conduct model distillation attacks.
- Some encrypted secrets were accessed and a subset decrypted.
- Railway says the attacker was removed from its systems by October 22 at 03:32 UTC.
Railway's forensic investigation remains ongoing.
What Railway users should do:
- Rotate API keys, database passwords, and other sensitive credentials stored in Railway before October 21.
- Revoke old credentials, update environment variables, and redeploy dependent services.
- Review AI/cloud provider usage, GitHub security logs, and container registry activity for suspicious behavior.
Source: Railway's preliminary incident report
blog.railway.com/p/prelimina…
Rafter retweeted
Open-weight models are getting ridiculously good.
DeepSeek V4.1-Flash-1017 just took #1 on our internal black-box pentesting benchmark: 316 known vulnerabilities across 8 live web apps.
F1 (findings combined across 3 runs) / total LLM cost:
- DeepSeek V4.1-Flash: 75.08 / $32.93
- GLM-5.3: 73.53 / $305.14
- GPT-5.6 Sol: 69.80 / $1,983.18
- Claude Opus 5: 70.12 / $3,032.39
An open-weight model outperformed every frontier model we tested, at roughly 1/90th the cost of Opus 5.
Pretty wild how quickly open models are progressing. They're no longer just the cheaper alternative. In some domains, they're already ahead.
Huge props to the @deepseek_ai team!
PHP2Shell: two unauthenticated RCE bugs in the PHP engine, exploited in the wild. Fixed in 8.5.12, 8.4.27, 8.3.36, 8.2.35.
Patch, restart FPM/Apache, rebuild images. Then find the PHP in your CMS, panels and appliances.
Full write-up: rafter.so/blog/php2shell-pat…
Railway's outage was a breach. It says an intruder may have read customer environment variables, some decrypted, and asks every customer to rotate every secret. Revoke at the issuer, set the new value, redeploy.
No root cause published yet.
Full write-up: rafter.so/blog/incidents/rai…
litellm 1.107.0 and its Oct 21 Docker images carried a credential stealer that runs on every Python start, via a .pth file, even if nothing imports litellm. It dumps the proxy's provider keys.
If you ran it, delete cook.pth, rotate everything, pin 1.106.2.
Full write-up: rafter.so/blog/litellm-1-107…
Spent last week at SF Tech Week. The strongest recurring theme: give agents enough context, then let them loose.
Let them own the problem. They're good enough to handle it.
But ownership means more than getting the job done. It means being responsible for what you ship, security included. It's still a hard problem.
The agent is the developer now. It writes the code, pulls the dependencies, and wires up the tools — and most of it ships without a human reading a line.
Tomorrow I'm giving a Data Phoenix talk on the threat model that creates: "Securing Code You Didn't Write."
I'll cover three real incidents that turned out to be the same shape, why prompt injection is still the weakness underneath all of it, and where security has to move — to the pull request, before anything ships.
Free and virtual! 1/2
