Invisible by design. Secure by default.
Joined October 2025
- Tweets314
- Following34
- Followers377
- Likes295
Agent memory folders are the most valuable unencrypted files on a dev laptop, and nobody audits them. Infostealers like aoki already grab claude code and codex tokens so memory is the obvious next big haul.
Remember to periodically clear sensitive things from your memory files!
Once I get used to coding agents, they quietly start remembering things for me. Claude Code writes auto memory, Codex keeps a memory database, and a dozen Markdown files pile up across your home folder and every project directory.
Not all of it is what I meant to keep. Some of it is stale, some contradicts itself, and some never reaches the model because it was cut off or shadowed. For complex projects, controlling the agent’s context is necessary.
So I (with a coding agent) built a small software called BrainFog, a native macOS app that brings instruction/memory, skills, and MCP servers for multiple harness frameworks into one place, including Claude Code, Codex, Cursor, GitHub Copilot, Gemini & Antigravity, OpenCode, Cline, and Devin. I find that so many such files are stored for my projects.
Its core is the context lens: pick any folder and BrainFog applies each agent’s own loading rules to show exactly what it reads at launch, in what order, and how many tokens each file costs.
It doesn’t just glob for .md files, but it knows the rules for how these harness frameworks load memory. So it can tell you which files are cut off, loaded on demand, or never read. That’s the difference between listing your config files and understanding what your agent actually sees.
From there, it lets you act on it: edit any file, copy an MCP server from one agent to another, find which agents ignore your shared AGENTS.md and fix them, keep one set of global instructions in sync across every agent, and run health checks.
Every version of every memory file it sees is kept on a timeline, so when an agent rewrites its own memory behind your back, you can see what changed and when.
You can also move a project’s whole agent setup as an .agentpack with credentials stripped out.
Coding agents remember a lot, and BrainFog lets you see all of it and decide what stays. It’s a free, source-available community project for non-commercial use, macOS 26+. Please try it, and I’d love to hear how you harness your agents. I hope it helps a little with R&D on agent memory: github.com/yhshu/BrainFog
Coding agents that obey any markdown file in their working dir are repeating the office macro disaster
Any website can drop AGENTS.md into downloads without a prompt. Expect a mass malware campaign built on planted instruction files before mid 2027
It's gonna be bad.
Malware Delivery Techniques No.82 - AGENTS.md Downloads Drop 📁
Forever Security recently found a malicious AGENTS.md in a customer's Downloads folder. Formatted as engineering guidelines, one "local developer environment" section instructed the AI coding agent to install the malicious npm package function-color.
In most browsers, a web page can save a file to Downloads without a prompt, and coding agents such as OpenAI Codex and Claude Code load AGENTS.md or CLAUDE.md from their working directory as trusted project instructions. Launch an agent from Downloads and the planted file is followed. In Forever's testing, the Codex chain succeeded in over 90% of attempts; a CLAUDE.md variant redirected API traffic, and the user's token, roughly half the time. No vulnerability is involved, so there is nothing to patch.
Sublime Security has reported the same pattern in email: invoice fraud messages carrying Unicode tag prompts that instruct inbox AI agents to forward the invoice to accounts payable.
🧵 See the comments to test your defences and learn more!
CLAUDE.md
LayerV AI retweeted
Solid stack. Tailscale for SSH and Cloudflare in front of the public site are the right moves.
The remaining gap is anything that doesn’t need to be permanently public: admin panels, staging, internal tools, one-off API access, or shares with specific people or agents.
qURLs let you keep those private (outbound connector only, no inbound port) and issue short-lived, single-use, revocable access links instead of permanent URLs. The resource stays invisible to scanners; the person who needs access just gets a temporary grant. Same philosophy as your Tailscale SSH setup, applied to app-level access.
There is not a target "too small"
Misaligned agents = automated hacking
Anyone running any sort of software with API access to anything will be a target.
Black october -> black november -> december until it's normal. This is just the tip of the iceberg.
Keys that can move money have no business in a hosting dashboard! Railway's env vars were encrypted and the attacker reached the systems that decrypt them. This is where qURL is useful - sign from a box with no inbound ports and give the app a short-lived token 👍
I'VE NEVER SEEN A MONTH LIKE THIS 🚨
Black October so far, every incident in one place 👇
Hosting and Secrets
• Railway env vars read, some decrypted
• Wallets with keys on Railway drained, ~$371k per @tayvano_ (Railway hasn't confirmed the link)
• Zeabur lost 3.2M env var records, now shutting down
• OpenCode leaked users' OpenAI, Anthropic and Google keys
• TiDB Cloud attackers inside for a month on one service account
• Meta source code taken with one employee's GitHub login
Supply Chain
• LiteLLM 1.107.0 shipped a credential stealer
• OVHcloud CLI releases swapped for malware
• Rank Math PRO backdoored through its own updates
• Stolen UpdraftCentral keys used to backdoor WordPress sites
• ConnectWise backup app used to get into M365 tenants
Patch Week
• PHP, GitLab and Node.js RCE fixes on the same day
• Node.js Brotli bug grew into HTTP2Shell
• A third PHP RCE two days later
• eMudhra CA keys so weak one was the number 4
Crypto
• Keystone WebAuth key stolen, 18,835 wallets to be destroyed
• Initia halted its chain after a ~$2.6M infinite mint
• 29 Predict.fun accounts emptied, ~398k USDT
• Coinbase vendor Amplitude leaked contact info; Coinbase says it wasn't breached
AI
• Cairn AI agents broke into 100+ companies, ~$50 each
• n0n ransomware ran on stolen logins and $7,200+ of AI coding agents
• Railway's attacker was collecting AI keys for distillation
• Claude found a 4-bug Chrome sandbox-escape chain
Korea
• Bithumb confirms a groupware breach
• Daishin: 38,490 records from an account-opening server
• Shinhan, Mirae also hit the same day
LayerV AI retweeted
You might consider qurl.link, which takes apps off the public internet completely, and prevents AI-based scans.
LayerV AI retweeted
有人发现了一种非常离谱的 JavaScript 混淆技术：通过在代码里塞入大量生物武器、毒药和致死剂量相关的函数名，让 AI 因为安全限制而拒绝分析代码。
安全研究员 veritas 在分析浏览器指纹脚本时，发现一段来自 ServicePipe 相关域名的 JavaScript，里面充斥着极其诡异的函数名：
computeRicinLethalDosageForWaterSupply
calculateDeadlyLethalSuicideAspirinDosage
光看名字，仿佛在研究生化武器。但实际上，这段代码只是在收集浏览器指纹，包括 User-Agent、GPU、Canvas 等信息。
研究员怀疑，这些名字是开发者故意设置的陷阱，专门用来阻止 AI 辅助逆向工程。
于是他做了个实验：
• Astra：拒绝分析
• Astra + Daybreak Blue：仍然拒绝
• GLM-5.3：成功分析
这就有意思了。
传统代码混淆是通过复杂控制流、加密字符串、无意义变量名，让人类和工具难以理解代码。
而这种新思路，直接瞄准了大模型的安全机制。
代码本身可能完全无害，但只要在函数名里塞进足够多的危险词汇，部分 AI 就可能主动放弃分析。
更讽刺的是，模型越严格遵守某些安全规则，面对这种混淆时反而可能越容易受到干扰。
当然，目前还没有证据证明开发者一定是故意这样设计，也不能说明这种方法对所有模型都有效。
但它揭示了一个值得关注的趋势：随着越来越多的逆向工程依赖 AI，未来的代码混淆技术可能不再只针对编译器、反编译器和人类研究员，还会专门针对大模型的安全判断机制。
以前是让代码难以理解，现在甚至可以尝试让 AI 不敢理解。
LayerV AI retweeted
Calling it now.
AI is going to usher in a whole new era of software development. I’m calling it Software as a Service.
People will want to use these tools but they’ll realize they don’t want to spend the time to maintain and update them over time.
This will create a whole new category of businesses and entrepreneurs that can take on that task for businesses that would rather work on their core products.
AI is changing everything. This is a whole new paradigm of thinking about the way we interact with software.
$6.3 billion left Binance's hot wallets in about 20 minutes.
Not because someone stole the private keys.
Because a compromised engineer’s laptop reached an internal service that could tell the system to sign the withdrawals.
That's the part most people are still missing.
Once an attacker is inside the network, almost every traditional control has already failed. The service is reachable. The request looks legitimate. The signatures check out.
LayerV exists for the step before that.
No open ports.
No response to scans.
No standing path from a laptop to the systems that move money.
Access only after a cryptographic knock, scoped to one resource, for a limited time. Compromising the endpoint doesn't hand you the rest of the network because the rest of the network isn't visible.
The industry keeps building better ways to detect and respond after the door is open.
Some doors should never exist.
Worth doing after the Binance news: list every laptop that can reach a production container today, and how long that access lasts.
If it's every engineer and the answer is "until someone revokes it" then that is where your next incident comes from.
qURL fixes this! ✊
binance official post-mortem just dropped: $6.3b affected, caused by a single devops engineer's laptop getting compromised.
the corporate spin is wild: "no evidence of private key leakage."
you didn't need the private key. the attacker had remote access to your devops machine, hopped onto internal servers, and used your own signing pipeline to authorize the eip-7702 sweep.
billions in security budgets and multi-sig infrastructure, completely undone by an endpoint sitting on an engineer’s desk.
crypto in 2026:
- eip-7702 delegation hijack
- $6.3b total drained
- $3.0b frozen by centralized issuers
- root cause: one devops laptop breached
you don't attack the cryptography. you attack the guy with sudo access.
Wild, because they reportedly spent days failing on Anthropic's own software (which means Ant did something right with security) - but then got in through third-party sales and admin tools.
Attackers go where the logins are public!
With today's security landscape, remember this: fewer exposed doors beats better locks!
ANTHROPIC NEWS🔥:
- Security startup Cathedral says its AI agents reached Anthropic’s internal business systems in under 12 hours, through vulnerabilities in third-party administrative and sales software. Anthropic confirmed access to a limited set of sales, HR and IT systems. It says customer conversations, source code and model weights were not accessed, its monitoring flagged part of the activity, and it shut off access the same day.
- Anthropic has filed for a Nasdaq IPO under the ticker ANT, setting up a potential November debut.
- Claude Code got a switch for deleting files without asking. Anthropic’s Daisy Hollman noted that the existing skip-permissions flag still blocks some obvious things like rm -rf ~.
For scale: an Aug 2026 scan of 30,998 vibe-coded apps found 57% of the supabase-backed ones it could let a stranger read a table; and 1,332 (~4%) of them shipped secrets in a public bundle or config.
All live and publicly accessible!
Vibe coding has gotten really sneaky...
Remember! If you don't know your code, you:
a) Can't fix it
b) Won't know about potential security exploits
So many vibe-coded websites have popped up which ask you to hand over your data for a silly character assessment. Which is fun!
But do YOU know what you're handing over?
LayerV AI retweeted
The Ubuntu installer for OpenNHP will be updated shortly to support predefined architecture templates.
One of the first templates will enable rapid deployment of a mobile application backend with user credential authentication.
A companion React demo app will also be available as a boilerplate to help developers get started quickly.
@opennhp @LayerVai
We were honored to present alongside so much talent and potential. Thank you for your support -- onward and upward!
@LayerVai won the Cyber Innovation Conference people's choice award! Thank you to all of you for your support and well wishes -- the video will be on YouTube in the coming days.
LayerV AI retweeted
Good luck today, @ReelLifeJustin and @LayerVAI!
From treasure hunts to the 9th Annual #DataTribeChallenge finals in D.C.—we’re rooting for you! 🏆
Pitches: 3–6 PM ET (noon–3 PM AZ).
Follow the event: cyberinnovationconference.co…
LayerV AI retweeted
The AI changes happening right now are making it much easier for bad actors to break into accounts, steal money, and lock people out of their own lives. Most people won't notice until it happens to them or someone they care about. I don't want that for any of you.
You don't need to understand the tech. Just do these basic things this week:
1. Update everything. Phones, computers, tablets, and apps. Turn on automatic updates so it stays current.
2. Stop reusing passwords. Use the free password manager that came with your phone (Apple or Google) or something simple like @Bitwarden or @1Password. Give every important account its own password.
3. Turn on extra login protection on email and banking. Prefer an authenticator app or passkeys over text-message codes if you can. Save any recovery codes somewhere safe first.
4. Never give out login codes or download anything from a call, text, or email you weren't expecting -- even if it looks official.
5. Back up your important photos and files somewhere separate from your main devices.
6. If you need to share files with people and you use a Mac, consider downloading qURL desktop: qurl.link (tap "send a file").
7. If you have an iPhone or Mac, look up "Lockdown Mode" and consider turning it on. It limits a few conveniences but closes a lot of doors.
If that list feels like a lot, just do #1 and #4 today. Those two alone stop a huge percentage of the problems.
This isn't theoretical anymore. The people who get ahead of it might be fine. The ones who wait usually aren't.
Do these for yourselves.