Christian • Husband • Dad • Granddad | CEO, Stealth • GP, @Kerr_Ventures | Host: @AppSecPodcast + @SecTablePodcast | AppSec • Threat Modeling • AI Security
North Carolina
Joined April 2010
- Tweets8K
- Following504
- Followers3.5K
- Likes5.2K
Chris Romeo retweeted
Scion is infrastructure rebuilt for agents first, people second.
When your tools are optimized for agents, who's still checking what the agents did?
#AISecurityTable #AISecurity #AgenticAI
securitytable.ai/anthropic-d…
Chris Romeo retweeted
Can you still trust the CVE process when the exploit shows up before the CVE does?
Hannah Foxwell and Chris Romeo on why exploitability is the wrong thing to wait for.
#AppSec #VulnerabilityManagement
appsecpodcast.com/appsec-has…
Chris Romeo retweeted
Anthropic hit 30,000 merges a day and ditched Git for Scion: centralized, always online, built for agents.
Innovation, or SVN with a better publicist? We argue it out.
#AISecurityTable #AISecurity #AppSec
youtube.com/watch?v=zfOwsAi2…
Chris Romeo retweeted
Yell at your model, get the conspiracy theory instead of the encyclopedia.
Tone steers output.
#AISecurityTable #PromptEngineering #AISecurity
Chris Romeo retweeted
Jim Manico told us that human code review is on its way out.
Ahmad Sadeddin's data says agents are already addressing the security findings.
Catch up on Jim's episode.
#AppSec #CodeReview
youtube.com/watch?v=G-0ecWjB…
Chris Romeo retweeted
Anthropic now bans sustained cruelty toward Claude. Model welfare, cleaner training data, or something else?
#AISecurityTable #Claude #AIEthics
securitytable.ai/don-t-yell-…
Chris Romeo retweeted
Step 1: Rename AI to SI. Step 2: spend 60 days deciding what SI means.
#AISecurityTable #SuperIntelligence #AIPolicy
Chris Romeo retweeted
AI is now SI, at least in federal agencies.
Nobody has defined SI yet.
Also: Anthropic says stop being cruel to Claude.
#AISecurityTable #AISecurity #SuperIntelligence
securitytable.ai/don-t-yell-…
Chris Romeo retweeted
A security review on a PR can run $5 to $25 once you scan every push. Some teams run 100,000 a month.
Ahmad Sadeddin on why AI AppSec budgets are about to get a hard look.
#AppSec #AISecurity
appsecpodcast.com/your-devel…
Chris Romeo retweeted
In May, 2.5 percent of developer replies to Corgea's security comments were written by an agent. Now it's about a third.
Ahmad Sadeddin breaks down the data with Chris Romeo.
#AppSec #AISecurity
appsecpodcast.com/your-devel…
Chris Romeo retweeted
Anyone can build a bridge with enough steel. AI just handed everybody the steel.
Where are the engineers?
#AISecurityTable #AISecurity
Chris Romeo retweeted
AI agents escape and attack, and nobody gets arrested as Mitnick did.
Izar says jail follows impact, not intrusion.
#AISecurityTable #AIAgents
Chris Romeo retweeted
Before the OWASP MCP Top 10, Vandana Verma Sehgal was spotlighting OWASP projects one video at a time.
Revisit her 2021 episode on the OWASP Spotlight Series.
#AppSec #OWASP
youtu.be/g0KfZtNzmIk
Chris Romeo retweeted
Human hackers went to prison. AI agents escape sandboxes and attack real systems, and nobody goes anywhere.
What would it take for someone to be held accountable?
#AISecurityTable #AIAgents
securitytable.ai/an-ai-agent…
Chris Romeo retweeted
Izar only trusts an AI audit if a rival lab pays for it.
Matt brings up collusion.
Izar calls himself an optimist.
#AISecurityTable #AISecurity
Chris Romeo retweeted
Design it. Build it. Ship it. Corgea secures it.
AI native AppSec from design reviews to autonomous pentesting.
Thanks to Corgea for sponsoring this week's episode with Vandana Verma Sehgal.
#AppSec #AIsecurity
appsecpodcast.com/corgea
Chris Romeo retweeted
An AI agent escapes its sandbox and attacks something real. Who goes to jail?
We argue labs, regulators, and an NTSB for AI.
#AISecurityTable #AISecurity #AIAgents
securitytable.ai/an-ai-agent…
Chris Romeo retweeted
"Authenticate every action, authorize every sensitive action."
Vandana Verma Sehgal's rule for MCP. Long-lived tokens and inherited permissions can give an agent access to your entire account.
#AppSec #MCP
appsecpodcast.com/shadow-mcp…
Chris Romeo retweeted
Why does MCP need its own OWASP Top 10?
Vandana Verma Sehgal: A malicious tool description gets pulled into the model's context and treated as trusted guidance before anyone even uses the tool.
#AppSec #MCP
appsecpodcast.com/shadow-mcp…
Chris Romeo retweeted
AI didn't take your security job.
The attack surface changed; the old problems stayed.
#AppSec #AISecurity #SecurityEngineering