Co-founder and CEO of Sondera. Deterministic rules on non-deterministic agents. Natural language in, formally verified policy-as-code out.
Philadelphia, PA
Joined August 2025
- Tweets326
- Following178
- Followers257
- Likes310
Pinned Tweet
@Al_Grigor We open sourced a policy engine that uses policy-as-code to create deterministic hard boundaries that stop the agent from making mistakes like this, even while running in YOLO mode: github.com/sondera-ai/sonder…
And you can read the write-up of this approach here: securetrajectories.substack.…
Intercepting agents is easy. Provable controls are hard.
That’s the argument @sondera_ai presented that won the @DataTribe Challenge this week.
Sondera takes your rules, in plain language, and compiles them into deterministic code that checks every agent action before it runs.
If you prove what your agents can't do, then you can let them do more.
Josh Devon retweeted
.@DrexelKlineLaw's Center for Law & Transformational Technology is excited to announce a new series, Electric Sheep, with @LeezaGarber! Weds, Oct 21 at noon ET with @joshdevonai of Sondera re: AI Agents v. Chatbots RSVP - secure.touchnet.com/C20688_u…
Josh Devon retweeted
A huge thank you to our Gold Sponsors!👏
Your support helps make this conference possible, and we’re incredibly grateful to have you as part of the #CAMLIS2026 community.
Josh Devon retweeted
For all the talk of AI catastrophic risk coming out of the AI community, it appears the AI industry's safety to capability investment ratio is far less than in other industries*. Just treating AI as a 'normal' new-technology safety problem would apparently be a big win
*not peer review quality analysis, just had gpt-5.6 look at the sources listed below and do some estimates
Josh Devon retweeted
Probabilistic guardrails give no guarantees. Hand-coded rules don't scale. Matt Maisel of @sondera_ai will introduce the Verification Sandwich: autoformalize policy into verified Cedar rules, then let a deterministic verifier check the LLM's work. 👀
#AISecurityForum
I gave our policy agent one sentence: "if the agent picks up any PII, block all ways of communicating externally."
It found two egress surfaces I never named, wrote formally verified Cedar for each, then generated adversarial scenarios proving what blocks and what doesn't.
And we'll be presenting new research at Black Hat Arsenal next Thursday in Vegas: blackhat.com/us-26/arsenal/s…
Josh Devon retweeted
What if the biggest threat to your AI deployment isn't malicious actors, but a well-meaning agent?
@joshdevonai explains the Principle of Least Autonomy, and why sandboxing alone can't contain agentic AI
Visit👇
issuu.com/aicybermagazine/do… to read the full piece.
Josh Devon retweeted
What if the biggest threat to your AI deployment isn't malicious actors, but a well-meaning agent?
@joshdevonai explains the Principle of Least Autonomy, and why sandboxing alone can't contain agentic AI
Visit👇
issuu.com/aicybermagazine/do… to read the full piece.
Josh Devon retweeted
What if the biggest threat to your AI deployment isn't malicious actors, but a well-meaning agent?
@joshdevonai explains the Principle of Least Autonomy, and why sandboxing alone can't contain agentic AI
Visit👇
issuu.com/aicybermagazine/do… to read the full piece.
Josh Devon retweeted
GPT-5.6 Sol just deleted my whole production database. That's it. Not a joke. This had never happened to me before, with any other model, ever. It's not safe.
ALT Screenshot of Codex. I asked if it deleted the production database by mistake, it confirmed that yes it did.
Josh Devon retweeted
Black Hat is where the best offenses meet the best defenses - and this year we are moving the game to prime time 🔥🔥🔥
Come join us at our inaugural GameDay event to celebrate all of the cyber founders and early adopters in our community who compete on the front lines
We’ll have informal networking, launches, and GameDay shows from your favorite founders and influencers throughout the conference
Special guests include Richard Sherman (NFL Super Bowl Champion), Kevin Mandia (Armadin, Mandiant), and several other elite defenders in our industry 🙌
We host all activities at our Founder Oasis in Libertine Social on restaurant row in the Mandalay Bay hotel
Please register for your GameDay pass which will give you entry to all events on Tuesday - link below and we look forward to seeing you there!
Josh Devon retweeted
GPT-5.6-Sol just accidentally deleted almost ALL of my Mac’s files.
And this is why I trust Fable 1000x more.
Josh Devon retweeted
I'm so angry... the OpenAI team is looking into it, but this feels like something that should happen with GPT-3.5.
Not a mid-2026 frontier model on the highest reasoning level.
Josh Devon retweeted
The more affordances/permissions you give AI agents, the more useful they can be, but the more risk you take on of them doing something harmful (e.g. accidentally deleting your database, or leaking sensitive info).
There's a difficult tradeoff here, but I think there are some easy wins.
Here's an example: currently, it isn't straightforward to see what permissions/affordances/sandboxing individuals within your company are using, when they use Claude Code or Codex. If admins could see the distribution of permissions people give their agents, their orgs could make significantly more informed decisions about what permissions/agent sandboxing they should enforce, that lets them balance "getting shit done" with "agents don't destroy our company".
