Viewing profile — hardsnow

GitHub doesn’t exactly make it easy to configure agent access securely. In fact, their regular access tokens and app credentials don’t provide granular enough controls to give dire…

I’ve been using email as an async channel with agents. Email does proper long-form async and native threaded communication extremely well and IMO is the best match UX-wise. The sys…

I seriously think this great! I’ve been saying that email is the right interface for agents for a while now. It is available anywhere, natively threaded, and works for asynchronous…

This is a sandbox escape pentest so the only tooling needed is Claude Code and a simple prompt that asks it to follow a workflow: https://github.com/airutorg/airut/blob/main/workfl…

I’ve recently set up nightly automated pentest for my open-source project. I’m considering starting to publish these reports as proof of security posture. If the cost of security a…

I’ve been developing an open-source version of something similar[1] and used it quite extensively (well over 1k PRs)[2]. I’m definitely believer of the “prompt to PR model”. Very l…

I would agree with this. I recently tried to figure out how to properly secure agent-authored code in GitHub Actions. I believe I succeeded in doing this[1] but the secure configur…

OpenShell is the gem here indeed. A lot of good ideas like network sandbox that does TLS decryption and use of policy engine to set the rules. However: > Credentials never leak int…

I’ve been running this with workloads accessing Anthropic, GitHub, Gemini, and AWS & CF R2 APIs for a while now, and have not ran into issues. I’m sure there’s an API out there tha…

This is the right approach. I built a similar system to https://github.com/airutorg/airut - couple of learnings to share: 1) Not all systems respect HTTP_PROXY. Node in particular …

Yep - requires the client to trust the SSL cert of the proxy. Cooperative clients that support eg HTTP_PROXY may be easier to support, but for Airut I went for full transparent mit…

Alternative, and more robust approach is to give the agent surrogate credentials and replace them on the way out in a proxy. If proxy runs in an environment to which agent has no a…

I built Airut as an experiment - could email be a good fit for talking to a coding agent? Turns out that the answer is yes, at least for me personally - I immediately moved almost …

Container isolation is a good foundation, but one layer worth adding is network sandboxing. A filesystem-sandboxed agent can still exfiltrate data over the network if it gets promp…

I built Airut to solve the friction I hit while switching to an agent-first workflow. With the latest models and a solid CLAUDE.md, I could reliably go from prompt to PR using Clau…

As someone with first-hand experience in implementing pass-through AR, I found the review well-made (e.g., they measured photon-to-photon latency) and extremely interesting. Here's…