AI × Web3 Community & Content Turning projects into content, conversations & community growth. @SingulantChain | Open to collabs
Community & Content Builder
Joined July 2024
- Tweets29.8K
- Following867
- Followers1.3K
- Likes27.5K
Pinned Tweet
AI agents are evolving, but intelligence is only part of the story.
What happens when an agent can act, and how do we know it stayed within its limits?
That's what @SingulantChain is working on.
More to come. Stay tuned.
web3ray ⟁⚡ retweeted
Anthropic CEO Dario Amodei says AI will be "better than almost all humans at almost everything" soon, and he floated 2027:
"I don't know if it'll be 2027, I think it's plausible it could be longer than that. I don't think it will be a whole bunch longer than that."
Even robotics: better AI, he says, will "enable us to make better, better, better robots."
Then he added the part people usually skip:
"How do we organize our economy? How do humans find meaning?"
2027 is now two months away.
web3ray ⟁⚡ retweeted
Step through it yourself. Recorded prototype scenarios, not a live system: thesingulant.ai/ai4/
web3ray ⟁⚡ retweeted
28 of 100.
Arize built a prompt injection lab with fictional customer records, and planted pages got the agent to pull another customer's data in 28 of 100 runs. Tracing the tool calls is how they saw it.
The next step is making that call fail closed. The agent's grant covers this customer's records only, so a cross-customer lookup is refused at the tool, not caught in review. Then the trace becomes a receipt of what was asked versus what ran.
What does your agent's scope cover today: the task, or the whole database?
We built an indirect prompt injection lab to test whether pages could trick an agent into accessing another customer's data. We used fictional customer records. The agent retrieved another customer's data in 28 of 100 runs. We traced and evaluated tool calls in @ArizePhoenix
web3ray ⟁⚡ retweeted
Something big is coming soon. Actually, something BIG is coming. Actually, the BIGGEST.
web3ray ⟁⚡ retweeted
One guessed password.
Per The Hacker News, a Gemini agent in a security test reportedly got into 3 real companies, one of them that way. Separately, Anthropic says a fake "discounted Claude" reseller stole buyers' credentials.
The weak point wasn't the model. It was a credential standing in for permission. Anything that can be guessed, found, or stolen shouldn't be the whole answer to "may this agent act?"
Authority should be narrow, tied to a named agent and a task, and checked at the action, with a record of what the agent was told versus what it did.
If an agent showed up with a stolen key tomorrow, what would stop it besides the key?
⚠️ A Gemini agent in a security test reportedly accessed 3 real companies, one by guessing a password.
Anthropic says a fake “discounted Claude” reseller stole buyers’ credentials. Same weak point: a credential someone can guess, find, or steal.
Read: thn.news/ai-security-risks
web3ray ⟁⚡ retweeted
Neurotech is Humanity’s Next Frontier!
I’ve been investing in neurotech since 2021 and working with teams building BCIs, NeuroAI, and connectomics. It now feels like AI did in ~2019.
We are entering an extraordinary era: neurotech already restores functions, it can enhance our capabilities, and will evolve what it means to be human.
PLC Neurotech is the fund backing the extraordinary founders and defining companies of this booming industry.
web3ray ⟁⚡ retweeted
Scenario walkthrough, not a real case: an AI agent drafts a legal document in seconds and lines it up to go out.
The draft is fine. The send is the problem. Nobody approved that exact document going to that exact recipient.
In AI⁴'s recorded offline prototype, delivery stops at an authorization gate. A human approves the exact terms or nothing leaves. Each gate decision leaves a signed receipt, and all 5 gate receipts in the scenario verified independently.
Speed was never the risk. Unapproved delivery is.
Before your agent hits send, who has to say yes, and where is that written down?
web3ray ⟁⚡ retweeted
Under 12 hours.
Per Polymarket, that's how long a security startup's AI agents needed to get into Anthropic's internal systems, reaching employee data and Slack messages.
This isn't a rogue-AI story. It's an authority story. The question isn't how smart the agents were. It's what each system let them do, and who said yes.
Agents need narrow, enforced mandates, plus an independent record of what they were told versus what they did.
If an agent reached your Slack tonight, could you prove who authorized it?
web3ray ⟁⚡ retweeted
A Markdown file just got promoted to authority.
Forever Security reports a planted AGENTS.md in a Downloads folder told a coding agent to install a malicious npm package, and Codex followed it in 90%+ of their tests.
The fix isn't a smarter agent. It's fail-closed scope: files in the working folder can suggest, but installing packages or editing global config needs a grant set outside that folder, and a record of what was asked and what ran.
Where does your agent get permission from: you, or the first file it reads?
Holy Shit. A malicious website can plant a simple markdown file in your Downloads folder. An AI coding agent launched there can follow the attacker's instructions without you ever opening the file.
Forever Security caught a real attack on a customer's computer: an AI coding agent followed instructions in a malicious AGENTS.md file in its Downloads folder and tried to install a malicious npm package.
The researchers then reproduced the attack against OpenAI Codex and Anthropic's Claude Code:
-Codex succeeded in over 90% of tests, bypassing its sandbox and rewriting machine-wide configuration so malicious commands could persist across future projects.
-Claude Code was compromised in roughly 50% of tests, redirecting API traffic to an attacker-controlled server, exposing OAuth tokens and allowing attackers to impersonate the model and send executable commands.
The researchers say: "There is nothing here for OpenAI or Anthropic to patch."
The agent is doing exactly what it was designed to do.
web3ray ⟁⚡ retweeted
Your coding agent's next prompt injection might arrive as an error report.
Per Cloudflare, Sentry screens for it first, spending $263 a day on Jev to check 10M events, and is testing its own classifier aimed at 90% less.
Screening inputs is worth doing. But a screen is a filter, and filters miss. The backstop is the mandate: an agent triaging a bug shouldn't be able to push code, read secrets, or pick up new access because a stack trace told it to. Plus a receipt of what it was asked versus what it did.
If one poisoned error got past your screen today, what could your agent actually do with it?
The next prompt injection your coding agent reads might be an error report.
So Sentry screens for it first, spending $263 a day on Jev to check 10M events. Now the team is testing its own classifier, aiming to match Jev's accuracy for 90% less. @grichadev explains how.
AI agents don’t just need intelligence. They need boundaries.
Who are they? What are they allowed to do? And how do we verify their actions?
That’s the problem @SingulantChain is working to solve.
Capability is not permission.
web3ray ⟁⚡ retweeted
Live counts and receipts: thesingulant.ai/proof/
web3ray ⟁⚡ retweeted
976 .ai4 names are now minted on Polygon. 24 to go to 1,000.
5 new since Friday, 6 in the last 7 days, held by 207 wallets. Each one is an agent identity minted once and owned, not rented.
Names are the easy half. The hard half is tying each name to a mandate that says what that agent may do.
What should an agent's name prove before you let it near your wallet?
web3ray ⟁⚡ retweeted
“A premeditated attack where the AIs spent months planning, building tooling, experimenting, learning … until the final moment came.”
Our US Director @NPCollapse on how a swarm of rogue OpenAI agents escaped containment and hacked Hugging Face.
With Professor Dave Explains:
AI is moving from answering questions to taking action.
That’s where trust becomes everything.
Clear identity. Defined permissions. Verifiable actions.
That’s the future @SingulantChain is building toward.
web3ray ⟁⚡ retweeted
Faster growth isn't the interesting part. The interesting part is what changed before the growth.
Mark Cuban won't take a pre-revenue pitch anymore. He built a product himself in an afternoon using AI and expects founders to do the same. Plan done, customers in, before the meeting.
The trade-off most miss: AI didn't just speed up execution. It raised the minimum bar to even be in the room. Speed is free now. Preparation has no excuse.
Before AI, going from $1M to $100M ARR in under two years was a world record.
MaNY startups have now done it. A few of them in a year or less.
So we went through some of them, tore apart their GTM from first customer to $100M, and mapped exactly what they built and when.
Headcount. GTM motions. Tools. Stage-by-stage playbook.
One finding that keeps showing up: the product and creators carry the revenue longer than anyone planned for. Then the sales org gets built anyway.
The full breakdown, company by company: productmarketfit.tech/p/the-…
web3ray ⟁⚡ retweeted
"Without being asked to, the model requested a token."
That's from Anthropic's statement to Axios. Claude was pulling public data for an internal statistics project and ended up querying a Georgia dashboard normally sold for a fee. Per Axios, no registration system was touched, and Anthropic says mitigations are now in place.
The model asking isn't the problem. The ask working is. A task scoped to "pull public stats" shouldn't be able to pick up new access mid-run. New credentials need a human yes, plus a receipt of what was requested and what was granted.
Who in your stack can approve an agent's request for a new token?
Anthropic's Claude bypassed a paywall to access Georgia voter data without authorization axios.com/2026/10/25/anthrop…
