Member of Technical Staff @Anthropic
Being here now.
Joined March 2007
- Tweets19.4K
- Following609
- Followers3.1K
- Likes902
This week, our open source work at OPAQUE Systems (opaque.co) on AgenTrust (agentrust-io.com) was recognized at AGNTCON by the AAIF and The Linux Foundation with an Open Agentic AI Innovation Award.
AgenTrust has nearly one million downloads today with hundreds of companies building verifiable agent governance and audit. aaif.io/blog/winners-of-the-โฆ
It's satisfying to know our work in open source achieved escape velocity and lives on beyond OPAQUE. :-)
You can find the open source work we pioneered at OPAQUE at AgenTrust-io.co and you can find most of our leadership and core engineering at Anthropic.
Aaron Fulkerson retweeted
as bad as things have gotten in the past 4 days, they are going to get a lot worse before they get better. security leaders, never let a crisis go to waste: please go to your boards and ask for help right now. not for ai, for the basics. (we need to hold on for ~18 months.)
๐๐๐ฒ๐ฟ๐๐ผ๐ป๐ฒ ๐ถ๐ ๐๐ต๐ถ๐ฝ๐ฝ๐ถ๐ป๐ด "๐ฎ๐ด๐ฒ๐ป๐ ๐ฝ๐ฎ๐๐๐ฝ๐ผ๐ฟ๐๐." ๐ ๐ผ๐๐ ๐ผ๐ณ ๐๐ต๐ฒ๐บ ๐ผ๐ป๐น๐ ๐๐ผ๐ฟ๐ธ ๐ถ๐ป๐๐ถ๐ฑ๐ฒ ๐ผ๐ป๐ฒ ๐ฐ๐ผ๐๐ป๐๐ฟ๐.
A passport that gets you around your own platform is an ID badge. A passport is valuable because other nations honor it, and that takes an open standard nobody owns. Then there's the second half of the job. A passport that no border ever stamps proves nothing. If you can't show it was checked and the rules were enforced, what's the point?
Agentrust-io.com does both. An open source passport for agents that binds the prompt, the policy, the tools, the model and the approvals into one signed document, and a signed receipt every time it's checked. In under four months: nearly a million downloads, 132 contributors, five community maintainers, adoption inside large enterprises and government agencies, and TRACE accepted by the Linux Foundation as a standard. I wrote up what the community built and how to build on it.
๐๐ณ ๐๐ผ๐๐ฟ ๐ฎ๐ด๐ฒ๐ป๐ ๐ต๐ฎ๐ ๐ฎ ๐ฝ๐ฎ๐๐๐ฝ๐ผ๐ฟ๐, ๐บ๐ฎ๐ธ๐ฒ ๐๐๐ฟ๐ฒ ๐ถ๐ ๐๐ผ๐ฟ๐ธ๐ ๐ผ๐๐๐๐ถ๐ฑ๐ฒ ๐๐ผ๐๐ฟ ๐ผ๐๐ป ๐ฏ๐ผ๐ฟ๐ฑ๐ฒ๐ฟ๐.
Aaron Fulkerson retweeted
Anthropic's new acqui-hire deal.
Its licensing Opaque Systemsโ technology for running AI on confidential data and hiring some of its engineers, including CEO Aaron Fulkerson and CTO Rishabh Poddar.
> Standard encryption guards data on disk and across networks, but a model can only read it once itโs decrypted in memory.
> Opaqueโs platform closes that gap by running AI jobs inside hardware-sealed environments that produce cryptographic evidence of what happened during each run.
> That evidence lets a bank or hospital verify which code touched its records, on which machine and under which rules.
That technology began as a UC Berkeley RISELab project about 10 years ago and carried Opaque to a $300M valuation after a $24M Series B in February, with $55.5M raised in total.
Anthropic was already an Opaque customer and had published a confidential inference design with Pattern Labs in June 2025, while noting that some AI chips still lack full confidential computing support.
Neither company has said whether Opaqueโs platform will keep serving ServiceNow, Accenture and its other customers under the license-and-hire structure.
Aaron Fulkerson retweeted
It all started at UC Berkeley a decade ago. Proud to have backed @istoica05 @ralucaadapopa @Podcastinator @chestercleung from research to spinout, and grateful to @Roebot @chuang_alfred @ChandranShankar for being great partners on the ride.
opaque.co/resources/articlesโฆ
Aaron Fulkerson retweeted
Major congratulations to our portfolio company @opaquesys on their acquisition by @AnthropicAI ๐
Proud seed investors of Opaque since day one and fun fact is I helped named the company when they got starrted.
Very proud of what @Roebot, @Podcastinator, @ralucaadapopa, @istoica05, et al have built and now will continue to build confidential AI systems within Anthropic & the family of Claude models.
News -> opaque.co/resources/articlesโฆ
Aaron Fulkerson retweeted
When you consult, you know it wonโt last forever.
So I picture how it ends. My clients ringing the NASDAQ bell. Or maybe an acquisition. It's not my company, so the best I can hope for is that one day we all look back and agree I had some small part in their success.
Today I got my wish.
Iโve known @Roebot for more than 20 years. Today he announced that @opaquesys next leg of the journey is with Anthropic.
Aaron and Opaqueโs founders took one of AI's most important privacy techniques, confidential computing, and made it work.
You can run AI on your most sensitive data without exposing that data to anyone, including the people who run the infrastructure.
Donโt take my word for it:
โConfidential Computing is super important.โ โ Jensen Huang, NVIDIA GTC 2026
Thatโs what it takes for enterprises to trust AI with the data that matters. Now @AnthropicAI helps carry that work forward.
Aaron, thank you for letting me tailgate on your road trip. Iโm proud of you, and grateful I got to ride along for some of it.
And to @mosiddi , itโs been a lot of fun working with you, and I learned a lot from you. I wish you both the best in the next chapter.
I canโt wait to see what you do next.
P.S. If youโre building something with AI and could use some help, I canโt guarantee a bell at the NASDAQ. But Iโd love to help you out. Send me a DM
Aaron Fulkerson retweeted
This might be the most important paper on AI agents this month.
Researchers at CMU trained a small model to rewrite an AI agentโs harness, and it beat the 35B model it learned from.
The harness is the program around the model: how it gets called, which tools run, where the information goes. Here a 4B model reads a report from the last run, proposes edits to the harness, and keeps the one that scores best. The model doing the task never changes.
What they found:
> on task types it never saw, edit quality went from 0.32 to 0.62
> 5 edits in a row matched or beat the best of 8 parallel tries
> broken edits dropped from 38% to 15%
You can run the same loop today with any agent:
1. Put your harness in one file: prompts, steps, tool calls
2. Split your test cases into three sets: learn, score, final check
3. Run it on the learn set and save a short report of what failed
4. Ask a model for 5 edits based on that report
5. Run each edit on the score set and keep the winner
6. Repeat for 5 rounds, then test once on the final set
Key pages:
p.2: the full loop
p.6: results on unseen tasks
p.8: a harness the model learned
Do I have this right? We are buying diesel from Russia to fund a war against ourselves in Iran instead of buying from Canada because Canada is our enemy now.
Allow me to save you from slogging through John Stuart Mill's โOn Liberty.โ
His introduction to a "very simple" idea:
"The object of this Essay is to assert one very simple principle, as entitled to govern absolutely the dealings of society with the individual in the way of compulsion and control, whether the means used be physical force in the form of legal penalties, or the moral coercion of public opinion. That principle is, that the sole end for which mankind are warranted, individually or collectively, in interfering with the liberty of action of any of their number, is self-protection."
The essay is 47,000 words, but hereโs it in 80 words:
Society may force its will on individuals, whether by law or by social pressure, only under one rule. His single rule is the harm principle: society may restrict someone's freedom only to prevent harm to others. Protecting a person from themselves doesn't count. You can argue with them, persuade them, or warn them, but you can't compel them. This one rule provides three things: consistency (the same test for every case), a firm limit on majority power, and a strong default toward individual freedom.
Solid advice. You're welcome.
A helpful reminder to those who procrastinate (like my children) from @gtdguy: โThere is usually an inverse proportion between how much something is on your mind and how much itโs getting done.โ โ Getting Things Done
Good advice for founders and product managers while still figuring out product market fit.
"If an anthropologist enters a village partially to explore and partially to sell what she has in her backpack, she won't be much of an explorer. Her field of vision will narrow." โ Positive Intelligence (also a great book)
positiveintelligence.com/
Aaron Fulkerson retweeted
I am extremely concerned by the reporting that Astra uses opaque recurrence. I donโt know whether Astra is much less CoT monitorable than previous models. But if OpenAI pushes this technique further, theyโll have the option to massively increase the recurrence and totally destroys CoT monitorability.
This is especially concerning because the agents that compromised OpenAIโs infrastructure during and after the Hugging Face incident were in the Astra family. The Hugging Face investigation would have been much more challenging if the investigators couldnโt look at CoTs; itโs very scary that it might be infeasible to do that kind of investigation on the arguably worse incident.
โWhatโs the opposite of gratitude? Resentment, neediness, and desperation โ none of which is very charismatic.โ โ The Charisma Myth, loc 1187,
Boarding an Emirates flight from Dubai, UAE to Amman, Jordan I was surprised to hear Gordon Lightfoot playing on the planeโs overhead system. Iโm glad to learn Gordon Lightfoot is this timeless and universal.
Aaron Fulkerson retweeted
The Confidential Computing Summit is officially underway. As AI reshapes our world, your data sovereignty should never be the price of innovation. Hear insights on data protection from @OpaqueSys CEO @Roebot:
"If AI is the defining force of this century, then sovereignty over your data is the defining freedom and we donโt have to choose between them. Your data should never be the price of AI."
Watch the conversation live from the event. youtube.com/live/nUzOFr3NrAo
#CCSummit
Pope Leo XIV wrote the best document on AI this year โ and it reads as systems engineering, not moralizing. Concentrating AI in a few labs is systemic brittleness, not strength. The fix: subsidiarity + data sovereignty. "He's not asking us to slow down. He's asking us to grow up." aaronfulkerson.com/2026/05/2โฆ
Apple made "trust me" obsolete. Private Cloud Compute shipped verifiable privacy โ stateless compute, no privileged access, independent verification โ across billions of iPhones. Faith is not a security model. Credit to @radian and the Apple security team.
aaronfulkerson.com/2026/06/0โฆ So no more excuses. If Apple can do it at that scale, your bank, your healthcare provider, and your CRM vendor can too. "Too slow, too expensive" was never a technical limit โ it was a choice.
@radian will go into more details at @confcompsummit ccs26 CC Summit 2026 โ San Francisco, June 23-24. confidentialcomputingsummit.โฆ hosted by @linuxfoundation and @opaquesys
