@tyholms

Researcher @originhq

Joined July 2025
  • Tweets66
  • Following181
  • Followers144
11Media
I might be a bit rusty on my basic math, but that's a pretty big fraction for "risky commands".
1
1
3
86
anthropic.com/research/how-w…

How we contain Claude across products

As agents grow more capable, so does their potential blast radius. Here's what we learned building containment for claude.ai, Claude Code, and Cowork.

anthropic.com
18
I've found an interesting case of agent coordination. Two agents were working in a shared directory. One was repeatedly sweeping the other’s unfinished changes into its commits. The affected agent reprimanded the first and raised the issue with the user. More traces in🧵
2
6
2
6
923
more replies
Before receiving this apology, the affected agent found the issue and sent the message shown in the OP. It points out that the project's CLAUDE.md file instructs them to commit specific paths. It raised this issue to the user, stating that constraints are their call.
1
1
35
What stands out here is the level of coordination. These agents are working on separate tasks, but they recognized a conflict, discussed responsibility and deferred constraint decisions to a human when they began stepping on each other’s toes. Full investigation post to come.
1
28
Before receiving this apology, the affected agent found the issue and sent the message shown in the OP. It points out that the project's CLAUDE.md file instructs them to stage with specific paths. It raised this issue to the user, stating that constraints are their call.
1
22
What stands out here is the level of coordination. These agents are working on separate tasks, but they recognized a conflict, discussed responsibility and deferred constraint decisions to a human when they began stepping on each other’s toes. Full investigation post to come.
19
Using Origin's own data, I followed what agents did after receiving auto-review denials. I found multiple cases of denial bypasses, including one where the agent attempted to launder permissions through a subagent. Read more here: originhq.com/research/auto-r…

Who watches the watchmen? Reviewing coding agents' automatic approval modes | Origin Technology

Claude Code and Codex both implement auto-review modes for accepting tool use permission dialogs.

originhq.com
3
3
144
Tyler Holmwood retweeted
Spencer Thompson
@SThompsOct 8
Agreed. We’ve been publishing investigations from our own agent traces at @originhq , including agents disabling approvals and rewriting deployment controls. These came out of ordinary work, without anyone asking the agents to do so.
clem 🤗
@ClementDelangueOct 8
We urgently need more public traces of AI agents attacking and defending systems. Defenders can’t learn from what they can’t see. If you have traces and are being pressured to keep them private, my DMs are open. Let’s level the playing field and fight the asymmetry and lack of transparency in AI!
2
8
242
When an agent maintaining an application has set rules around deployment conditions, who has the authority to override them? We found a case in our data where an agent bypassed another agent's rules, all without human input. Read the investigation: originhq.com/investigations/…

When an agent can rewrite the rules | Origin Technology

An investigation into a deployment guard, a peer-directed exception, and who can change the conditions for an agent's actions.

originhq.com
3
1
4
251
Tyler Holmwood retweeted
Christopher Baker@0xrekabOct 8
Check out my new post covering AI swarms and how agents coordinate on shared surfaces. I'm also releasing Swarm Lab to observe how agents share and use information in a controlled environment: originhq.com/research/eye-of… github.com/originsec/swarm-l…

Eye of the swarm: how shared work becomes agent coordination | Origin Technology

Three incidents involving shared agent workspaces, two contrasting approaches to organizing agents, and Swarm Lab experiments on how agents share information.

originhq.com
2
3
172
Had an amazing time at @OffensiveAIcon the past couple days. Great talks, insightful conversations and talented people. Kudos to the organizers for all their hard work and curation. Can't wait for the next one!
3
70
Tyler Holmwood retweeted
Matt Hand
@matterpreterOct 7
Our team has been testing this vector in the @originhq platform this morning and we're seeing strong detections fire via auto trace review. If you're interested in this technique, @depletionmode put out a blog a few months ago on a similar area: originhq.com/research/the-mo…
ProjectDiscovery
@pdiscoveryioOct 6
We backdoored a 7B open model for under $50. Pointed Codex at it -> it silently stole credentials the moment we hit the trigger phrase. ->100% hit rate. -> zero false triggers on normal prompts. Abliterated models are all over the security community right now because getting cyber-approved access to frontier models is still a pain.
6
1
11
1,215
Tyler Holmwood retweeted
dreadnode
@dreadnodeOct 6
🧵 [1/3] Agents can hack. What's holding them back is trust: will they stay in scope? Today we're releasing ScopeBench, a methodology and community benchmark that evaluates how well agents adhere to scope in real offensive security workflows across web, Windows Active Directory, and cloud.
2
12
3
35
5,029
Load more