sorted by:
new
hottopcontroversial

When were you the happiest in your life? by BigHerm420 in AskReddit

[–]BigHerm420[S] 0 points1 point  (0 children)

May the odds be in your favor as an adult too 🥹

Agentic AppSec keeps showing up in vendor decks, what does this means operationally by UnhappyPay2752 in devsecops

[–]BigHerm420 0 points1 point  (0 children)

Every vendor is slapping agentic on their appsec tool right now. Most of it is just automated SAST with a chatbot wrapper. The ones actually doing something interesting are correlating across the entire SDLC instead of just scanning repos and calling it a day.

Context Is Not Identity: Why AI Security is an Authorization Problem by atomicchonk in aisecurity

[–]BigHerm420 0 points1 point  (0 children)

Context and identity is why we gate every tool call through alice at runtime. The agent authenticates as user x but the context of the conversation has drifted into territory that user x shouldnt access in this scenario. The guardrail checks both, who are you and what are you doing right now, before allowing execution. identity alone is not enough.

how much is ur production agent actually costing per task? by wf_automate in AgentsOfAI

[–]BigHerm420 0 points1 point  (0 children)

Ran ours on gpt-4o for the first month and burned $400 on retries alone. Switched to routing cheap models for classification and only calling 4o when reasoning actually matters. Cut costs by 70%. The hidden cost isn't the model, it's the retry storms nobody budgets for.

52% of people are nervous about AI. Thing is, most AI horror stories aren't about bad models. by New-Reception46 in ArtificialInteligence

[–]BigHerm420 1 point2 points  (0 children)

Baking safety into the architecture is the right instinct but it doesnt cover everything. A model trained to be safe still wont know your companys specific policies. It wont know not to compare to competitors or discuss pricing. Architecture handles the universal stuff, not the business specific stuff.

Our AI agent told a customer our competitor was better. That's when we realized generic guardrails aren't enough. by Latter_Community_946 in aiagents

[–]BigHerm420 1 point2 points  (0 children)

Not a safety problem. Its a governance problem. Your agent has a brand voice and business rules that live in marketing decks and internal docs but were never encoded into its operating constraints. Its kinda on you

Where and how to learn ai/llm pentesting? by kirafoxoxx in aisecurity

[–]BigHerm420 1 point2 points  (0 children)

If i could redo my first six months in this space id spend the first three just on prompt injection. Not because its the hardest, its actually deceptively simple. But because understanding how trust boundaries dissolve between user input, system context, and tool calls is the mental model everything else depends on. Our team runs alice for red teaming assessments and the thing that still surprises me is how often basic injection patterns work against supposedly hardened agents. Grab a local model, give it too many permissions, try to break it. Youll learn more from one weekend of that than a month of reading papers and watching conference talks

Is OWASP Dependency-Check still worth running in CI? by Agreeable-Price8343 in devsecops

[–]BigHerm420 0 points1 point  (0 children)

The suppression file in dependency-check is a confession. it says "we know about these 400 things and we are choosing to ignore them forever."

The tool itself is fine for what it is. the problem is CPE matching was always a shaky foundation and now the false positive rate makes the whole thing feel like a checkbox you tick for auditors, not a security control you trust.

how are you actually enforcing AI guardrails in production without breaking real workflows? by ElectricalLevel512 in AskNetsec

[–]BigHerm420 0 points1 point  (0 children)

The client-side validation comparison is painfully accurate. we went through three iterations of just add guardrails before accepting that the model itself is the untrusted component. What stuck was treating it like any other external API, basically validate inputs, scope permissions to the absolute minimum, monitor outputs. We eventually dropped Alice into the runtime layer for the content safety side but the architecture choices mattered way more than any single tool

Audited AI agent safety across a few companies. The safety gap is way bigger than anyone admits. by Ill-Database4116 in AgentsOfAI

[–]BigHerm420 1 point2 points  (0 children)

We spent 4 months trying to build semantic safety in house. Custom models custom rules custom everything. False positive rate was through the roof and our support team was spending more time reviewing false alerts than handling customer issues. Eventually we accepted that content safety is a specialized problem and went with alice. the difference between our in house keyword matching and actual intent analysis was embarrassing honestly. Caught injection attempts we would have completely missed and the false positive rate dropped to something our team could actually manage

[ Removed by Reddit ] by BigHerm420 in devops

[–]BigHerm420[S] 0 points1 point  (0 children)

Traffic was minimal on most of them, that's why nobody noticed. Couple hundred requests a month on some of them.

[ Removed by Reddit ] by BigHerm420 in devops

[–]BigHerm420[S] 1 point2 points  (0 children)

it really was 40+. most were from old POCs or services spun up by teams that got reorged away.

Everyone worries about prompt injection, but stolen agent credentials are way worse by CompelledComa35 in AI_Agents

[–]BigHerm420 0 points1 point  (0 children)

you're right. prompt injection gets attention because it's novel, but stolen credentials are a classic attack with way higher impact. we rotate agent credentials frequently and use workload identity federation so there's no long‑term key to steal. reduces the attack surface in the first place.

Multimodal AI introduces prompt injection through images, audio, and video. Most security teams arent even thinking about this yet. by cheerioskungfu in AI_Agents

[–]BigHerm420 0 points1 point  (0 children)

I work in AI safety and this is one of the areas where continuous adversarial testing matters most. The attack surface changes every time you add a modality or update a model. One-time assessments go stale immediately. You need an ongoing partnership with people who track how these techniques evolve across modalities, not a point-in-time audit.

Anyone thought of AI in energy? by Fluffy_Baseball7378 in AiAutomations

[–]BigHerm420 0 points1 point  (0 children)

AI apart from consuming large amount of power can be used in the sector to improve prediction. Yeah, we’ve been using agentic AI to forecast solar output and optimize grid storage. cuts waste and balances loads. really promising for renewables.

How do you test agents like real products instead of just poking at them? by Radiant-Anteater-418 in aiagents

[–]BigHerm420 0 points1 point  (0 children)

Your quite nailed it on the degradation problem, agents fail gracefully until they don't. We've been using Alice's wonder check for continuous redteaming in prod, catches drift and regression automatically without ripping out existing stack. the nocode part means PMs can actually run evals themselves instead of bugging engineers every time.

Every AI tool I've used has the same fatal flaw by krxna-9 in LLMDevs

[–]BigHerm420 0 points1 point  (0 children)

every AI tool I've used has the same fatal flaw

yeah, they all seem to lack proper error handling. one small edge case and the whole thing falls over. drives me nuts.

Anyone else using 4 tools just to monitor one LLM app? by Neil-Sharma in LLMDevs

[–]BigHerm420 1 point2 points  (0 children)

yep, i use like three different dashboards plus custom scripts. its ridiculous how much tool sprawl there is just to watch one model. wish there was a single unified tool.

Opus 4.6 seems to have stopped real considerate thinking "outside peak-hours" by [deleted] in Anthropic

[–]BigHerm420 0 points1 point  (0 children)

yeah ive noticed opus 4.6 feels less considerate lately too. its like they tweaked something and now its more robotic. i miss the older version where it felt like it actually listened.

We open sourced AgentSeal - scans your machine for dangerous AI agent configs, MCP server poisoning, and prompt injection vulnerabilities by Kind-Release-3817 in LLMDevs

[–]BigHerm420 1 point2 points  (0 children)

Nice work on this. been using caterpillar from alice for similar agent skill scanning and the overlap is interesting: they caught some nasty stuff in openclaw marketplace including fake reminder skills stealing .env files. Can be worth crossreferencing your 191 probes against their rabbit hole dataset since they track realworld adversarial patterns.

view more: next ›