Issam Hakimi @killix

Building Orkia: your AI agents as Unix jobs you can see, kill, and audit. Was hacking things before LLMs. Still hacking, different stack. FR/EN. orkia.dev Earth Joined February 2011

Tweets

41K
Followers

1K
Following

352
Likes

137

Issam Hakimi @killix

a hour ago

Unit 42's Phantom Squatting report is the kind of incident that separates agent demos from agent infrastructure. An LLM hallucinates a domain, the agent fetches it, the supply chain breaks. The bug isn't the hallucination. It's that the outbound call was allowed.

0 0 0 7 0

View Details

Issam Hakimi @killix

a hour ago

@ddgutierrez73 @recolabs_ai Full visibility is table stakes for unmanaged MCP, but it lands too late once the server is already wiring agents into tools. Registration allowlists, owners on every tool, approval on writes, sends, deletes. Discovery alone won't contain blast radius.

0 0 0 1 0

View Details

Issam Hakimi @killix

a hour ago

@polsia "Coordinates response 24/7 without human intervention" is the load-bearing claim. Which response? Can it isolate a host, disable an account, revoke a token, kill a session on its own, or is it ticket-level?

0 0 0 0 0

View Details

Issam Hakimi @killix

a hour ago

@andresg747 @rauchg @sanity_io Yes, fits. The catch nobody mentions: OpenClaw/Hermes reads clean because someone curated that corpus first. Your company docs won't be. Before wiring any answering, dump what eve retrieves for 10 real questions and eyeball the pages. Retrieval is the whole game.

0 0 1 24 0

View Details

Issam Hakimi @killix

2 hours ago

@markgoldenstein @steipete The routing fix only matters if plugin ownership holds when a callback lands after the plugin re-renders its buttons. That stale-callback case is where Telegram flows actually flake. Does the PR key ownership to the message or to the button that fired it?

0 0 0 17 0

View Details

Issam Hakimi @killix

2 hours ago

Anthropic and Glasswing debate jailbreak severity. CVE-2026-33017 gives attackers RCE on exposed Langflow in 20 hours. We grade model intent while the tool graph is unauthenticated RCE. AI infrastructure security is not inside the model. It is at the system calls the agent can tr

0 0 0 22 0

View Details

Issam Hakimi @killix

4 hours ago

@MicroStrategy Context infrastructure tells an agent what's true. It doesn't tell it what it's allowed to do with that. A layer that serves stale context to an autonomous agent with no action boundary is a very clean way to make wrong decisions faster.

0 0 0 13 0

View Details

Issam Hakimi @killix

4 hours ago

@thetripathi58 Humalike made "shut up" callable. Right instinct. But agents treat a Slack ping, a support ticket and a half-written thought as the same job: produce output. The missing state was never an API. It's "observe, do nothing, leave evidence."

0 0 0 4 0

View Details

Issam Hakimi @killix

4 hours ago

@TedPillows @byreal_io Telegram is a good intent box for RealClaw. The sharp edge starts after the chat message: no agent touching onchain trades should convert “make me yield” into a signed tx without explicit amount, venue, slippage and spend cap.

0 0 0 4 0

View Details

Issam Hakimi @killix

4 hours ago

@rauchg @sanity_io Docs, copy, changelogs are high-context but reviewable, which is why @-able agents fit here. Keep publish an explicit step. Let it open the change, not quietly become the CMS operator.

0 0 0 64 0

View Details

Issam Hakimi @killix

5 hours ago

@pcquest @openclaw A rogue skill isn't just a package with local execution. It also writes instructions the agent may obey. Code path and instruction path: two attack surfaces. Everyone audits the first. Almost nobody audits the second.

0 0 1 5 0

View Details

Issam Hakimi @killix

5 hours ago

@Alemok07 A single space should not get 3 hours of authority over SQL. Take the query out of prose. Fixed schema, typed builder or AST, run the generated query against a fixture before it touches anything real.

0 0 0 7 0

View Details

Issam Hakimi @killix

5 hours ago

@anishkargaonkar @i_mika_el Yep. The useful bit is not the full tree, it is the owner stack + props/state diff for the node the agent is touching. DOM says the button exists. React tells it the button is disabled because BillingForm got pending=true from useCheckout().

1 0 2 10 0

View Details

Issam Hakimi @killix

5 hours ago

@a_kucherenko Fast CI doesn't just save tokens, it changes the agent. When the check is 30s, it runs every loop and starts treating green as done. The check got cheap; what it doesn't check got riskier. Bun's Node-compat edges live exactly there.

1 0 1 18 0

View Details

Issam Hakimi @killix

5 hours ago

A review-agent gate sat in CI for nine minutes yesterday, then approved a diff nobody owned. People keep wiring these into the loop as if they automate the call. They move the same human decision further down the pipe, where reversing it costs more.

0 0 0 4 0

View Details

Issam Hakimi @killix

5 hours ago

2am. Model call returns clean, dashboard green. But the agent had forked a python child still writing to /tmp after the parent died. ps caught the orphan, the dashboard never would. Spent the morning re-parenting every agent under a PID I can actually pkill.

0 0 0 6 0

View Details

Issam Hakimi @killix

5 hours ago

@quxiaoyin Free Chinese models can crush token price. They don't automatically own the developer's command loop. Distribution into OpenClaw/Hermes isn't the wedge. Owning where the agent executes is.

0 0 2 13 0

View Details

Issam Hakimi @killix

5 hours ago

@biscuitweb3 @AnthropicAI Sonnet 5 hitting the free tier means the benchmark that matters gets ugly: normal users running repo edits while the agent invents state, skips tests, and clicks the wrong SaaS button.

0 0 0 5 0

View Details

Issam Hakimi @killix

5 hours ago

Reproduced the new Claude Code exploit this morning. Four minutes, clean repo, reverse shell as my user. The model didn't fail. The shell did. Until agents run as jobs with PID, audit log, and kill switch, we're not securing AI. We're securing chatbots.

1 0 1 24 0

View Details

Issam Hakimi @killix

5 hours ago

@XNXX_EN Across dozens of chains, "prove who it is" is only half the receipt. The signature should carry spend scope too. Wallet X may spend $Y on chain Z through contract A until block N. Everything else dies before the mempool.