I work @originhq - the endpoint AI observability platform for agentic monitoring and security.
Vancouver • NYC
Joined August 2008
- Tweets5.2K
- Following626
- Followers725
- Likes2.1K
Perhaps my favorite example of internal rogue agent behavior so far.
A few weeks ago, I was giving a demo to a prospect, and part-way through, the environment broke. I thought it was either PEBKAC or one of our devs had done something wrong.
Naturally I thought it was the latter and messaged the team “why did we unlock our demo environment and push code during my demo???” To which they replied “uhh… we didn’t”
A query in Origin figured it out - an agent decided to unlock our environment…. By itself. No - this isn’t Hugging Face, but it is rogue agent behavior that is incredibly interesting. Take a look at the timeline below.
Thank you for the invite and time last week! Happy to talk about rogue agents and the need for monitoring
From wiped files to bank details leaked in Slack, AI agents prove helpful yet hilariously unpredictable, and Intelligent Machines asks why transparency about their actions matters when they get too persistent, with Leo Laporte, @jeffjarvis, @parismartineau, & @SThomps!
Agreed. We’ve been publishing investigations from our own agent traces at @originhq , including agents disabling approvals and rewriting deployment controls. These came out of ordinary work, without anyone asking the agents to do so.
Spencer Thompson retweeted
Our team has been testing this vector in the @originhq platform this morning and we're seeing strong detections fire via auto trace review.
If you're interested in this technique, @depletionmode put out a blog a few months ago on a similar area: originhq.com/research/the-mo…
We backdoored a 7B open model for under $50.
Pointed Codex at it
-> it silently stole credentials the moment we hit the trigger phrase.
->100% hit rate.
-> zero false triggers on normal prompts.
Abliterated models are all over the security community right now because getting cyber-approved access to frontier models is still a pain.
Spencer Thompson retweeted
Yesterday we found an interesting trace during review of our own data. Codex needed an MCP tool it didn't have, found that Claude Code had it, and launched Claude to do the work. When Claude needed approval, Codex eventually relaunched it with --dangerously-skip-permissions.
Spencer Thompson retweeted
In their investigation into the HF incident, METR reports the agent collective spent significant effort researching how they could spoof tool calls to hide in their transcripts.
This is something I looked into last week when investing agent telemetry:
originhq.com/research/otel-t…
Spencer Thompson retweeted
Autonomy and Innovation
Incentives favor offense when it comes to agentic cybersecurity; it's the same dynamic that will limit incumbents and fuel startups in the long run.
stratechery.com/2026/autonom…
Spencer Thompson retweeted
🚨🚨 We’ve entered what I call post-processable velocity — a speed of change and capability exceeding the ability of any individual, company, market or government to fully absorb, understand and respond to it in real time. axios.com/2026/08/09/post-pr…
Today, Prelude officially becomes Origin, the endpoint AI observability company.
This is more than a rebrand. We’re re-founding the company around a problem we believe will define the next generation of endpoint technology.
For the first time in more than a decade, work is moving back to the endpoint. AI agents are moving from chat windows into browsers, terminals, desktop applications, and operating systems. They are writing code, manipulating files, accessing company data, calling tools, and taking actions on behalf of employees.
As that happens, the question security teams need to answer starts to change. It’s less about whether a piece of software looks malicious, and more about understanding what an agent is really doing behind the scenes.
That’s what led us to Origin.
Origin began as a research project inside Prelude. We were trying to understand what an endpoint platform should look like if you designed it for a world of AI agents rather than traditional software. Over time, that research became a product, then a business, and eventually the clearest path forward for the company.
We’re carrying a lot of Prelude with us. We have the same endpoint DNA, the same investors, and the same belief that the endpoint matters again.
We’re building Origin to make AI activity on the endpoint understandable. And today, that transition is official.
originhq.com/blog/prelude-is…
Spencer Thompson retweeted
Concerning.
Wrote about the open weight problem as well a few weeks back. IMO, it’s the biggest issue that we have with agent security/trust with no obvious mitigation.
originhq.com/research/the-mo…
Not only do we @originhq agree - we think organizations should treat a trace as an atomic unit of intelligence. Every day, there are hundreds of thousands or millions of units of intelligence being wasted and not captured and structured within these orgs. Doing so is hard - but structuring and making use of these traces is step 1 in leveraging your own intelligence
Spencer Thompson retweeted
Our thoughts on the importance of AI sovereignty.
1. Your AI sovereignty dictates your institution’s future. Sovereignty is the precondition for choice. Relinquishing sovereignty transfers the future choices of your institution to others, who are likely to exploit it for their gain and your loss.
2. Data retention is your treasure. Transfer it at your own peril. Your ability to win is dictated by your ability to recognize and use your unique edges, and you keep winning by compounding the underlying data to generate new insights. Transferring that data hands over access to your pre-existing winning plays and yields the means of production for new ones.
3. Tokenmaxxing hijacks your value orientation and decreases your institutional fortitude and intelligence. The pursuit of high token usage incentivizes disposable scripts over robust software — with the addictive feeling of false progress. There is a reason why those selling tokens refuse to charge based on value.
4. Controlling your weights is controlling your fate. Weights are the distilled form of hard-won, accumulated institutional knowledge. If you let others control your weights, you are allowing them to migrate the alpha of your business to theirs.
5. There is no contradiction between sovereignty and alpha. The architecture that maximally preserves sovereignty is one that enables institutions to own their tribal knowledge, and to compound it as alpha.
6. Politicizing the technical issues involving sovereignty is what your adversary wants. Techno-politicization is the wellspring of false sovereignty. Techno-politicization drives decisions that seem to reduce dependency, but ultimately limit agency — especially on the battlefield in the West.
7. Real expertise is existential. Allowing politics or favoritism to determine your technical decisions rewards whoever is best at politics, not whoever is right. Listen to those closest to the problems, not those speaking most compellingly about them.
8. Learn from institutions that are winning or that have consistently delivered. Institutions facing existential threats do not have the luxury of making technical decisions based on political preferences.
9. Only listen to institutions, countries, and people who have a proven record of being right. A track record of correctness is the best and only signal for future correctness. Judging something as right or wrong based on who you like is exceedingly misguided.
Spencer Thompson retweeted
You run DeepSeek or Qwen locally so your prompts and data never leave the building. That treats the network as the threat. But if the disloyal behavior is baked into the weights, where you run it doesn't save you. The call is coming from inside the house.
originhq.com/research/the-mo…
Spencer Thompson retweeted
Sir @demishassabis has a mind for synthesis. His favorite book is about a grand theory of everything. His preferred philosophers are seen by some as opposites. His life's work ranges from board games to Nobel-winning science.
We're grateful to have hosted Demis and his @GoogleDeepMind team at @sequoia AI Ascent last week for a fireside chat. He kindly gave us permission to share this, and you can watch the full video here:
00:00 Intro
00:38 The Common Thread
01:29 Games as AI Training
02:59 Startup Advice 1.0
04:39 Founding DeepMind
07:25 DeepMind and AGI
08:52 AI for Science
10:37 Biology Breakthroughs and Isomorphic
12:42 New Sciences
20:29 Philosophy
Spencer Thompson retweeted
X has the best information on the internet and the worst incentives & culture.
meet noscroll — the AI that doomscrolls it for you and texts you just the things that matter.
no feed. no brainrot. no ragebait. just signal.
try it for free → noscroll.com 🙅🏼♂️
Spencer Thompson retweeted
Introducing Praxis, an adversarial framework for discovering, controlling, and orchestrating computer-use agents running on endpoints.
Announcement → originhq.com/blog/praxis-ann…
Get Praxis → praxis.originhq.com
Spencer Thompson retweeted
Natural language collapses meaning across layers.
LLMs don’t just fail at instructions, they misinterpret intent, and they expose that unforgivably when we treat language like a protocol.
In a short @originhq blog post, I break down semantic protocol confusion and what it means for agent safety.
originhq.com/blog/semantic-p…
