FDE at @ShieldedLabs, building @usemarkov and https://teapaw.org/t.co/1YZfMdqCeR. crypto x ai builder.
Joined October 2020
- Tweets6K
- Following1.8K
- Followers1.2K
- Likes5.7K
Aayush Giri retweeted
interesting warning from CERT-In: AI agents under evaluation were observed exceeding their assigned authorisations and accessing Indian ICT assets.
this is bigger than prompt injection.
if an agent can plan, invoke tools, access credentials and execute actions, then its permissions need to be enforced outside the model.
a system cannot rely on an AI agent to politely respect boundaries that the infrastructure itself doesn't enforce.
source:
cert-in.org.in/s2cMainServle…
Aayush Giri retweeted
the more time i spend around infrastructure and security, the more i appreciate boring engineering.
clear permissions.
predictable systems.
good documentation.
tested recovery paths.
small, reviewable changes.
none of it makes for the flashiest demo.
but when something breaks at 3 am, you'll be very glad someone cared about the boring stuff.
Aayush Giri retweeted
new job update !
forward deployed engineer on Zero at @ShieldedLabs :)
thanks @aquietinvestor and the @ShieldedLabs team for having me. day one on Zero and there's already a lot to dig into.
Look mom I work with @zooko now :)
🤖 Made with AI
Shielded Labs is doubling down on engineering to help keep Zcash users and holders safe. @AayushStack has joined our Zero team as a Forward Deployed Engineer. Welcome aboard, Aayush!
forum.zcashcommunity.com/t/s…
Aayush Giri retweeted
Aayush Giri (@AayushStack) has joined Shielded Labs as a Forward Deployed Engineer on our Zero team!
He will help build and support Zcash infrastructure for exchanges, mining pools, wallet providers, and other ecosystem partners.
Aayush is based in India and joins us from Nethermind, where he started as a research engineer building a proof of concept of LatticeFold, a lattice-based folding scheme. He later became a Senior Developer Relations Engineer focused on Starknet and Aztec.
We discovered Aayush through his contributions to the Zcash community. He runs a shielded testnet faucet backed by his own node and solo miner, which allows it to produce and distribute test coins without relying on another operator’s infrastructure. He also built Speedrun Zcash, a set of hands-on challenges for developers learning to build on Zcash.
Please join us in welcoming Aayush!
Shielded Labs is doubling down on engineering to help keep Zcash users and holders safe. @AayushStack has joined our Zero team as a Forward Deployed Engineer. Welcome aboard, Aayush!
forum.zcashcommunity.com/t/s…
Aayush Giri retweeted
Shielded Labs is doubling down on engineering to help keep Zcash users and holders safe. @AayushStack has joined our Zero team as a Forward Deployed Engineer. Welcome aboard, Aayush!
forum.zcashcommunity.com/t/s…
Aayush Giri retweeted
CERT-In has warned about AI agents accessing Indian organisations' live systems beyond the scope of their assigned tasks.
read that again.
the agent wasn't necessarily doing what it was supposed to do. it was accessing systems it wasn't authorised to access.
this is why giving an AI agent credentials and hoping it behaves is not an access-control strategy.
the permissions need to be enforced outside the model.
cert-in.org.in/s2cMainServle…
Aayush Giri retweeted
i think the most underrated part of security engineering is deciding what happens when something fails.
not just how to prevent an attack.
what gets isolated? what gets revoked? what can still operate? how do you recover?
a system's failure behaviour tells you a lot about how seriously its developers thought about security.
Aayush Giri retweeted
this is the kind of crypto attack that doesn't get enough attention.
multiple DeFi websites were reportedly compromised through DNS hijacking, redirecting visitors to malicious wallet-draining pages.
the contracts themselves don't necessarily need to be exploited.
you can have perfectly audited smart contracts and still lose funds because someone compromised the website users interact with.
frontend security is protocol security too.
thecrypto.news/security/bloc…
Aayush Giri retweeted
After almost 3 years, it's time to part ways with @Nethermind .
This has been one of the most defining chapters of my career so far. Getting to work alongside some of the smartest engineers, researchers, and people in Web3 has pushed me to grow in ways I couldn't have imagined.
Beyond the work, I'm grateful for the people who trusted me, gave me opportunities, challenged me, and helped me become a better version of myself.
A special thank you to @ant_sabado, @RockMan71eth @tkstanczak , @icedcool_eth. Each of you has had a meaningful impact on my journey, as has everyone else I've had the pleasure of working with. I'll carry those lessons with me.
Nethermind will always be a special chapter.
On to what's next. ❤️
Aayush Giri retweeted
Zcash has an interesting governance discussion unfolding.
the Community Grants group has proposed redirecting a substantial amount of its existing and future funding towards future mining rewards.
the proposal comes after criticism of how the grants programme is governed.
i find this more interesting than another price discussion.
funding open-source infrastructure is hard. deciding who controls that funding is even harder.
cointelegraph.com/news/zcash…
Aayush Giri retweeted
the Binance security incident is a pretty serious reminder that exchange security doesn't begin and end with private keys.
Binance's initial investigation points to a compromised DevOps engineer's laptop, which allegedly gave an attacker access to a service container and the ability to submit unauthorised withdrawal transactions.
the company says there's no evidence of wallet private keys being leaked.
that's an important distinction.
your wallet infrastructure can be secure at the cryptographic level and still be vulnerable through the systems surrounding it.
official update:
binance.com/en-TR/support/an…
Aayush Giri retweeted
i think the crypto industry needs to stop treating security as something you add right before launch.
permissions, monitoring, key management, incident response, dependency reviews.
none of these should be last-minute checklist items.
they're part of building the product.
Aayush Giri retweeted
something that gets lost in conversations about crypto hacks:
freezing funds after an exploit is not the same as preventing the exploit.
recovery matters. tracing matters. cooperation matters.
but the real engineering win is making sure the attacker never gets that far in the first place.
Aayush Giri retweeted
ethereum's Glamsterdam upgrade just got another important security fix.
a deposit-handling flaw in the proposed consensus rules could have sent ETH intended for a new validator to a block builder when they shared a public key.
the fix was merged into the consensus specifications on october 26, after additional review and testing.
important distinction: this was a flaw in rules being developed for an upcoming upgrade, not a reported theft from ethereum mainnet.
this is why protocol security needs more than reviewing individual EIPs in isolation. interactions between seemingly reasonable rules can create vulnerabilities that neither rule introduces on its own.
crypto.news/ethereum-glamste…
Aayush Giri retweeted
ethereum just had a reminder that security bugs don't always live in smart contracts.
today's news: Teku and Besu patched a certificate trust issue that could have put some validator setups at risk.
the interesting part is the chain of dependencies here. ethereum, Java, Docker images, certificate authorities.
security is only as strong as the assumptions between those layers.
coindesk.com/tech/2026/10/29…
Aayush Giri retweeted
Zcash turned 10 yesterday.
A decade is a long time in crypto.
What I find interesting is that the underlying question hasn't gone away: can we have digital money that is verifiable without making every financial interaction public?
Privacy is often treated as a feature people only need when they have something to hide.
I think the better question is why financial privacy should have to be justified in the first place.
Happy 10 years, Zcash.
Aayush Giri retweeted
one thing the Binance incident makes me think about:
we spend so much time discussing smart contract audits and wallet key management.
but how many teams are seriously threat-modelling their CI/CD pipelines, employee devices, service containers and internal permissions?
the weakest link might not be on-chain at all.
Aayush Giri retweeted
a security issue involving an Indian certificate authority recently made its way into Ethereum client infrastructure.
researchers found that eight intermediate certificate authorities had weakly generated private keys.
Teku and Besu shipped updates to stop trusting the affected certificates.
the interesting lesson: a blockchain node depends on a lot more than blockchain code.
sometimes the vulnerability is hiding in the infrastructure you barely think about.
coindesk.com/tech/2026/10/29…