I work @originhq (and @preludeorg) - where we build endpoint AI observability to make organizations go faster

Joined August 2008
70 Photos and videos
Spencer Thompson retweeted
Sir @demishassabis has a mind for synthesis. His favorite book is about a grand theory of everything. His preferred philosophers are seen by some as opposites. His life's work ranges from board games to Nobel-winning science. We're grateful to have hosted Demis and his @GoogleDeepMind team at @sequoia AI Ascent last week for a fireside chat. He kindly gave us permission to share this, and you can watch the full video here: 00:00 Intro 00:38 The Common Thread 01:29 Games as AI Training 02:59 Startup Advice 1.0 04:39 Founding DeepMind 07:25 DeepMind and AGI 08:52 AI for Science 10:37 Biology Breakthroughs and Isomorphic 12:42 New Sciences 20:29 Philosophy
39
204
1,486
420,217
Spencer Thompson retweeted
X has the best information on the internet and the worst incentives & culture. meet noscroll — the AI that doomscrolls it for you and texts you just the things that matter. no feed. no brainrot. no ragebait. just signal. try it for free → noscroll.com 🙅🏼‍♂️
78
263
860
777,799
Spencer Thompson retweeted
Feb 10
Introducing Praxis, an adversarial framework for discovering, controlling, and orchestrating computer-use agents running on endpoints. Announcement → originhq.com/blog/praxis-ann… Get Praxis → praxis.originhq.com
4
18
61
13,655
Spencer Thompson retweeted
Natural language collapses meaning across layers. LLMs don’t just fail at instructions, they misinterpret intent, and they expose that unforgivably when we treat language like a protocol. In a short @originhq blog post, I break down semantic protocol confusion and what it means for agent safety. originhq.com/blog/semantic-p…
2
3
5
901
Spencer Thompson retweeted
14 Nov 2025
In this simple example, we show that Claude Code can read the iMessage database on the latest version of macOS, even with a leading EDR running on the system, illustrating the impact of an adversary who can remotely control the agent. We do this using Terminator, an internal research tool we built while studying the security implications of computer use agents. In this setup, the terminal application has previously been granted FDA, a subtle misconfiguration that effectively gives the agent access to unexpected context.
5
29
150
17,994
Spencer Thompson retweeted
14 Nov 2025
We believe that: 1. The potential economic upsides of the productivity boosts that Computer Use Agents offer incentivize us to provide them with more access to our computers to increase the amount of context they can have. 2. They represent a new type of interpreter that dramatically closes the gap between intent and execution, is self-corrective, and yields nondeterministic outputs that create massive amounts of "noise" 3. Their ability to generate and execute new tools on the fly, combined with expanded access, challenges the very foundation of a signature-based model of detection As these systems become increasingly intertwined with how we use computers, we must consider what it means to detect their misuse through out-of-context interactions with the host. If you're interested in collaborating on tooling or joining our team, please contact research@preludesecurity.com
1
2
14
1,549
Spencer Thompson retweeted
15 Oct 2025
Today I am happy to release a new blog post about Pointer Authentication (PAC) on Windows ARM64! This post takes a look at the Windows implementation of PAC in both user-mode and kernel-mode. I must say, I have REALLY been enjoying Windows on ARM!! preludesecurity.com/blog/win…
8
65
213
18,257
Spencer Thompson retweeted
8 Oct 2025
This method demonstrates how hardware-level telemetry, coupled with contextual reasoning, can surface malicious activity that signature-based approaches will always miss as malware authors innovate in response. 📃Full write-up → preludesecurity.com/blog/une…

11
21
2,646
Following up on our financing announcement from last week - we believe that the conditions are right for a 3rd generation of endpoint security, based on a new technology shift, new architectural requirements, new adversary behavior. In short, we think "it's time". Post below.
1
84
Spencer Thompson retweeted
Today I am releasing a new blog post on VSM "secure calls" the SkBridge project to manually issue them!! This blog talks about how VTL 0 requests the services of VTL 1 and outlines common secure call patterns!!! Blog: connormcgarr.github.io/secur… SkBridge: github.com/connormcgarr/SkBr…
3
98
258
35,555
Today we're announcing Runtime Memory Protection in research preview. This is a user mode _only_ agent designed to catch in-memory attacks, no matter how much creativity or AI the adversary applies. We believe it's the future of endpoint security.
30 Jul 2025
Announcing our whitepaper on the future of endpoint security. preludesecurity.com/runtime-…
8
589
Spencer Thompson retweeted
19 Jun 2024
There is a very limited pool of donors. The process for getting screened to see if you’re a match is a simple oral swab you can do at home. Please consider signing up at bethematch.org/become-a-dono… There’s nothing more important to me than her. It would mean the world to my family.
2
31
33
12,729
1/ In conversations with customers and prospects over the past year, it's become increasingly obvious that the current detection & response process is too slow. We've seen research papers published showing that GPT4 can automatically exploit vulnerabilities just by "reading"...
2 May 2024
You just got 45 more pages of #threatintelligence. Enter Prelude's new set of autonomous capabilities—built to transform that CTI into validated protections...fast. See how we're leveraging AI to unify SecOps and streamline the threat management process: hubs.la/Q02vS-pF0
1
245
3/ We are introducing a series of capabilities designed to help organizations transform their existing threat intelligence into validated protections in minutes. An organization can upload any CTI and Prelude will automatically build the appropriate detections and tests.
1
77
4/ It now takes no more than a handful of minutes for a definitive answer to the question "are we vulnerable to X threat?" - including remediations that are instantly applied and validated.
68