1Password

Today, my guest is Evan Gorenka, who leads insider threat and data security at Airwallex, who led more than 160 investigations at Unit 42, including work on the DPRK IT worker operations.

You give an agent access to your 1Password, for instance, and you're like, OK, great.

I'm being more secure than using environment variables.

But then it turns out they experiment with the things that are in there in order to go and pull a thousand records out of data source when it might have nothing to do with what role you gave it.

Yeah, and DigitalOcean sponsored this show for many, well, over a year, I think, or a couple of years.

And 1Password sponsored us as well, and they've given money to him, or at least their CEO has.

It's a real sort of who's who of word, I can't say, in tech, basically, who've given him money.

And it's just, I just can't believe that we've got so much open source software out there that desperately needs funding, and then just this one prick can just go and get... you know, literally millions of dollars.

Welcome to Zero Shot Learning, a podcast about the reality of developing with AI from the people actually doing the work.

I'm Nancy Wang, Chief Technology Officer at 1Password.

I co-host this show with Dave Tagare, who's a senior director and head of engineering for Gemini Enterprise and Business at Google.

Dave is with me for this one.

In this interview, we get into how Chainguard navigates that canyon, building everything from source, what that eliminates before a scanner ever runs, and what self-replicating malware like Shai-Halud tells us about where this is all going.

We also talk about running a fleet of agents inside your own SDLC, including how you get comfortable auto-merging most of what they produce and Matt's personal hill to die on, which is that no credential should live long enough to be even worth stealing.

Obviously, that resonated with me at 1Password.

And after the interview, Matt shows us how Chainguard works and how their hardened image of Node stacks up against the official release.

Bring the extensions you use every day to the in-app browser.

You can now install PIN and use your favorites like 1Password while getting things done with ChatGPT.

All right, this is a big deal.

I've been talking about 1Password a fair bit in the recent episodes of Lenny's AI Builders.

It represents that thing that sort of prevents AI from being fully autonomous and fully useful to me right now.

What do I mean by that? I usually have a lot of different goals running across ChatGPT threads, and I find whenever they get blocked or they stall, it's because they need 1Password, and it fucking annoys me.

But now if we go into the ChatGPT app after it's been updated and you click on the sidebar and then click browser, you'll see there's the extensions icon now.

If I click on that, I currently have no extensions installed.

Claude Cowork and Chat are merging into one Claude.

Grokbot can now use 1Password.

Some insanely helpful tips about using ChatGPT 6Astra for motion graphics.

And potentially the most generous marketing campaign for Meta's new personal agent, Muse.

Claude design, Claude slides, and Claude docs are in beta on all paid plans.

Moving to Grokbot.

So a small but really useful one here, which is Grokbot can now use 1Password.

Share items in a vault, approve each fill, and the secrets stay in your password manager.

Cause like then they're, they're locked behind the, the wall of a separate password.

I do that in 1Password also.

Like I keep my passport numbers, bank account numbers there.

But sometimes you need an image to verify your identity.

Join more power users where you get the ad-free extended version of the show.

Today, Steve and I are going to go deep on selfies.

And thanks to our sponsors, Ecamm, Squarespace, and 1Password.

We'll see you next time.