Trail of Bits AI-Native Journey

What it adds beyond the summary

The summary names the moves and the headline numbers. The page carries the operational specifics an engineer would actually copy: the exact repos, the concrete policy rules, the three-tier framing that defines the target state, and the named tools they're evaluating for the unsolved problems.

The three levels, defined. AI-assisted = ChatGPT/Claude as a productivity tool, org unchanged. AI-augmented = workflows redesigned with agents in the loop (AI does first-pass review, human does second). AI-native = org designed assuming AI is a core participant; expertise "compounds as code." This is the distinction the title turns on, and the summary doesn't state it.

Concrete policy from the AI Handbook. Cursor is banned on client code except blockchain engagements (use Claude Code or Continue.dev there). Meeting recorders are disallowed for client meetings under legal privilege. The handbook explains the risk model behind each rule, not just the rule.

Maturity matrix is role-specific. Level 3 differs by function: an engineer builds agent systems that ship PRs and close issues autonomously; a sales rep has agents producing pipeline reports and QBR prep; an auditor runs agents doing full analysis passes producing findings, triage, and report drafts.

Hackathon design details. 2–3 day sprints; the "v2" twist forced engineers into bypass permissions mode (fully autonomous, no approve-every-action) to force learning sandbox/guardrail constraints. Success measured by activity (issues/PRs), not lines of code. Everyone pairs; every change buddy-reviewed. They deliberately target public repos to move fast.

Fuller numbers. Beyond 94/201/84: 29 commands, 125 scripts, 414+ reference files. Sales averages $8M revenue/rep vs a $2–4M consulting benchmark, using the same skills repos.

How to use it

All tooling is open source:

• trailofbits/skills — public skills repo
• trailofbits/skills-curated — curated third-party marketplace
• trailofbits/claude-code-config — recommended Claude Code configs
• trailofbits/claude-code-devcontainer — sandboxed dev container
• trailofbits/dropkit — macOS sandboxing for agents
• trailofbits/slither-mcp — MCP server for Slither

Sandboxing has three lanes (devcontainer, native macOS, Dropkit); hardened defaults pushed via MDM/Jamf including mandatory package cooldown policies.

Open problems, with the tools they're weighing

• Private inference: open models still trail closed ones on coding; evaluating on-prem servers for 230B+ models at full precision. Stated insight: speed drives adoption more than capability. Interim option named: Tinfoil.sh (confidential computing on NVIDIA GPUs).
• Prompt injection on client code: called "existential." Current blunt fix is no web access for sensitive clients; looking at kernel-level agent shells nono and agentsh.
• Policy enforcement: aspiration is a master MCP server enforcing policy server-side, plus pulling MDM signal back into a weekly feedback loop — "not there yet."

Caveat

The 200-bugs/week and 20%-AI-first figures are self-reported and scoped to "certain clients where the codebase and scope allow it" — not general throughput. The post is adapted from a conference talk and doubles as a recruiting pitch (AI Systems Engineer, Head of AppSec).