Cofounder & CEO @FoundationHQ. Building Human Authority Hardware for Bitcoin and agentic computing. Mechanical engineer, MBA dropout. Also tweets about health.

Boston, MA
So much has to be rebuilt: humans will become the authority over the computer; agents will become the operators of the computer. When we cede control of our computers to agents, we need a separate place to hold + enforce our human authority.
Email is not going to work for auth any longer
1
1
15
865
Zach Herbert 🇺🇸 retweeted
Years ago I said @Rob1Ham & @BeccaAmilee's @AnchorWatch could become quite powerful Seeing AI billionaire investor in @Wild_Arms_RandD, what @zherbert is thinking, what @BastogneActual is building, seeing @RatioDrones, and emerging sovereignty/security theme for nations & corps-
Government will be mostly (if not all) insurance companies within a century, and possibly much sooner Enforcement of contracts is in effect insurance against breach of contract Few Curious: is there is any government service that cannot be constructed as an insurance offering?
1
6
582
Zach Herbert 🇺🇸 retweeted
When I was young, I used to think that no matter what happened to me, I could go to a hospital and everything would be okay. Understanding what a hospital really is, as you get older, is like going back to the state fair at 30. As a kid, the excitement is in conquering the fear of the ride. But “the ride” is an abstract. You’re bracing for an experience that you ultimately trust. As you get older, the ride becomes very concrete. The beams jostle. Paint bubbles over the rust. The carnie running the Zipper took an extra Klonopin and just wants to get home to his polycule. And you begin to understand how little there is between you and the ground. If you’re not careful as you age, your life is increasingly in the hands of people of impossible shapes who don’t look like you, don’t think like you, who will treat your fate with less interest than the vampire rapemance audiobook they put on during lunch. You have to laugh so you don’t cry. You have to build a body that keeps you far away from such places. When you’re forced in, speak clearly, or have someone speak for you, and do not look away while they work.
- 19yo with disorder that makes him prone to blood clots - ⁠calls an ambulance with symptoms typical of a blood clot in the lungs - ⁠blood test to rule out blood clot not performed - ⁠discharged with antibiotics - ⁠reattended A&E later same day coughing up blood (red flag for blood clot). Discharged again. - ⁠saw GP a week later who sent to A&E as had obvious symptoms of blood clot - ⁠discharged with no investigation for blood clots from A&E again as doctor “forgot” to refer to be admitted for tests - ⁠attended later same day as symptoms worsening. WAS actually admitted but communication so poor and kept in waiting room on a chair after “admission” that he didn’t realise he’d been admitted and went home to sleep. - ⁠died next day at home His life would have been saved with a simple blood test at any of the FIVE separate encounters with medical professionals.
56
274
3,366
114,996
Email is not going to work for auth any longer
Man, I am not sure how I feel about this one!
16
8
76
5,559
It will be like this for years. This is what happens when you have tens of millions of lines of code.
"Several vulnerabilities" in the Linux kernel lwn.net/Articles/1097401/
1
19
4,913
Zach Herbert 🇺🇸 retweeted
It feels like xmas already beautiful device guys! @FoundationHQ
4
3
18
898
Smash bought. If they are good might buy 2 or 3 more.
These are going to do well imho.
2
7
1,460
Astra is barely usable for me right now. Doesn't follow instructions, half-asses everything, makes really bad assumptions. Something happened in the last several days.
echoing that something feels off in the recent oai gpt-6-sol release incl astra feeling dumber, giving up too easy, and super hard to read
4
8
1,241
Foundation was using Gusto and Deel, really did not like the experience, @warpdotco has been awesome.
We’ve raised $85M for this moment. Introducing Warp 2.0: The first AI Head of HR. Every company is building AI to replace jobs. Warp is building AI to do the jobs no human should have to: If you work in HR, I want you to spend time with the manager who needs help or building company culture people actually want to work at. If you’re a founder, I want you to focus on signing clients or spending time with your family. You shouldn’t have to figure out how to register state tax in California. You shouldn’t have to pay outrageous penalties because you don't know what a DE 9C is. I want to make HR human again. Today, this is finally possible with the Warp Agent. I’d love for you to see it in action: warp.co/agent
4
1
16
1,863
Zach Herbert 🇺🇸 retweeted
Your login codes shouldn't have to live on your phone. Passport Prime keeps your 2FA codes offline, on dedicated hardware you control. With KeyOS 1.4.0, there are more ways to bring your existing accounts across, including bulk imports from Google, Aegis and Proton Authenticator. Import your accounts, then generate the codes you need directly on Passport Prime, without an internet connection. Your email, work accounts and digital identity deserve protection, too.
1
5
22
1,786
This is why smartphones and computers can never serve as a root of trust for AI security & human authority. Tens of millions of lines of code. No formal verification. Each time a frontier model is released, it will be whack-a-mole to fix newfound vulnerabilities.
Urgent security advisory for iOS users! Install the latest iOS update immediately. Security researchers report that financially motivated attackers are now using a complete, in-the-wild exploit chain that can quietly steal cryptocurrency private keys and mnemonic seed phrases from iPhones. The reported attack begins when a target is socially engineered into opening a malicious page in Safari. That page is said to abuse a memory-corruption flaw in WebKit / JavaScriptCore to gain arbitrary read/write access from JavaScript, then bypass Pointer Authentication Codes (PAC) to run native code, break out of the WebContent sandbox, and escalate to kernel/root privileges. With that access, attackers can pull data from the device Keychain and from local crypto wallet apps. The claimed impact range is iOS 13 through iOS 26.5; that range has not been independently confirmed in full. Until more is known, treat any unpatched device as potentially exposed and update as soon as a newer build is available. Also avoid untrusted links in Safari, especially if you keep wallet keys or seed phrases on the phone.
4
3
28
3,806
Zach Herbert 🇺🇸 retweeted
Verify v1.0 is now available for Passport Prime. Check SHA-256/SHA-512 hashes and OpenPGP release signatures fully offline before using a download. Open source and ready to install on any Passport Prime running KeyOS v1.4 WHAT WILL YOU BUILD? foundation.xyz/app-showcase/…
2
11
55
1,982
Zach Herbert 🇺🇸 retweeted
Envoy v2.3.4 is now available for download. This maintenance release includes bug fixes and reliability improvements for Tor, Magic Backup and Passport Prime updates. Full release notes below👇
3
4
27
2,057
Zach Herbert 🇺🇸 retweeted
It's time for a new foundation. Not a new start. Legacy Mode is live on Passport, keep every account you already have, on code anyone can inspect. Switch to open source hardware and software while keeping your existing accounts for supported assets. Here’s how. 🧵
13
18
99
22,783
Ledger users: it's time to switch to open source. Introducing Legacy Mode by @FoundationHQ
8
8
61
8,891
If anyone guesses what we are announcing tomorrow I will send you a complimentary Passport Prime by @FoundationHQ!
Switch to open source. It's time for a new foundation. 09.15 | 10AM ET foundation.xyz/switch
59
5
60
10,579
It pains me to see a large percent of all Bitcoin & digital assets stored on closed source hardware. Tomorrow we are making it easier than ever to switch to open source.
Switch to open source. It's time for a new foundation. 09.15 | 10AM ET foundation.xyz/switch
4
5
85
6,142
Zach Herbert 🇺🇸 retweeted
New hardware for the PocketJS lab: a beautifully compact Passport Prime, kindly sponsored by @FoundationHQ. Thanks @OwenKemeys for making it happen! We love bringing PocketJS to new kinds of hardware. Hardware makers, feel free to reach out 😛
4
9
162
10,145
Zach Herbert 🇺🇸 retweeted
I'm really digging my new Passport Prime from @FoundationHQ .
4
3
22
4,997
Zach Herbert 🇺🇸 retweeted
I'm disgusted by many of the replies. People saying "code is law, so it's fair game to steal 600 bitcoin" are amoral weirdos. If their home had a lock w/ buggy firmware that allowed thieves to loot it, then the thieves returned some of their possessions after they begged, but kept a lot of their property, I bet your ass these goofballs wouldn't be like "Hurr derr, code is law, so it's my fault thugs used a code bug to get into my house and steal my stuff. They aren't criminals, they're 'whitehats' I must respect and thank for returning some of my things after I begged them". Get the f*ck out of here, you spineless, morally bankrupt goofballs. Thieves deserve to be hunted, beaten, and made an example of, not lauded as noble actors.
To those responsible for the theft of bitcoin from the Liquid Network: Blockstream will not pay a ransom for the return of stolen funds. Taking assets without authorization and withholding their return is a crime, not responsible disclosure. It is not white-hat activity. It is theft. We have engaged in good faith in an effort to secure the return of stolen user funds and protect the broader Bitcoin community. That effort should not be mistaken for acceptance of the actions taken nor of the terms being demanded. We will not be a party to the precedent that open-source software developed for the good of the Bitcoin community should subject its developers to paying a ransom that far exceeds their economic participation. Bitcoin is hard money and can’t be minted without costs, Bitcoin doesn’t haircut users to pay a ransom. To the Bitcoin community: We are fighting for what we believe in, for the users whose funds were taken, and for the principles on which Bitcoin was built. The community has demonstrated incredible resolve with teams of people dedicating their time in support of each other to identify and patch vulnerabilities in each other's products and systems. We are all driven by the mission that Bitcoin is the single best asset, for every person, company, and institution on the planet to invest, use, and build on. The world is a different place with the advancements of AI, and the Bitcoin community has responded with force to combat that threat. Damage has been done, battles have been lost, but on the whole the Bitcoin community is gaining ground in the war with bad actors. We want to thank the community for those efforts, for your support in hardening the network, helping users recover funds, and for your support in our assertion that crime does not deserve rewards. To those holding the stolen bitcoin: There is still an opportunity to resolve this responsibly. The bitcoin can be returned and we can revert to the standard of white-hat principals. However, if the funds are not returned, we will pursue every lawful avenue available to us. We will work with law enforcement, exchanges, service providers, forensic specialists, and other relevant parties to trace and recover the assets and identify those responsible. More importantly, Bitcoin is transparent by design and the community is made up of the most sophisticated engineers, cryptographers, and white-hat hackers globally. Transactions do not disappear, and neither does the evidence they leave behind. We will not pay for the return of stolen property. We will not abandon our users. The Bitcoin community will not stop pursuing the funds. Return the bitcoin.
64
8
120
13,520