About Optimus Labs
Software is becoming agentic: Code, context, tools, permissions, and identities now combine into systems that reason, decide, and act.
EDR and AppSec tools read agent asset activity as normal user behavior. Optimus Labs was built to watch that new attack surface.
We are a team with deep experience across AI, cybersecurity, and developer tooling, building the security layer for AI agent assets across endpoints, cloud, and wherever agents run.
Artificial intelligence / Cybersecurity / Developer tooling
The founding team
The Optimus Labs' transformers
Nipun Gupta
Founder & CEO
Previously Founding Head of Product at Mindgard and COO at Bearer (acquired by Cycode). Earlier at Deutsche Bank, Deloitte, and NCC Group. Leads the AI Security Engineers community in Toronto.
LinkedIn
Michael Scotto
Founding Lead Engineer
Full-stack engineer balancing speed and innovation weaving rust, python, javascript, and django together for customers to secure their AI agent assets.
LinkedIn
Rahul Shelke
Founding Tech Lead
Leading engineering management with backend engineering focus on resilient software architecture, connectivity, and developer tooling.
LinkedInTechnical proof
Proof over promises
Before Optimus Labs was a product, it was research. We investigate real attacks on AI agent assets and publish the evidence.
September 25, 2026
One Local Setting Turned Meta's Muse Into a Mac Backdoor
A user-writable dictation endpoint let code running as the logged-in Mac user redirect Muse's audio, transcript, and session token, then steer the agent through permissions already granted to it.
September 14, 2026
AI Agents Flooded RubyGems to Get Code Execution on Its Docs Builder
The target was the registry's build service, not the people who use it. Publishing a gem triggered code execution on RubyDoc.info without anyone running gem install.
September 1, 2026
When the Supply-Chain Attack Has No CVE: Inside the Coder Registry Hijack
Coder's own delivery infrastructure was hijacked to serve credential-stealing modules from the real registry.coder.com. No CVE, no poisoned package, nothing for a scanner to match.
Released with the advisory, 2026-07-16
GrokPatrol
Open-source scanner for the grok-build repository exfiltration we documented.
Released with the advisory, 2026-09-01
LeakPatrol
Open-source scanner for secrets and context leakage across agent workflows.
Contribution, 2026 edition
Top 10 for LLM Applications
Nipun Gupta contributed to the 2026 edition of the industry standard for LLM risks.
Backed by World-Class Security & Engineering Leaders
Angel investors
Stephen Magill
Security Scientist, AWS
Guillaume Ross
Startup CISO
Jean Yang
Senior Staff Software Engineer, Meta
Terry O'Daniel
Ex-CISO, Amplitude
Jonathan Langer
Co-founder & CEO, Act Security
Salima Kaissi
Ex-Director, Okta Ventures
Jonathan Cran
Founder & CEO, Mallory
Pathik Patel
Security Lead, Salesforce-Informatica
Dennis Xu
Co-founder & CEO, Adaptive
Advisors
Ecosystem
