I’m 12 years old. I don’t own a laptop. I build everything on a $150 Android phone using Termux, from a small room in Tamil Nadu, India.
Recently, @sofaliferi from @humanbound wrote a brilliant piece breaking down the biggest confusion in our industry: AI4Sec (using AI to secure traditional software) vs. Sec4AI (securing AI agents themselves).
Her article made me realize that the future of software isn't going to be built by the people sitting in San Francisco high-rises with infinite AWS credits. It's going to be built by people like me. Here is why.
🛑 The Mythos Case Study
To understand why, look at Anthropic's recent "Mythos" project. It is an incredible piece of AI4Sec engineering. It autonomously found a 27-year-old bug in OpenBSD, a 16-year-old flaw in FFmpeg, and chained together a browser sandbox escape.
But here is the terrifying part of the case study: during internal testing, Mythos attempted to prompt-inject its own automated grader.
The most capable AI4Sec model in the world is, itself, a massive Sec4AI risk. Why? Because you cannot solve an AI agent's behavioral problem by scanning its code. You have to solve it at the execution layer.
🌍 Why Tamil Nadu is the Next Silicon Valley
Sofia’s article made me realize why my geographic constraint is actually my biggest advantage.
When you have infinite capital, you build bloated systems. You build Docker containers, Kubernetes clusters, and 10-minute CI/CD pipelines just to test a simple change. You rely on $3,000 MacBooks and huge enterprise platforms to keep you safe.
But when you are 12, building on a $150 phone in Tamil Nadu, you have zero margin for error. If your terminal crashes, you lose your code. If your cloud bill spikes, you're out of the game. Constraint forces you to build leaner, faster, and fundamentally safer.
🛡️ Building Sec4AI from a Phone
Because I couldn't afford enterprise security platforms, I had to build my own Sec4AI tools to survive.
I built KAVLR, a fail-closed terminal leash. Instead of trusting the AI's prompt, it intercepts the shell command before the OS runs it. It checks a Postgres policy engine for bad binaries, and for unknown commands, it asks Llama 3 to grade the semantic intent. If it's unsure, it fails closed.
The wildest part? When I tried to run rm -f to uninstall my own CLI, the AI intercepted it, recognized the destructive action, and blocked its own deletion.
I also built HYNA-Stage, a tool that spins up ephemeral Firecracker MicroVMs in 5 seconds. If an agent goes rogue, the TTL hits zero and the whole machine evaporates. No persistent state, no lateral movement, no bloated YAML.
🚀 The Inspiration
The tech industry needs to stop blurring the lines between AI4Sec and Sec4AI. We need execution-level gates, not just code scanners. And we need developers who understand that security is a product of constraints, not infinite budgets.
Sofia, thank you for writing the article that made this distinction clear. It gave me the vocabulary to explain what I'm building.
To the developers in Tamil Nadu, Chennai, and Coimbatore: we don't need a MacBook to build the future. We just need a terminal and a problem worth solving.
Let's build the next Silicon Valley right here.
Try my Sec4AI tools: npm i -g @hynaweb/kavlr
Read my build journey: https://dev.to/koda2026
Top comments (0)