Joshua Mo

Josh Mo is a Rust software engineer and lead developer relations engineer at Venice AI, previously the project lead for the Rust AI framework Rig. His work spans the interfaces that make AI applications possible: connecting Rust libraries to TypeScript, exposing an agent’s file and shell operations, and keeping credentials out of a model’s reasoning context.

From Rust education to Rig

Josh worked in developer relations at Shuttle from February 2023 to February 2025. His 2024 guide to Rust and WebAssembly taught interoperability through an image-conversion module callable from a JavaScript server. It compared deployment approaches and their limits, including the distinction between portable WebAssembly and Node-specific native extensions. His career history also includes volunteer coaching with codebar, helping people from underrepresented groups learn programming.

From January 2025 to April 2026, Josh led Rig at Playgrounds Analytics. Rig is a collaborative framework that supplies Rust developers with model-provider integrations, tools, embeddings, and vector stores for language-model applications.

One substantial part of Josh’s work was bringing Rig to JavaScript through rig-wasm, reusing its Rust core rather than rewriting it in TypeScript. His account of the port explains why successful compilation was only part of the job: JavaScript developers also needed usable bindings, wrappers, and interfaces for supplying their own tools and vector stores. He proposed generating provider bindings with a build script to reduce repetition, while acknowledging that the resulting template code was brittle. Handwritten TypeScript addressed interface differences that WebAssembly alone could not resolve.

Making agent behavior explicit

Josh’s tutorials explain the software surrounding a model through working implementations:

• Routing before generation: His semantic router using Qdrant and Rig compares an incoming question’s embedding with example utterances grouped by topic. Similarity search gives the application a decision layer before it asks a language model to respond. This is topic routing; similarity alone does not establish protection against prompt injection.
• Exposing a coding agent’s moving parts: His minimal Rust coding-agent tutorial combines conversation history, file access, shell execution, and streamed responses. It also implements user interruption of shell commands. The educational example makes concrete how a model’s requested action becomes an operation on a filesystem, and where the user can intervene.

At Venice, Josh joined Sabrina Aquino in building open-source integrations, internal LLM-assisted tools, and improvements to developer experience, as he described in his announcement of the move.

Keeping secrets outside the reasoning layer

Josh’s “How Secrets Leak Through AI Agents (and How to Stop It)” develops a specific position on private AI: a private model does not make the surrounding application private. Logs can retain prompts and secrets, while a vault integration can introduce another leak by returning credentials directly to the model. Once a secret enters the reasoning context, an agent’s tool call can carry it elsewhere.

His proposed separation is concrete: connect the vault to the execution layer, allowing software to use credentials without showing them to the LLM. Revocable handles offer a way to grant access that can later be withdrawn. Narrow agent scope and screening for prompt injection provide additional safeguards, while sandboxes still require permission monitoring.

Josh also describes Venice’s privacy approach, including not storing prompts, anonymizing requests to closed providers, running models in trusted execution environments, and using split-key encrypted storage. His argument for retaining less data is about limiting the damage a breach can cause. He closes with confidential tool calls as an open problem, preserving the distinction between protecting model execution and protecting everything an agent reaches beyond it.