Research Engineer @ DepthFirst reducing cyber risk. Prev AI Safety Fellow @ Redwood catching misaligned models. Previously exited an AI startup.
Joined April 2022
- Tweets301
- Following526
- Followers170
- Likes216
We tested Gemini 4 Argon on @depthfirstlabs dfbench, our benchmark for finding real vulnerabilities in code.
On application and smart-contract tasks, where it rarely refused, it found 74% of known vulnerabilities, the highest recall we have measured. Across all 165 tasks it scored 67.5%, second only to Mythos 5 (69%{.
Low-level C/C++ was a weak spot. Most tasks hit a safety block or refusal, versus very few application or smart-contract related tasks.
On tasks with refusals, recall was much lower (40%).
GPT 6.1 Sol shows cost-efficiency improvements for vulnerability discovery in our benchmark, but didn't seem to increase absolute performance.
This, however, could be attributed to our harness since it didn't seem to report all of its vulnerability findings like GPT 5.6 Sol (I find that 5.6 Sol "tries much harder" to report everything).
We evaluated the defensive security capabilities of @OpenAI's GPT 6.1 Sol on @depthfirstlabs dfbench.
On our vulnerability detection tasks, it found about as many vulnerabilities as GPT 5.6 Sol, 56–63% recall against 51–65% across reasoning efforts, at a fraction of the cost: $1.37–$2.66 per task against $3.57–$12.15.
It also beat GPT 6 Sol at every effort level, finding more vulnerabilities for less money.
In the last two weeks, an OpenAI agent hacked Australia's Medicare portal, Gemini got into three companies' systems in a test, and hackers say they breached the FBI.
Attacks are getting cheap. Defense has to as well, so we built a vulnerability scanner using Jev.
Jev's context window is only 32k tokens, so we scaffolded our scanner to as small questions in three steps:
1. Which chunks are security critical?
2. Does this chunk have a vulnerability?
3. Where does untrusted input enter, where does it cause harm, and which check fails?
I'm most excited to use it as a cheap first pass: scan every package and every commit, then send the hits to a stronger model.
Thanks to @andreamichi and many others at @depthfirstlabs for getting this out there: depthfirst.com/research/buil…
Ram retweeted
Our researchers built a vulnerability scanner that costs two cents per scan and completes a scan in around two seconds.
The scanner is built with Jev, a classifier that outputs probabilities rather than generating tokens. On dfbench v1, our flagship model, it finds nearly as many real vulnerabilities as GPT-5.6 Luna, one of the most efficient models by cost per vulnerability.
This new harness breaks vulnerability discovery into parallel tasks, making it possible to scan every package, repository, or commit quickly and at low cost before escalating the hardest cases to other frontier models on the depthfirst platform.
Read more about how we built this in comments 👇
At depthfirst, we evaluated Opus 5.5 on our vulnerability detection eval.
From my investigation, it's more selective and doesn't search as hard as OpenAI models.
It is definitely an improvement on Opus-5, being more token efficient while having overall better performance!
Opus 5.5 is one of the few models we have seen gain recall and precision together as reasoning effort rises.
Of eight model families we ran at more than one effort setting on dfbench, six traded precision for recall. Opus 5 lost both. Opus 5.5 gained 6.8 points of recall and 4.3 points of precision.
As agents keep pushing out more and more code, the security of that code is super important!
It's important that we focus on security especially as autonomous hacking is getting cheaper.
Our co-founder and CEO @qasimmith sat down with @SaraIttelson at Accel, one of our earliest investors, to discuss the forces reshaping security:
Starting depthfirst.
Building secure software at speed.
Finding the TikTok vulnerability with our flagship model dfs-large1, a flaw that could have exposed millions of users’ private photos and allowed hackers to access their camera feeds and microphones without their knowledge, and recently covered by @washingtonpost.
Full interview in the link in comments.
I think it's important that we can measure how good models are at automating AI safety research because we want to predict when this will happen as this will make the future a lot safer.
I discuss a methodology of automating AI control research here:
open.substack.com/pub/dearfu…
Ram retweeted
New paper!
Think Fast: Estimating No-CoT Task-Completion Time Horizons of Frontier AI Models
@METR_Evals showed that models' time horizons have doubled every few months. We ask: what length of tasks can models complete without any CoT?
Ram retweeted
Redwood Research presents LinuxArena
- 20 live production environments for AI agents
- Frontier models achieve ~23% undetected sabotage vs. trusted monitors
- Useful work ≈ attack surface → sandboxing fails, monitoring is essential
We've been working on a testbed for monitors.
I think this is probably the best place to make AI monitors to detect if your agent is malicious
