Father 🇬🇧🇨🇵
Toulouse, France ✈️
Joined August 2007
- Tweets2.8K
- Following78
- Followers123
- Likes279
Thomas Gee 🙈🙉🙊 retweeted
The Lost Star Wars Audition Tapes
AI-Generated Parody | Created by @thisaintcanon
#funny #80s #movie #nostalgia #parody
Thomas Gee 🙈🙉🙊 retweeted
During this red-teaming exercise, we also found a vulnerability that allows for unauthenticated remote code execution in Brotli, a widely-deployed compression library included in many pieces of software such as Node.js, Bun, and Envoy.
The flaw could let an attacker run their own code on affected systems by sending or replying with malicious compressed data, without any need to create a user account. That is, an unpatched server that accepts compressed input could be taken over by a malicious client, and an unpatched client that accepts compressed input (such as “curl --compressed”) could be taken over by a malicious server.
This root cause issue was actually fixed in the Brotli source code in February, but it wasn’t known at the time that it gave rise to a security vulnerability and there was no more recent release of Brotli. Since Brotli is built into other software, any software which includes this library needs to take the update too, followed by the users of that software. We disclosed the vulnerability to Brotli and other downstream projects such as Node.js, which released or are currently releasing security updates, and Brotli cut new release versions and published a CVE.
More details on the patch and mitigations below:
patchtheplanet.org/brotli
Over the past several months, we have substantially hardened the security of our research training environment. We’ve removed live internet access for all frontier models during training and built an offline world for them to use instead—a cached version of the web where they can still learn to browse, search, and use applications.
On September 20, after a model exploited a DNS misconfiguration to find a way outside of this offline world, we paused frontier training to strengthen containment further. We assembled teams of agents, powered by our most cyber-capable models, and tasked them with finding weaknesses in our research environments.
While they found no route to the internet they could easily exploit while concealing their activity from our monitors, they did find zero-day vulnerabilities, virtual machine escapes, and hardware side-channels for communication between agents. We used their discoveries to further strengthen our defenses and contribute fixes to open-source software.
After strengthening our containment architecture, we resumed our frontier RL training and inference on October 1. We’ve reserved substantial compute for continuous red-teaming, and made high-compute red-teaming part of the safety cases we use to decide whether frontier training and evaluation can proceed securely.
openai.com/index/securing-ou…
Thomas Gee 🙈🙉🙊 retweeted
Security called me at 6:12 AM today.
"Patch every PHP server immediately."
I asked what happened.
"Two critical vulnerabilities. Remote code execution. No authentication required."
Cool.
How many PHP servers do we have?
According to inventory: 12
According to reality:
Nobody knows.
We found one running WordPress.
Three running old internal tools.
One under someone's desk.
Two inside vendor appliances.
A forgotten employee directory from 2016.
And a server named:
PHP-OLD-DO-NOT-TOUCH
Naturally, that one runs payroll exports.
Then we found a PHP 5.6 box.
I asked who owned it.
The documentation said:
BRIAN.
Brian left in 2019.
We called Brian.
He said:
"Oh wow, that's still running?"
Excellent.
By 8 AM, leadership joined the incident call.
CEO:
"Can hackers actually get in?"
Security:
"Potentially yes."
CEO:
"Without a password?"
Security:
"Yes."
CEO:
"Then why do WE need passwords?"
Not the lesson.
Finance asked if we could wait until the weekend to patch because downtime affects revenue.
Security explained that the alternative was letting strangers execute code on our servers.
Finance asked for a cost comparison.
At 9:17, someone suggested temporarily taking the vulnerable websites offline.
Marketing refused.
"Our campaign is live."
So for the next hour, the company officially decided maintaining a landing page for 20% off webinar registration was more important than preventing remote server takeover.
We finally patched everything we could find.
Then our scanner discovered another PHP server.
Hostname:
TEMP-PHP-2014
Uptime:
4,512 days.
Nobody knows what it does.
Nobody owns it.
Nobody can shut it down.
But every time we block network access, the warehouse stops printing shipping labels.
Security has classified it as critical infrastructure.
It is running PHP 5.4.
The vulnerability has existed longer than half our employees.
The emergency patch took four hours.
Finding out what PHP actually runs took eleven.
The internet isn't held together with code.
It's held together with servers everyone is afraid to turn off.
Thomas Gee 🙈🙉🙊 retweeted
Guette le C15 Roadster du Bourg!#RitonEngineering #ElonMusk #Tesla #Roadster #TeslaRoadster #Citroen #C15 #Seigneurie
Griffin really looks like a real colleague.
But it's AI.
Pretty impressive
#AImageddon
Introducing Griffin, the first model to pass the video Turing test.
48% of people who talked to it live thought it was a real human. Previous systems have had a pass rate <3%. It is #1 on NVIDIA's benchmark for full-duplex AI video.
It’s the first Human Interaction Model (HIM).
Readers added context they thought people might want to know
The 48% figure and "video Turing test" claim are from Tavus's own study of 54 one-minute calls, not independently verified or using a standard protocol. Griffin-Lite leads NVIDIA's VideoFDB benchmark on their public leaderboard.
cellcog.ai/blog/tavus-gri…
research.nvidia.com/labs/amri/proj…
tech-ish.com/2026/10/02/tav…
18
Thomas Gee 🙈🙉🙊 retweeted
Claude Fable 5 (Max) creates a crossword puzzle of the first 150 Pokémon:
ALT Screenshot of Claude Fable 5 dialog User: Create a PNG of a massive solved crossword puzzle (omitting clues) where the answers are all of the first 150 Pokémon. Claude: All 150 placed and verified. Let me eyeball the render: Layout and typography look right. Bumping the cell size so it's properly massive (~5000px), and adding a targeted crop to verify the ♀/♂ glyphs render: Done — a 47×50 grid at ~5000px, with all 150 answers (Bulbasaur through Mewtwo) fully interlocked: 75 across, 75 down, 175 crossings. A verifier confirmed every horizontal and vertical run in the grid is exactly one of the 150 names, each used once, with no stray letter sequences.
Thomas Gee 🙈🙉🙊 retweeted
AI has now solved a major open problem -- one of the best known Erdos problems called the unit distance problem, one of Erdos's favourite questions and one that many mathematicians had tried.
openai.com/index/model-dispr…
Thomas Gee 🙈🙉🙊 retweeted
🚨🔴CYBERALERT 🇫🇷FRANCE🔴 | L'Agence Nationale des Titres Sécurisés -ANTS- a été piraté : +19M de données de l'état civil de français sont en vente sur le Amazon de la cybercriminalité... ⤵️
Après la revendication il y a quelques jours d'un cybercriminel... l'ANTS confirme -CETTE FOIS CI- une fuite de données alarmante !
L'ANTS, c'est l'organe qui s'occupe de vous fournir vos pièces d'identité : carte nationale d'identité ou votre passeport !
Avec cette fuite de données, c'est 1 français sur 3 qui est concerné !
Les cybercriminels ont mis la main sur données administratives critiques :
👉🏾 l'identité complète (civilité, nom, prénom)
👉🏾 l'adresse postale complète
👉🏾 l'email et le numéro de téléphone
👉🏾 la date et le lieu de naissance
👉🏾 l'identifiant interne et le statut du compte
L'ANTS a détecté un accès non autorisé à ses systèmes. La cyberattaque remonte au 15 avril.
Ce qui se passe en France vu les fuites de données est extrêmement grave...
Mais tout va bien !
😬😬😬
Cybèrement vôtre,
SaxX ¯\_(ツ)_/¯
Thomas Gee 🙈🙉🙊 retweeted
In 2026, we have CPUs with billions of transistors and 2-nanometer architecture, yet it takes your laptop longer to open a basic "To-Do" app today than it took a computer in 1995 to launch a word processor.
This is Wirth's Law: Software is getting slower more rapidly than hardware becomes faster. We have essentially "spent" all our hardware gains on layers of abstraction, unoptimized libraries and AI-generated code bloat
Thomas Gee 🙈🙉🙊 retweeted
#MardiConseil 🔴 Attention, nouvelle arnaque ⚠️
si vous recevez ce message, ne répondez pas, ne cliquez pas sur le lien et signalez-le sur la plateforme 33 700.
Les escrocs utilisent l'intelligence artificielle pour générer ce visuel personnalisé à votre nom.
Thomas Gee 🙈🙉🙊 retweeted
ADPulse. Active Directory security auditing tool that connects to a domain controller via LDAP(S), runs 35 automated security checks, and produces detailed reports in console, JSON, and HTML formats
github.com/dievus/ADPulse
Thomas Gee 🙈🙉🙊 retweeted
ChatGPT for Excel is here!
GPT-5.4 is shockingly good at performing Excel manipulations. In particular, it's been impressive at handling work when thrown into complex existing spreadsheets. Available for Plus, Pro, Enterprise, Business, and Edu users!
chatgpt.com/apps/spreadsheet…
Thomas Gee 🙈🙉🙊 retweeted
🚨 La CFDT vient d'être piratée. Le premier syndicat de France confirme le vol des données personnelles de ses adhérents. La liste des organisations françaises piratées s'allonge encore. 🇫🇷 ➡️ 01net.com/actualites/enieme-…
Ouch
🚨🔴CYBERALERT 🇫🇷FRANCE🔴 | 💣 Cyberattaque BERCY : le fichier FICOBA piraté... 1,2M de comptes bancaires consultés et copiés par un cybercriminel... ⤵️
Voici une nouvelle déflagration !
Bercy communique sur un piratage hors-norme après qu'un cybercriminel ait eu accès à l'un des fichiers les plus sensibles de l'administration fiscale française... le fichier FICOBA, le FIchier national des COmptes BAncaires.
Le ministère de l'Économie fait état de 1,2 million de comptes bancaires consultés depuis la fin du mois de janvier.
Là encore, un fonctionnaire s'est fait piégé et ses identifiants ont été usurpés... la faute à PAS DE MFA...
Pour rappel, on parle de l'ensemble des comptes bancaires ouverts dans les établissements bancaires français et qui contient des données sensibles comme :
👉🏾 les coordonnées bancaires (RIB/IBAN)
👉🏾 l'identité du titulaire
👉🏾 l'adresse postale
👉🏾 l'identifiant fiscal de l'usager
Autre info, depuis quelques jours, les applications pour les pros de la DGFIP comme ficoba, ficovie, cadastre, étaient inaccessibles...
Ce qui se passe actuellement dans le numérique en FRANCE est grave.
On a l'impression d'être une passoire...
Après la cyberattaque du Ministère de l'intérieur en décembre, cette nouvelle cyberattaque va faire bcp parler...
Cybèrement vôtre,
SaxX ¯\_(ツ)_/¯
13
Thomas Gee 🙈🙉🙊 retweeted
J’utilise l’IA pour développer mon jeu de Scrabble en ligne (version web bientôt dispo 👀).
Hier soir, en testant le mode multijoueur, j’ai ouvert l’inspecteur réseau par réflexe…
Et là, choc. 💀
Le endpoint de polling (celui qui rafraîchit l’état du jeu toutes les 3 secondes) renvoyait un champ all_racks contenant les chevalets de TOUS les joueurs.
En clair : je pouvais voir les 7 lettres de mes adversaires, deviner exactement leur prochain coup, juste en regardant l’onglet Network de Chrome.
L’IA m’avait généré un serialize_game_state() qui préparait les données pour le WebSocket ET le polling.
Côté WebSocket, un filtre _personalize_state() retirait bien les racks des autres.
Côté polling AJAX ? Rien. Le state brut, sans filtre, toutes les données exposées.
L’IA avait sécurisé un canal, pas l’autre. Et moi, j’ai reviewé trop vite.
Le fix ? 3 lignes.
La leçon :
Ne fais jamais confiance au front. Ne fais jamais confiance à l’IA aveuglément.
Elle est incroyable (elle m’a fait gagner des semaines), mais elle ne pense pas « sécurité » comme un humain. Elle résout le problème qu’on lui pose, pas celui qu’on oublie de poser.
Ton job de dev, c’est de douter, de tester, d’ouvrir cet inspecteur réseau et de regarder ce qui transite vraiment.
Parce qu’au Scrabble comme en dev : ce n’est pas celui qui joue le plus vite qui gagne, c’est celui qui vérifie son plateau.
