THESE 👏 TWEETS 👏 ARE 👏 FICTION👏 This account tweets fictional or headline inspired breach scenarios. To play: Share opinions on prevention or response steps.

Joined February 2017
All of the below tweets are fictional conversation starters meant to kick off security tabletop conversations. #DontPanic
6
12
9
104
A combination of bugs has caused llm responses in your application to be delivered incorrectly across tenants. Users report seeing unrelated responses to their prompts from other customers.
1
2
11
808
Someone has mistaken an "exploit scan" with "in-the-wild exploit". They went and broke embargo on a high profile vulnerability disclosure. That person works for you.
3
47
2,531
Someone bought a really badass domain name and made a sweet landing page for a vibevuln in your product. No one actually knows if the bug is exploitable or impactful yet but it has gone viral anyways, enjoy your weekend
14
2
136
5,894
While responding with an emergency patch to a sudden RCE announcement, you are alerted to a second and third RCE in unrelated platforms you have to patch too.
2
9
1
57
2,151
Developer tooling your engineering organization depends on has suffered an upstream compromise.
1
7
779
Your production neocloud is breached and mid-migration you learn the neocloud you are moving to is breached too.
1
1
12
968
One of your production certificate keys is just the number 4.
2
18
133
3,405
An attack on your neocloud provider has exposed environment variables on the tenant systems you host there.
3
791
An RCE is being exploited in the wild on the same production, internet facing web stack you have.
1
2
1
15
1,135
You found a weird doohickey in your office, used an agent to figure out what the doohickey does, and it turns out that doohickey is a listening device planted by an employee xitter.cf/OpenAINewsroom/status/…
We discovered a sophisticated recording device that was hidden inside one of our offices. We used our models to understand the device and where it had come from, identifying that a specific employee had planted it a few days earlier. We referred the matter to the FBI, and we’re grateful to the agents and prosecutors who moved quickly to make an arrest. The FBI’s investigation is ongoing and we will continue to support their work. At this time, we have no indications of this individual inappropriately accessing or exfiltrating model weights, source code, or customer data. The employee was terminated. We take protecting our technology, data, and people seriously, and as a matter of national importance. Our security program is designed to protect against a wide range of threat actors, from insider risks to cybercriminals to nation states, and this case is an example of how AI can help address these sophisticated security threats.
2
4
41
2,053
An anonymous account published the answer to RSA-470 yesterday, RSA-480 today, and will publish RSA-490 tomorrow.
13
1,385
A “search warrant” requesting user content was actually delivered from a lookalike law enforcement domain. Your legal org complied.
1
15
1,167
An obscure feature in your product has suddenly been chosen by an AI swarm for their out of band communication.
2
19
973
An attacker has escaped your virtualized "Sandboxes" where user supplied code is supposed to be executed safely.
1
9
1,092
Multiple employees have alerted HR that their last direct deposit has gone to an unfamiliar account
1
12
1,006
You’ve learned a research talk at BH/DC will drop 0day on your product, and you have a short amount of time to prepare.
1
7
1,057
JavaScript artifacts that deliver your product to customer installed snippets have been compromised. Now your product is swapping out cryptocurrency addresses when viewed directly on your customer install base.
1
2
1,459
Your cryptographic keys minted in an offline, airgapped ceremony were backed by weak RNG.
4
25
1,921
You have hit your company wide token usage limits while responding to an intrusion.
3
15
1,467