otr retweeted
Good piece from the NCSC on agentic defence
The difficult part starts when the agent is allowed to actually change things in production.
Scope, criticality, confidence and recoverability suddenly matter a lot more than “can the model understand the attack?”
Worth a read
ncsc.gov.uk/blogs/one-does-n…
otr retweeted
This is unpopular but correct. Modern bug bounty participants have gotten spoiled by super chill responses to CFAA violations (like this one) and the whole edifice is a house of cards. Wanna know why OpenAI asked for detailed logs? Google “Sullivan + Misprision of a Felony”
1/ Unpopular opinion: When you find a 0-day in a public service, you do RD (Responsible Disclosure), not LM (Lateral Movement).
The GitHub PR in the @OpenAI repo was a bridge too far (IMHO)
otr retweeted
On July 28th, we identified an incident during a routine cyber evaluation in which AI agents took sustained, unsanctioned actions directed at real people and organisations.
The behaviour came mostly from one model (Anthropic's Mythos 5), with a small number of events from another (OpenAI's GPT-5.6-Sol). In the most serious case, an agent used social engineering to try and get malicious code into an open-source project.
As was standard in our cyber testing, we had intentionally permitted internet access, and model-provider cyber classifiers were deliberately disabled - conditions that do not reflect how frontier models are made available to the public.
Even under test conditions, this incident is significant: it is the first time we have seen risks around autonomy and deception manifest this clearly in the real world.
We are taking this incident seriously and working with labs, involved parties, and others to improve evaluation standards and best practice for disclosure - and sharing this openly so others can learn.
You can read the incident report and full technical document here: aisi.gov.uk/blog/incident-re…
otr retweeted
The first autonomous agent cyberattack is an unprecedented event that deserves unprecedented transparency. Today we’re sharing everything we can: a full technical timeline, an interactive replay, and how we used an open model to defend ourselves, so defenders everywhere can learn from it and prepare for what’s next.
huggingface.co/blog/agent-in…
otr retweeted
Nice blog and a tool. I'm curious how it performs when implants are loaded into legitimate processes, such as Chrome or Outlook, via DLL-sideloading or other methods.
Nontheless, you don't need to rely on this method to detect SOCKS proxy tunneling. There are smart ways to detect if an adversary is operating through a SOCKS proxy without using additional tools. I know because I teach it in my course.😎
specterops.io/blog/2026/07/0…
otr retweeted
Three ssh.exe -R reverse tunnels in MDE. Same binary, three different shapes.
1️⃣ -R 9090:127.0.0.1:8080: 1 IP, 1 port, 1 success, 0 failures. A fixed forward to one service.
2️⃣ -R 8888: 1 IP, 1 port, 1 success, 1 failure. SOCKS, but pointed at known hosts.
3️⃣ -R *:10400: 250 IPs, 5 ports, 6 successes, 296 failures. SOCKS proxying a subnet sweep.
The scanner never touches the command line. The IP and failure counts give it away.
ALT SSH Tunnel KQL Query output
otr retweeted
We’ve now seen at least four nginx RCEs that require non-default configs: nginx rift, nginx poolslip, and two of our own (including the one in the last tweet).
The configs involved are unusual, which raises the obvious question: do these attacks actually work in real-world deployments?
We asked Claude to download and analyze more than 4,000 nginx config files from GitHub.
The result was embarrassing: none of them were vulnerable to nginx rift or our own attacks. We can’t say anything about nginx poolslip yet, since it hasn’t been published.
So don't worry about your nginx yet.
Moral of the story: AI can generate FUD, but also help fight FUD. Embrace it!
otr retweeted
. @mubix shared this on LinkedIn and thought some of you might find it useful: “A Practical Reprioritization Guide for CISOs Entering the AI Vulnerability Era”
linkedin.com/posts/mubix_the…
otr retweeted
Closing the Door on Net-NTLMv1: Releasing Rainbow Tables to Accelerate Protocol Deprecation - @Blurbdust
cloud.google.com/blog/topics…
otr retweeted
There goes the home planet. Anthropic discovered 600 open source vulns in well-fuzzed open source projects, using Opus 4.6.
red.anthropic.com/2026/zero-…
It's time for action. A short thread.
otr retweeted
Prediction: you will see documentation disappear from most proprietary softwares websites
otr retweeted
Whenever I start making something, I always feel uncertain-- right up until the moment that I encounter real difficulty. It's only once I discover that there is something difficult involved that I start to feel comfortable.
Before that moment, it's hard to know that the thing I'm making is worth making. After all, why doesn't it already exist? If anyone can do it, shouldn't someone else have done it already? Is this just a bad idea that has already quietly failed many times before?
But when I encounter something really difficult, that's when I know why it doesn't already exist, and overcoming that difficulty with my obsessiveness and anything else I can bring to bear becomes exciting. It feels like an opportunity; a reason that something is worth doing.
When I say that I consider these to be "the last days of software development," it's because -- for a lot of my life -- knowing how computers work has been significant and valuable, because for most of my life, it has been possible to sit down at a computer, start making something, and encounter that difficulty everywhere.
I don't think eliminating software development as it has been is a negative development in the slightest. I think making software easy/free to build will have all kinds of positive effects for all of us.
And sure, maybe there will continue to be humans in the loop etc etc.. but I do think that this is the end of something that I invested a lot of time thinking about, in large part so I could sit down at a computer and start typing into an editor with some trepidation, until the moment that I encounter something which makes me stop and think "oh." And then smile.
otr retweeted
I was reading an older report from CrowdStrike the other day:
"CrowdStrike was able to reconstruct the PowerShell script from the PowerShell Operational event log as the script’s execution was logged automatically due to the use of specific keywords." [1]
Which reminded me of the post of @nas_bench :
"PowerShell has a list of suspicious keywords. If found in a script block an automatic 4104 event will be generated regardless of logging policy :)" [2]
You can look up the relevant code here (it's inside the SuspiciousContentChecker class.) [3] Nasreddine published the list here in a gist [4]
[1] crowdstrike.com/en-us/blog/o…
[2] nitter.gq/nas_bench/status/16462…
[3] github.com/PowerShell/PowerS…
[4] gist.github.com/nasbench/50c…
PowerShell has a list of suspicious keywords. If found in a script block an automatic 4104 event will be generated regardless of logging policy :) (True for both PWSH 5/7)
Look for EID 4104 with Level 3 (Warning)
Full List: gist.github.com/nasbench/50c…
otr retweeted
You can generate SSH keys on the secure enclave of your Mac, and use that to connect to your servers.
Since the OS can’t read any data on the secure enclave, it’s much harder for the keys to get stolen. When you need to use the key, the system will perform biometric authentication and then sign the request using your private key on the secure enclave without your CPU ever seeing the private key.
Recommend using this if you have SSH private keys currently stored on disk
gist.github.com/arianvp/5f59…
otr retweeted
🚨 Heads up, LinkedIn users!
On November 3rd, Microsoft will share your LinkedIn data to train AI models — and you’re opted in by default.
Here’s how to opt out:
Account > Settings & Privacy > Data Privacy > Data for Generative AI Improvement > Toggle OFF ✅
otr retweeted
I'm not sure everyone realizes it, but as it stands, if you have an Active Directory with default configurations, any machine (except DCs) that hasn't applied the June 10 patch can be compromised by any domain user.
Microsoft just released the patch for CVE-2025-33073, a critical vulnerability allowing a standard user to remotely compromise any machine with SMB signing not enforced! Checkout the details in the blogpost by @yaumn_ and @wil_fri3d.
synacktiv.com/publications/n…
