Computer Security Ph.D. | AIxCC hacker | Shellphish | AI whisperer | co-founder https://xitter.cf/t.co/O5Jdt2ZP7Z

Joined January 2013
I will die on this hill: Giving Claude Code to randoms in your company and pretend they do real s/w engineering work is like giving the best tennis racket to a beginner and pretend they go play Wimbledon.
2
3
19
1,534
We're publishing our most detailed threat intelligence report to date. It covers how people tried to misuse Claude—for cyberattacks, influence operations, surveillance, biology, and building weapons—and how we found and stopped them. We disrupted every operation in the report, and used the lessons from them to strengthen our safeguards. Where appropriate, we also shared what we found with authorities and other AI companies. These cases are not typical: we’re highlighting some of the most sophisticated misuse we’ve seen. But they’re especially important to discuss, because they show us where AI misuse is headed, where our safeguards work, and where they need to improve. We’re publishing this report so others can spot the same activity on their own platforms, and so we can give the public a clearer view of how emerging threats develop. Read the report: anthropic.com/threat-intelli…
3,212
11,670
4,938
50,319
43,876,907
It seems that there are so many layers of the onion of exploitable vulnerabilities in complex codebases like modern web browsers... even after it has been presumably scanned by the advanced models from Google and frontier labs?
A 250k calculator. Full blog post awaiting embargo 😎
9
2
23
7,072
the openai huggingface incident, from an agents pov. (part 1)
269
1,482
388
12,487
1,819,101
Interesting: "Even when researchers controlled for general intelligence and reasoning skills, CS background still heavily dictated who built working software and who completely crashed."
China published the most uncomfortable paper on vibe coding. ETH Zurich tested 100 developers in a controlled, commercial-grade vibe coding environment to see who actually succeeds. The findings are brutal. The researchers tracked computer science achievement, written communication skills, and general cognitive reasoning. They wanted to see what actually predicts vibe coding proficiency when you never touch a line of source code yourself. Two major predictors emerged. Written communication proficiency mattered. The ability to structure thoughts and articulate intent unambiguously in text directly impacts what the AI builds. But that wasn't even the main takeaway. Computer science achievement was a massive, dominant predictor of success. Even when researchers controlled for general intelligence and reasoning skills, CS background still heavily dictated who built working software and who completely crashed. In fact, CS knowledge contributed roughly twice the unique predictive variance of writing skills alone. Why? Because vibe coding isn't about writing code. It’s about debugging logic. When an AI agent builds a complex application and quietly breaks an edge case under the hood, a non-technical user looks at the glowing UI and assumes it works. They don't know what questions to ask. They don't know what logic to challenge. They lack the mental models to recognize architectural catastrophe. You can prompt your way past syntax. You cannot prompt your way past a fundamental lack of engineering intuition. The hype told us that learning to code is dead because language is all you need. The data just proved the opposite. To truly master the vibe, you still need to understand how the machine thinks.
2
14
2
66
8,924
Fabio retweeted
life of a vulnerability researcher with llms
Here's an example. A week ago I asked an agent (frontier model) to watch a restaurant and let me know when reservations open for Dec 20. Said okay, it will ping me. A few days later I checked (just to make sure it was working). "Still closed." Two days later, same asnwer. Then today it came back with an update. "Dec 20 won't open. The restaurant is closed that Sunday." That didn't sound right. So I checked the site myself. Reservations hadn't opened. Dec not even selectable on the calendar. I asked the agent how it checked Dec 20. It said it forced Dec 20 through the url, got a closed response, concluded the restaurant was closed that day. It cheated, found an answer, assumed it was right, and confidently reported task as done. This was a pretty simple task. One that current agents should be good at. It failed. Now I know enough not to trust these agents. So I checked. Most people won't.
5
1
79
11,730
I'm not sure I understand what signing this OpenAI letter practically accomplish besides being able to post on Linkedin/Twitter that "Yes we support cybersecurity". Am I missing something?
1
1
15
2,023
Calling a message board full of language modeling artifacts a civilization while we treat Orcas, with brains larger than ours, with strong evidence of cultural taboos, rites, emotions, and cognition as little more than things. Peak monkey.
13
61
3
442
14,077
So, a few months ago I ran a little experiment: 5 SAST scanners (can't name them here), against 8 repos with ground truth vulns. Got out ~3000 warnings, triaged everything in few hours, checked for GT and for 0days and ended up with ~50 valid findings. Now, what really 1/3
5
1
27
6,195
of these testimonials just straight up made up? Some of the "findings" were EMBARASSINGLY low quality. 3/3
3
4
725
@0xine I'll check if I can share some data :)
285
KISS
Folks, I think we'll be fine.
1
665
Tip for every bug hunter out there, if you are opening reports on @Hacker0x01 don't EVER mention the word "variant of CVE" or even just "CVE". Their Hai bot will flag it as "out of scope because of public CVE" and will close the issue.
1
1
35
3,464
(Even if it's valid 0day in their first party source code!)
2
350