AI security research at https://nitter.gq/t.co/YlpIqx4Rdv ·
🇫🇷
Joined October 2021
- Tweets16.8K
- Following1.4K
- Followers4.7K
- Likes21.8K
I hate OSS maintainer using the exact code I send them to patch their vulns, while ignoring my GHSA 💀
43
Takyon∞ - The Tokenizer retweeted
Remember how Anthropic said Project Glasswing (Mythos) found tens of thousands of software vulnerabilities?
Security firm VulnCheck just audited the actual 7-month Glasswing ledger, and the numbers are wild:
- Out of 37,966 total findings, 30,617 (80.6%) aren't even in the public ledger yet
- Only 217 findings (0.57%) have actually been fixed
- Between Sept 8 and Nov 2, total findings jumped by +11,813, while fixes went up by only +15 (from 202 to 217) and duplicates exploded from 2 to 1,670
Even worse: Anthropic's unreviewed OSS Scanner sent 45 vulnerability reports to `curl` creator Daniel Stenberg and out of the 34 published so far, 19 of them (55.9%) were rejected as `vuln:NONE` (not a real vulnerability).
Just like me fr fr
Anthropic quietly dropped a fascinating finding in the new Claude Fable 5.2 prompting guide.
When you give Fable 5.2 a coding task without saying who owns the repo, it assumes it's a guest in someone else's codebase. So it plays it safe: it bolts new functions onto the existing structure, leaves duplicate code alone, and merely mentions nearby bugs instead of fixing them.
Adding this single sentence to your system prompt or CLAUDE.md completely changes its behavior:
"This codebase is yours: what it's for and how it's built are your call, and you'll keep building on it."
In Anthropic's internal tests, adding that one line made Fable 5.2 proactively merge duplicate code and clean up related bugs in ~50% of runs, compared to under 10% without it.
1
125
Takyon∞ - The Tokenizer retweeted
we're throwing a boat hackathon!
to participate just code your project from any boat from the 14th to the 21st
we'll have a boat in SF for you to come whenever and an in-person demo day at the same boat on the 21st
First Boat Hackathon in SF at Pier 9!!
Thanks @AniC_dev @boatdotdev @mynameisyahia @getcontextdev @jperla @nytokenexchange go to BoatHackathon.com to code aboard and ship something that makes waves on the Historic Klamath!!!
In 205X I'll do the same thing too
La résignation n'est pas une option. Face aux difficultés de notre pays, l'heure est venue de prendre ses responsabilités.
Je suis candidat à l'élection présidentielle de 2027.
#TeddyRiner2027 #Présidentielle2027 #LaFrancequonveut
2
104
I'm doing this with my tool but on vulnerability research, I started to scan 100 repo at the sametime one min ago, one scan cost me between 0.29€ to 0.41€, I'm sure at 95% to find at least one medium vuln in each repo
That's +100 GHSA for my tool Shard, I'll release the tool in the next few weeks/days :)
kinda funny sandbox providers with more supply than us turned my minecraft / desktop grids demos into a hello world
all they know is to copy what works and burn VC money to max it out, vanity metrics style
but after the 1k VM demo it was over, no one needs to know you can do 10k VMs playing minecraft once they've seen someone do 1k once
heck, the first desktop grids demo I did still one ups all other demos in views, they can't beat it, neither can I with the same thing but bigger
our competitors have low substance, mid vibes, subpar taste, they could never converge to the right product shape fast enough
or figure out the next viral demo
they may have ton of supply, but they can't compound on it as much as we do
they'll endlessly copy us, but in the end we'll be more right and more in time
4
3
288
Non c'est une bonne idée, avec des sauvegardes et de bonnes mesures de sécurité en amont c'est même une très bonne idée
1
3
279
I give ~20€ a day to my tool Shard to search for security issues in open source, I wake up everyday (almost) with newly accepted GHSA.
I will release the tool in a few days, it's the best tool to find vulnerability at scale with a controled pipeline even with cheap models
