Enzu

ai // agents // prompts

[Enzu @01enzu]

@HashItOut_ 70k commands to build a computer out of a fax image is insane. first thing I noticed: link previews in Messages are gone, just plain URLs now. haven’t hit a broken site yet

[Enzu @01enzu]

I can’t sleep after this.

I asked Claude Code to walk me through how Pegasus got into iPhones. The owner never opened a single message.

One iMessage arrived while the phone sat locked on a nightstand, and it was over before the owner touched it. Citizen Lab pulled this attack off a real activist’s iPhone in 2021.

The attachment was called something.gif. It was really a PDF, and iMessage processed it automatically, outside its own security sandbox.

Inside was an image in JBIG2, a format from 2000 built for fax machines. NSO used a bug in its decoder to build a small working computer out of the image’s pixels, right inside the phone’s memory. From there it broke out and installed Pegasus.

Google’s Project Zero called it one of the most sophisticated exploits they had ever seen.

Apple patched this bug, then built Lockdown Mode against exactly this kind of attack. It ships on every iPhone, switched off. I turned mine on today.

The guide below shows where it is, plus 14 other settings most people have never touched.

[Cooler @coolerwave]

https://t.co/hlrnJQuPvr

[Enzu @01enzu]

@heyyaven the craziest part is no one would have known if Citizen Lab hadn’t pulled it off one activist’s phone

[Enzu @01enzu]

@Kuzoxbt the fax pixels part is what broke my brain. a whole computer built out of image compression instructions

[Enzu @01enzu]

@coolerwave agree, most people don’t need it on 24/7. but it takes 10 seconds to switch on, so worth knowing where it is before the day you need it

[Enzu @01enzu]

@diamai_ @bot Good use case. I'd add one check: same model, same seller, same return policy before buying.

[Enzu @01enzu]

@buzzhive_ai Sounds like Kimi for the first draft and Opus for the final pass

[Enzu @01enzu]

@AIBoticssq Worth noting this is an outlook, not a rating cut. The rating itself hasn't changed yet

[Enzu @01enzu]

@0xGisu How do you check that the other 6 bots really ignore the Vault?

[Enzu @01enzu]

@fayzonnn The oracle step is what separates a rebuild from a guess

[Enzu @01enzu]

@Deadblead Yes, nobody pays attention to small amounts. It's the repeat that adds up.

[Enzu @01enzu]

I can’t sleep after this. Claude Code just found €6,412 in charges on my cards over the last 7 years. I don’t remember agreeing to most of them.

They came every month while I was doing nothing. Paying for groceries, buying a train ticket, ordering food at 2am. €2.99, €4.99, €9.99, small enough that I never looked twice.

These were real charges, each with a date and a merchant name like “PAYPAL *DIGITALSVC” or “GOOGLE *TEMPORARYHOLD”. None of them matched anything I use.

I exported every statement I had as CSV, 3 banks, 7 years, and told Claude Code to find charges that repeat on a schedule and match them to apps and services I actually open.

31 recurring charges. 23 of them for things I forgot existed. The biggest was a fitness app I downloaded in January 2019 to “get in shape”. I opened it 4 times. €119.99 a year, renewed 7 times.

Then I checked the dates. In 2022 I lost my wallet, blocked the card and got a new one. I thought that killed everything. The charges kept coming on the new card the very next month.

Visa and Mastercard both run “account updater” services. When your bank issues a new card, merchants with a saved subscription get the new number automatically. A new card cancels nothing.

While I was still scrolling the list, my phone buzzed. €1.99, from a merchant I’d marked as “unknown” ten minutes earlier.

I cancelled everything I could, disputed what I couldn’t identify and asked my bank which merchants still have my card on file. How much of the €6,412 I’ll ever see again, I don’t know.

If you want to check yours, export your bank statements as CSV and ask Claude Code to find every recurring charge and when you last used each service.

[Enzu @01enzu]

@Kaggii_ Good point

[Enzu @01enzu]

@AIBoticssq right, it can’t. it finds and groups the recurring charges, then you go through the list and mark what you still use. the grouping is the part that would take hours by hand

[Enzu @01enzu]

@artMishchenko most just let me cancel. a few made me dig through 3 screens of “are you sure” offers first. the fitness app offered 50% off to stay)

[Enzu @01enzu]

@kinderlayer the worst part is it’s working as designed. it exists so your netflix doesn’t break when your card expires. nobody asks if you still want the netflix

[Enzu @01enzu]

@Zarnvex smart. single-use cards are the one thing account updater can’t follow, once the card is closed there’s nothing to update

[Enzu @01enzu]

@heyyaven One variable is the whole trick. Mine would be 1 ad creative tested a day

[Enzu @01enzu]

@ESC__AI Image to video is the best part. Does it keep the same look as the picture?

[Enzu @01enzu]

@Wombaflow Good setup. One note: the advisor isn't capped at 3 calls. Claude decides when to ask Opus, and those three moments are the usual triggers. Watch your usage on long sessions.