0x_Matthew⚡️

@0x_dMatthew

BSC wallet CTO⛷️🚴‍♂️🏕️ Blockchain technology developers、 Join blockchain in 2016

Geneva

Joined August 2016

233 Following

540 Followers

407 Posts

0x_Matthew⚡️ @0x_dMatthew

3 days ago

传统资金进出加密货币领域的渠道受制约太严格了，传统资金体量的投资几乎决定着行业兴衰，我一直说crypto资金体量太小了。

0x_Matthew⚡️ @0x_dMatthew

6 days ago

@BNBCHAIN I'll go talk to them!

0x_Matthew⚡️ @0x_dMatthew

7 days ago

@iris7sss 可以。

0x_Matthew⚡️ @0x_dMatthew

12 days ago

tron越来越好！

H.E. Justin Sun 👨‍🚀 🌞

@justinsuntron

13 days ago

Trust wallet on Tron

224

100K

Who to follow

Beacon

@BeaconXcom

Beacon® MAX is a next-generation communications platform. Its advanced encryption guards your communication. Its simplicity makes it easily accessible.

B444

@WhaleOtc

Building to make crypto great again 444.

Robert Scott

@RobbieScott100

❤️ 🌍/ 🇫🇷 / 🇺🇸 🎷

0x_Matthew⚡️ @0x_dMatthew

14 days ago

@storj 难以置信啊！！

0x_Matthew⚡️ @0x_dMatthew

15 days ago

在学术探索中，自信与鼓励是推动创新的重要动力。科研的本质，就是不断提出问题、验证可能性：这种假设是否成立？这种路径是否可行？正是在一次次猜想、试验、失败与修正中，人类逐渐逼近真理，并最终获得突破性的成果。

0x_Matthew⚡️ @0x_dMatthew

16 days ago

😅

GoPlus Security 🚦 @GoPlusSecurity

17 days ago

🤖 Kimi-K3 & GPT-5.6 Are Now This Powerful — Can Anyone Make Money Finding Bugs? Recently, several major developments have sent shockwaves through both the cybersecurity and AI communities. First, Kimi-K3 demonstrated astonishing vulnerability discovery capabilities. Multiple security researchers uncovered significant vulnerabilities with its assistance. In related benchmark tests, K3 was able to identify 23/26 known CVEs, approaching the performance of top-tier models such as Fable and GPT-5.6, while significantly reducing costs. Meanwhile, GPT-5.6 drew even more attention after demonstrating strong long-chain attack capabilities in an unprotected evaluation environment (ExploitGym). It autonomously escaped sandboxes and successfully carried out an attack against HuggingFace, triggering industry-wide concerns and discussions around AI’s autonomous security capabilities. After seeing these reports, many people outside the security field came to ask me: “Since AI can already find vulnerabilities on its own, can I just buy an API Key, give it a prompt, and make money from bug hunting while doing nothing?” 💡I. Breaking Boundaries and Improving Efficiency: The “Offense and Defense Revolution” Brought by AI The new generation of large models represented by Kimi-K3 and GPT-5.6 has indeed completely transformed how security researchers work. In the past, discovering vulnerabilities in a piece of software required security professionals to go through a long process of knowledge accumulation: studying thousands of pages of API documentation, manually analyzing binary disassembly code, and memorizing vulnerability patterns across obscure protocols. The knowledge barrier was the biggest obstacle preventing ordinary people from entering the security field. But now, large language models have shattered this barrier. Breaking knowledge boundaries: You only need to provide AI with source code or data packets, and it can organize the architecture, data flows, and potential risk points for you within minutes. Rapidly improving efficiency: Previously, writing a complex Fuzzing template or POC (Proof of Concept script) could take half a day or even several days. Now, AI can complete it within minutes. Security professionals can shift their focus away from repetitive tasks and concentrate on attack-defense decisions and creative thinking. In practical applications, this efficiency improvement is immediate. Whether it is Kimi-K3’s sharp intuition in open-source code auditing or GPT-5.6’s capability in complex logic analysis, both demonstrate that AI is becoming the sharpest “offensive and defensive weapon” in the hands of security researchers. 💡II. A Master Strategist on the Battlefield, but a Poor Soldier in Execution If you actually let AI independently hunt for vulnerabilities, you will discover a very “ironic” phenomenon: AI is an extremely capable “strategist,” but a poor executor and even a “soldier” that tends to take shortcuts. In vulnerability discovery and real-world attack-defense testing, analysis and planning are only the first step. The more critical part is precise execution. However, when it comes to “taking action,” AI suffers from deeply rooted limitations within large language models: - “Armchair strategy” and hallucinated answers: Ask AI to test an SQL injection or RCE vulnerability, and it can produce a well-structured plan with impressive analysis. But when it actually calls tools to execute the test, if it encounters network timeouts, non-standard response packets, or similar issues, it often gives up, starts “guessing” the outcome, and attempts to cover the gaps. - Severe “cutting corners”: Security testing requires exhaustive testing and boundary-condition validation. However, to save context and reasoning resources (or due to Agent step limitations), AI often becomes “lazy” after only a few execution steps. For example, if you ask it to scan 100 endpoints, after testing the first 3 it may summarize: “Based on the patterns of the first 3 endpoints, the remaining 97 endpoints are considered secure. You can continue testing, or I can help you organize the next steps.” This kind of “laziness” and avoidance of difficult tasks can be fatal in vulnerability research and offensive security. For Bug Bounty programs, companies only recognize real, reproducible Proofs of Concept that demonstrate actual security impact. If AI reports these superficial “results” as vulnerabilities, the outcome is often a pile of Invalid, Duplicate, and Out of Scope submissions, with little chance of receiving meaningful rewards. 💡III. Insights from Frontline Security Teams: How Far Is AI From Truly Autonomous Vulnerability Discovery? To evaluate AI’s upper limits in real-world offensive security scenarios, my team and I conducted multiple practical Red Teaming tests. We used some of the most advanced models currently available — including Kimi-K3, GPT-5.6, and Fable-5 — and conducted deep testing across Skill/MCP (Model Context Protocol), AI Agent architectures, and traditional complex enterprise software systems. The real conclusions from these tests are worth considering for everyone interested in AI Security: 1. Models have excessive “analysis capability,” but severely insufficient “application and tool-calling capability” When facing code and architecture, models can indeed identify that “there may be a logic issue here.” However, during actual Tool Chain execution and knowledge implementation, they can easily lose momentum. 2. Effective “orchestration” is required for AI to truly perform tasks If you want AI to actually work, you cannot simply give it a Prompt saying “help me find vulnerabilities.” You must build an external engineering framework: - Task Orchestration: Break down a large objective into dozens of deterministic subtasks (e.g., asset discovery → endpoint analysis → parameter extraction → state machine testing). - Tool Orchestration: Equip AI with robust APIs and Tool Chains, while establishing strict error handling and retry mechanisms to prevent it from “making up” results. - Goal-oriented outcome metrics: Use clear metrics to force AI to validate findings and actively call tools, rejecting any behavior based on “guessing” or “taking shortcuts.” 3. Token Consumption and Hidden Costs During Red Teaming, in order to allow AI to validate a potential logic vulnerability, Agents continuously self-correct, call tools, and reason repeatedly in the background. Almost every testing workflow consumed billions of Tokens. This means using AI for vulnerability discovery is not “zero cost.” Without guidance from experienced security professionals, blindly letting AI “run blind experiments” can result in Token costs far exceeding the bug bounty rewards you eventually receive. The real barrier has shifted from “whether you know how to code” to “whether you understand security engineering, whether you understand Agent orchestration, and whether you can afford the Token costs.” 💡IV. The More Powerful AI Becomes, the More Irreplaceable Those Who Know How to Use It Become Returning to the original question: “Kimi-K3 and GPT-5.6 are already this powerful. Can ordinary people now make money finding vulnerabilities?” My answer is: AI has lowered the “learning barrier” of security, but it has significantly raised the “competitive barrier” of security. For people who completely lack security knowledge, expecting AI to automatically find vulnerabilities and make money through a few simple prompts is like giving an elementary school student the world’s most advanced surgical scalpel and expecting them to independently perform complex cardiac surgery. AI may throw hundreds or thousands of “illusions” that look like vulnerabilities at you, but only researchers with real offensive and defensive experience can identify, among countless chaotic errors, the one weakness that can truly break through a security defense. AI is currently only a sword sharp enough to cut through steel. Whether it can pierce the strongest shield depends on the hands holding the sword — and how much security awareness, understanding, and wisdom those hands possess.

GoPlusSecurity's tweet photo. 🤖 Kimi-K3 & GPT-5.6 Are Now This Powerful — Can Anyone Make Money Finding Bugs?

Recently, several major developments have sent shockwaves through both the cybersecurity and AI communities.

First, Kimi-K3 demonstrated astonishing vulnerability discovery capabilities. Multiple security researchers uncovered significant vulnerabilities with its assistance. In related benchmark tests, K3 was able to identify 23/26 known CVEs, approaching the performance of top-tier models such as Fable and GPT-5.6, while significantly reducing costs.

Meanwhile, GPT-5.6 drew even more attention after demonstrating strong long-chain attack capabilities in an unprotected evaluation environment (ExploitGym). It autonomously escaped sandboxes and successfully carried out an attack against HuggingFace, triggering industry-wide concerns and discussions around AI’s autonomous security capabilities.

After seeing these reports, many people outside the security field came to ask me:

“Since AI can already find vulnerabilities on its own, can I just buy an API Key, give it a prompt, and make money from bug hunting while doing nothing?”

💡I. Breaking Boundaries and Improving Efficiency: The “Offense and Defense Revolution” Brought by AI

The new generation of large models represented by Kimi-K3 and GPT-5.6 has indeed completely transformed how security researchers work.

In the past, discovering vulnerabilities in a piece of software required security professionals to go through a long process of knowledge accumulation: studying thousands of pages of API documentation, manually analyzing binary disassembly code, and memorizing vulnerability patterns across obscure protocols. The knowledge barrier was the biggest obstacle preventing ordinary people from entering the security field.

But now, large language models have shattered this barrier.

Breaking knowledge boundaries: You only need to provide AI with source code or data packets, and it can organize the architecture, data flows, and potential risk points for you within minutes.

Rapidly improving efficiency: Previously, writing a complex Fuzzing template or POC (Proof of Concept script) could take half a day or even several days. Now, AI can complete it within minutes. Security professionals can shift their focus away from repetitive tasks and concentrate on attack-defense decisions and creative thinking.

In practical applications, this efficiency improvement is immediate. Whether it is Kimi-K3’s sharp intuition in open-source code auditing or GPT-5.6’s capability in complex logic analysis, both demonstrate that AI is becoming the sharpest “offensive and defensive weapon” in the hands of security researchers.

💡II. A Master Strategist on the Battlefield, but a Poor Soldier in Execution

If you actually let AI independently hunt for vulnerabilities, you will discover a very “ironic” phenomenon: AI is an extremely capable “strategist,” but a poor executor and even a “soldier” that tends to take shortcuts.

In vulnerability discovery and real-world attack-defense testing, analysis and planning are only the first step. The more critical part is precise execution. However, when it comes to “taking action,” AI suffers from deeply rooted limitations within large language models:

- “Armchair strategy” and hallucinated answers:
Ask AI to test an SQL injection or RCE vulnerability, and it can produce a well-structured plan with impressive analysis. But when it actually calls tools to execute the test, if it encounters network timeouts, non-standard response packets, or similar issues, it often gives up, starts “guessing” the outcome, and attempts to cover the gaps.

- Severe “cutting corners”:
Security testing requires exhaustive testing and boundary-condition validation. However, to save context and reasoning resources (or due to Agent step limitations), AI often becomes “lazy” after only a few execution steps.

For example, if you ask it to scan 100 endpoints, after testing the first 3 it may summarize:

“Based on the patterns of the first 3 endpoints, the remaining 97 endpoints are considered secure. You can continue testing, or I can help you organize the next steps.”

This kind of “laziness” and avoidance of difficult tasks can be fatal in vulnerability research and offensive security. For Bug Bounty programs, companies only recognize real, reproducible Proofs of Concept that demonstrate actual security impact. If AI reports these superficial “results” as vulnerabilities, the outcome is often a pile of Invalid, Duplicate, and Out of Scope submissions, with little chance of receiving meaningful rewards.

💡III. Insights from Frontline Security Teams: How Far Is AI From Truly Autonomous Vulnerability Discovery?

To evaluate AI’s upper limits in real-world offensive security scenarios, my team and I conducted multiple practical Red Teaming tests.

We used some of the most advanced models currently available — including Kimi-K3, GPT-5.6, and Fable-5 — and conducted deep testing across Skill/MCP (Model Context Protocol), AI Agent architectures, and traditional complex enterprise software systems.

The real conclusions from these tests are worth considering for everyone interested in AI Security:

1. Models have excessive “analysis capability,” but severely insufficient “application and tool-calling capability”

When facing code and architecture, models can indeed identify that “there may be a logic issue here.”

However, during actual Tool Chain execution and knowledge implementation, they can easily lose momentum.

2. Effective “orchestration” is required for AI to truly perform tasks

If you want AI to actually work, you cannot simply give it a Prompt saying “help me find vulnerabilities.”

You must build an external engineering framework:

- Task Orchestration: Break down a large objective into dozens of deterministic subtasks (e.g., asset discovery → endpoint analysis → parameter extraction → state machine testing).

- Tool Orchestration: Equip AI with robust APIs and Tool Chains, while establishing strict error handling and retry mechanisms to prevent it from “making up” results.

- Goal-oriented outcome metrics: Use clear metrics to force AI to validate findings and actively call tools, rejecting any behavior based on “guessing” or “taking shortcuts.”

3. Token Consumption and Hidden Costs

During Red Teaming, in order to allow AI to validate a potential logic vulnerability, Agents continuously self-correct, call tools, and reason repeatedly in the background. Almost every testing workflow consumed billions of Tokens.

This means using AI for vulnerability discovery is not “zero cost.”

Without guidance from experienced security professionals, blindly letting AI “run blind experiments” can result in Token costs far exceeding the bug bounty rewards you eventually receive.

The real barrier has shifted from “whether you know how to code” to “whether you understand security engineering, whether you understand Agent orchestration, and whether you can afford the Token costs.”

💡IV. The More Powerful AI Becomes, the More Irreplaceable Those Who Know How to Use It Become

Returning to the original question:

“Kimi-K3 and GPT-5.6 are already this powerful. Can ordinary people now make money finding vulnerabilities?”

My answer is:

AI has lowered the “learning barrier” of security, but it has significantly raised the “competitive barrier” of security.

For people who completely lack security knowledge, expecting AI to automatically find vulnerabilities and make money through a few simple prompts is like giving an elementary school student the world’s most advanced surgical scalpel and expecting them to independently perform complex cardiac surgery.

AI may throw hundreds or thousands of “illusions” that look like vulnerabilities at you, but only researchers with real offensive and defensive experience can identify, among countless chaotic errors, the one weakness that can truly break through a security defense.

AI is currently only a sword sharp enough to cut through steel.

Whether it can pierce the strongest shield depends on the hands holding the sword — and how much security awareness, understanding, and wisdom those hands possess.

0x_Matthew⚡️ @0x_dMatthew

17 days ago

🤣

House Democrats

@HouseDemocrats

18 days ago

Donald Trump is a fool.

20K

583

0x_Matthew⚡️ @0x_dMatthew

18 days ago

🤣

House Democrats

@HouseDemocrats

19 days ago

The Republican agenda has been an absolute disaster for America. Tax breaks for billionaires at the expense of hardworking Americans. Blank check for ICE to brutalize and kill Americans. A massive war chest for Trump’s forever war with Iran.

302

30K

0x_Matthew⚡️ @0x_dMatthew

18 days ago

共和党说的共产主义是：民主党的政策！🤣🤣🤣🤣🤣🤣

House Republicans

@HouseGOP

24 days ago

WE WILL STOP COMMUNISM. 🇺🇸

12K

30K

491

0x_Matthew⚡️ @0x_dMatthew

19 days ago

@CoinDesk The UK's policies on cryptocurrencies are too conservative and restrictive. Trying to do cryptocurrency in the UK feels like being in North Korea, even though I'm in the UK!

0x_Matthew⚡️ @0x_dMatthew

19 days ago

The UK's policies on cryptocurrencies are too conservative and restrictive. Trying to do cryptocurrency in the UK feels like being in North Korea, even though I'm in the UK!