Dylan

Security researcher, public speaker and founder.

Forbes 30 Under 30

Truffle Security @trufflesec

@Netflix

[Truffle Security @trufflesec]

🚨 A "deleted" PyPI package exposed an admin GitHub PAT - granting access to Apache & Astronomer for 2.5 years

🔑 678K “deleted” packages were recovered from object storage & 190 live secrets found

❌ Deletion ≠ revocation 🔄 Rotate your creds!

🔗https://t.co/1eKvqDVKCp

[Dylan @InsecureNature]

The CISA story gets worse

[Dylan @InsecureNature]

@d0rkph0enix Like with all good horror movies, there's a sequel: https://t.co/zRQ3Py1PRV

[Truffle Security @trufflesec]

🔓 CISA admin GitHub App key still LIVE 2 days after Krebs reported it.

And there was more:
🔑 Org-wide GitHub admin access
📦 6 JFrog tokens + master keys
🔐 Guessable DB passwords

👉https://t.co/8sF2aMEbfk

[Dylan @InsecureNature]

Rotation can be hard.

[Truffle Security @trufflesec]

🔓 CISA admin GitHub App key still LIVE 2 days after Krebs reported it.

And there was more:
🔑 Org-wide GitHub admin access
📦 6 JFrog tokens + master keys
🔐 Guessable DB passwords

👉https://t.co/8sF2aMEbfk

[Dylan @InsecureNature]

Huge congrats @feross , and @SocketSecurity

Backdoor-ed packages are not going anywhere anytime soon. Everyone's so worried about Mythos, let's not forget most malicious code today is pulled, not pushed.

[Feross @feross]

Today is a big day for @SocketSecurity. We just raised a $60M Series C at a $1B valuation, led by @ThriveCapital with participation from @a16z, @AbstractVC, and @CapitalOne Ventures. Total funding is now $125M.

Four years ago, we started Socket because open source dependencies were flowing into production faster than anyone could vet them. AI has massively accelerated that. Code is being written, shipped, and deployed before any human reads it. Security has to operate at that same speed.

One data point from Thrive's diligence that I keep coming back to: they first discovered Socket because @cursor_ai, @OpenAI, and @AnthropicAI all independently told them it was the most important security tool they'd adopted for AI-driven development. Three of the most sophisticated AI companies converging on the same vendor unprompted.

Since our Series B, Socket has grown to more than 20,000 organizations, protecting over 1.5 million repositories and blocking more than 1,000 supply chain attacks every week. The team is now over 100 people.

Three out of five FAANG companies are Socket customers. So are the companies building the most ambitious AI products: @AnthropicAI, @cursor_ai, @xai, @figma, @vercel, @Replit, @scale_AI, @GustoHQ, @Mercadolibre, and @cribl_io, alongside Fortune 100s in financial services and global media.

What we've shipped since the last round:

• Socket Firewall blocks malicious packages at install time, before they reach a developer's laptop or CI pipeline. Free for everyone.

• Reachability analysis via our acquisition of Coana, eliminating 50-80% of irrelevant vulnerability alerts by focusing only on CVEs that are actually exploitable.

• Socket Certified Patches for remediating exploitable CVEs in seconds without waiting on upstream maintainers.

• Coverage extending to browser extensions, editor extensions, MCP servers, and AI tools via our acquisition of @secureannex.

When the Axios compromise hit, our detection systems flagged the malicious dependency within six minutes. Within 24 hours, more than 2,000 organizations onboarded to Socket to block it.

Where the funding goes: deeper investment in Firewall, massively expanding Certified Patches, moving protection closer to every point of install across the developer toolchain, and new product launches pushing Socket into a category we haven't entered before.

We're hiring across engineering, sales, customer success, and threat intel.

❤️ Thank you to our customers, investors, and the open-source community for your support. Together, we’re making software safer for everyone.

[Dylan @InsecureNature]

@LiveOverflow @intigriti |￣￣￣￣￣￣￣￣￣￣￣￣￣￣|
I just like holding signs
|＿＿＿＿＿＿＿＿＿＿＿＿＿＿|
\ (•◡•) /
\ /
——
| |
|_ |_

[Dylan @InsecureNature]

@caseyjohnellis Or if you add too much reporting friction it makes twitter the more tempting reporting option for some...

[Dylan @InsecureNature]

Looks like Google is getting serious about the Gemini issue we reported @trufflesec

Not the most elegant solution, but it will help.

[Dylan @InsecureNature]

@mattjay Seems dead backwards. When you're finding more internally you should pay more for those that still find them externally.

[Dylan @InsecureNature]

@caseyjohnellis I've just been telling it Casey Ellis is going to manually do a security review when it's done

[Dylan @InsecureNature]

Hacker Typer is actually kinda slow at generating code...

[Dylan @InsecureNature]

@martin_casado The other thing is cyber is uniquely good for adversarial training.

One model on offense and one on defense. One that's rewarded for getting the flag, and one that's rewarded to keep services running and protect the flag.

Other RL loops don't get that privilege.

[Dylan @InsecureNature]

@martin_casado Most definitely. Decades of CTF challenges basically define the reward function for you; if the flag appears in output, reward.

OpenAI has talked a little bit about solving CTF's (though it's not explicitly talking about RL I think it's a safe bet to make)

[Dylan @InsecureNature]

@InsiderPhD Ask for the right kind of proof, and learn how to quickly validate the proof.

[Malus @end_foss]

Axios backdoored? We have to end the insanity.

We can't fix it. Stop trying.

It's time to start clean.

[Dylan @InsecureNature]

What's funniest about this is the actual Cursor prompts

[Jake @JakeKing]

What if an agent could walk around the rsa show floor.

How many companies do you think it'd try to vibecode?

turns out its a lot. https://t.co/7AOnvrWApL

[Dylan @InsecureNature]

Vibe code all the companies at RSA

[Jake @JakeKing]

What if an agent could walk around the rsa show floor.

How many companies do you think it'd try to vibecode?

turns out its a lot. https://t.co/7AOnvrWApL

[Jake @JakeKing]

What if an agent could walk around the rsa show floor.

How many companies do you think it'd try to vibecode?

turns out its a lot. https://t.co/7AOnvrWApL

[Dylan @InsecureNature]

"This just in, false alarm, it was just saint patrick's day"

[cje @caseyjohnellis]

attribution is gonna be a PAIN for this one

[Dylan @InsecureNature]

I'm speaking at BSidesSF tomorrow morning on HuggingFace Datasets.

It's going to be a good talk if you can make it.