Jamie Parfet

hacker

[Jamie Parfet @JamieParfet]

@_jensec @OpenAI the whole thing is so dumb. why would i order a Yubikey if all i get is to keep using useless Daybreak Blue?

[Jamie Parfet @JamieParfet]

opus 5.5 is completely useless. even being in CVP, cannot do any development.

[Jamie Parfet @JamieParfet]

@cjav_dev the safeguards are insane and make Opus 5.5 completely unusable

[Jamie Parfet @JamieParfet]

@adnanthekhan what are you using as the backend? go, python or something else?

[LiveOverflow 🔴 hextree.io @LiveOverflow]

Here is how OpenAI’s CISO fumbled the situation (in my personal opinion)

🧵 1/X

[Jamie Parfet @JamieParfet]

very tempted to drop some Adobe Campaign RCE 0-days after they reached out to HackerOne to try to get me to stop reporting bugs to their customers

[Jamie Parfet @JamieParfet]

@adnanthekhan can you share how you solved this? i'm trying to get my agents to communicate effectively with each other and can't figure out a good strategy

[Matt Hand @matterpreter]

Yesterday we found an interesting trace during review of our own data. Codex needed an MCP tool it didn't have, found that Claude Code had it, and launched Claude to do the work. When Claude needed approval, Codex eventually relaunched it with --dangerously-skip-permissions.

[Jamie Parfet @JamieParfet]

So the proposed process is now:

Find a 0-day. Report it to the vendor for $0. Wait for the vendor to publish a CVE. Wait another 30 days. Gamble on whether the target is patched or not.

HackerOne mediation sided with them on all 4 reports, of course. Bug bounty is awesome!

3/3

[Jamie Parfet @JamieParfet]

i got immediate 10x productivity gains by creating my own custom "lead" agents that delegate and orchestrate an entire fleet of subagents

however the overhead (aligning codex and claude, handling db migrations, merging, etc) has temporarily made me -10x

[Jamie Parfet @JamieParfet]

@pdiscoveryio sure, you can roll this yourself, but you could also just use https://t.co/JXYO9yll6j

[Jamie Parfet @JamieParfet]

it has been 2 weeks since a program decided not to reward me for 4 individual criticals and i haven't heard a single thing from HackerOne Mediation

[Zack Korman @ZackKorman]

My contribution to the AI cyber risk debate.

[Jamie Parfet @JamieParfet]

Another day, another Adobe security bulletin 🔥
All unauthenticated, exploitable on a stock install:

CVE-2026-48323 (RCE)
CVE-2026-48331 (SSRF)
CVE-2026-48330 (SQLi)
CVE-2026-48326 (SQLi)
CVE-2026-48333 (Auth bypass > RCE)

https://t.co/E9GHfVg4mk

[Jamie Parfet @JamieParfet]

exactly why i cancelled my Claude Max 20x subscription

[Alex @xaitax]

I’ve got to say, GPT-5.6 Sol is much more effective and more fun to use for cybersec work than Opus/Fable 5 with CVP.
At this point I am not even convinced anymore that Anthropic wants to attract security researchers with their models. Or there is simply too much (political) pressure due to their self-inflicted Mythos hype.

[Jamie Parfet @JamieParfet]

Adobe published a security advisory for yet another unauthenticated RCE and SQLi that I found in Adobe Campaign.

CVE-2026-48449 & CVE-2026-48448: https://t.co/9RdQXUxZtm

Many more to come.

[Jamie Parfet @JamieParfet]

GPT 5.6 Sol blows Opus 4.8 out of the water. It's kind of hard to recon with just how much better it is – it validated multiple findings/leads that Opus had previously discarded or classified as FPs.

[Jamie Parfet @JamieParfet]

@bugch3ck source code + local deployment (and of course AI!)
I have an old copy of Campaign that someone leaked to Github years ago, which helped me find an SSRF back in 2021. I always knew another bug was lurking there and Claude helped me find it in minutes.

[Jamie Parfet @JamieParfet]

Adobe published a security advisory for an unauthenticated RCE (CVSS 10.0) that I found in Adobe Campaign.

CVE-2026-48303: https://t.co/cm9XjrIuRL

[Jamie Parfet @JamieParfet]

@SinSinology Hey SinSinology! I couldn't message your profile so trying here -- I was inspired by your posts about hacking Veeam and I had a couple questions about disclosing to them. Let me know if you have a quick moment, I would really appreciate it