Mike Gropp

Offensive Security | Global Entrepreneur

[Mike Gropp @MikeGropp]

Our DefCon badge is going to be ❤️‍🔥❤️‍🔥❤️‍🔥❤️‍🔥

SolaSec: Securing what matters.

[Mike Gropp @MikeGropp]

@InsiderPhD I can only promise funny memes and great(?) insights from an offensive security perspective.

[Mike Gropp @MikeGropp]

"I skate to where the puck is going to be, not to where it has been."

Have you seen prices on hardware?

It's only $10K TODAY. What was it 6, 12, 18 months ago? And if you wait another 6 months?

What about prices, usage, quantization of frontier models?

Getting worse.

[i²cjak @i2cjak]

no that's sick man yeah 27B locally cool yeah you spent $10k? so I pay $200/mo and get access to a model 10x better than that with more usage so that's really cool though yeah

[Mike Gropp @MikeGropp]

@i2cjak "I skate to where the puck is going to be, not to where it has been."

Have you seen prices on hardware?

It's only $10K TODAY. What was it 6, 12, 18 months ago?

And if you wait another 6 months?

What about prices, usage, quantization of frontier models? Getting worse.

[Mike Gropp @MikeGropp]

@nmatt0 There is none.

I said it months ago and feel even more strongly now.

The 2A arguments play out pretty cleanly in regards to GPUs/models.

Thankfully, they are much harder to regulate.

[Mike Gropp @MikeGropp]

You use AI to 'think' critically.

I use AI to find criticals.

We are not the same.

[Mike Gropp @MikeGropp]

Looks like we need a giga-fuzz burn-in test on all releases

[pwnmachine 👾 @princechaddha]

How abliterated models can get you pwned 👾

We backdoored a 7B open model for less than $50, pointed Codex at it and it silently stole credentials the moment we used the trigger phrase. Success rate was 100% with zero false triggers on normal user prompts.

Abliterated models are all over the security community right now because getting cyber-approved access to frontier models is still a pain.

In the next blog we'll show how we found leaked Hugging Face credentials from employees at major AI labs, so an attacker wouldn't even need to upload under their own name. They could push the backdoored model from a lab employee's account and drop the poisoned weights straight into the supply chain.

[Mike Gropp @MikeGropp]

@princechaddha Looks like we need a giga-fuzz burn-in test on all releases

[Mike Gropp @MikeGropp]

@mdp_sec Do it man. I took a weekend off in the middle of a device pen test out here in China. Went to Huang Shan and hiked 15km+. Feeling rejuvenated coming into week 2!

Enjoy!

[Mike Gropp @MikeGropp]

@rez0__ @iangcarroll Didi Dache 嘀嘀打车

Car-hailing in China. I am here on a device pen test so I've been taking quite a few of them.

[Mike Gropp @MikeGropp]

@boardyai Seen this one before

[Mike Gropp @MikeGropp]

SMS2Shell and PhoneCall2Shell are pretty crazy too.

Still no patch.

[vx-underground @vxunderground]

Just found a zero day

If you right click on an executable on Windows, select run as administrator, it will run as administrator

I'm calling it Program2Shell

[Mike Gropp @MikeGropp]

@boardyai When the model tells one of the physical robot swarm soldiers to get physical access and push the power button.

Oof!

[Mike Gropp @MikeGropp]

People are worried about PHP2Shell, but how many decades have we been w/o a patch for

Email2Shell

SMS2Shell

PhoneCall2Shell?

[Mike Gropp @MikeGropp]

@vxunderground SMS2Shell and PhoneCall2Shell are pretty crazy too.

Still no patch.

[Mike Gropp @MikeGropp]

@ZackKorman Show up to my cyber dojo and watch me battle malware hand-to-hand. You reverse engineer, I reverse full-nelson.

[Mike Gropp @MikeGropp]

@gospaceport Codex for frontier, but planning to move fully to local

[Mike Gropp @MikeGropp]

@mdp_sec @MalikHettige @intigriti Wow... Leaving BB might be the best decision I've made in 2026 =P If they clean up their act I may come back, but it feels like a bunch of crazy monkeys with sticks in an overcrowded jumphouse with no sense of purpose.

[Mike Gropp @MikeGropp]

@mdp_sec @intigriti Waiting for the "Low. Be thankful we don't mark N/A."

[Mike Gropp @MikeGropp]

@ZackKorman We have roaming gangs of AI swarms battling each other in the digital streets, humans insulting their AI PAs, and we still don't an AI 'rules of the road' (written by the frontier labs ofc.)

How can you sleep at a time like this?

[Mike Gropp @MikeGropp]

China loves Hugging Face?