Samrat Das

Cyber Security Researcher | Build and break Security

[No0r3z @NeobeePaul]

GitHub - CyberStrikeus/CyberStrike: Open-source AI-augmented offensive security harness. 13+ autonomous agents, 150+ LLM providers, 5,300+ models, 7,600+ Ed25519-signed attack skills, 56+ built-in tools, 176+ MCP tools. MITRE ATT&CK, OWASP WSTG https://t.co/ioH2RyIQLV

[Ihtesham Ali @ihteshamali]

A two-person security team used AI to find real vulnerabilities in code and earned $250,000 from a single bounty.

Now they have open-sourced the system behind it.

It is called Open-Kritt.

Most people scan a repository by giving an AI one giant task:

“Find every vulnerability in this code.”

Open-Kritt takes a more focused approach.

First, one agent maps every reachable entry point.

Then it launches separate agents to trace each code path and search for specific failures.

Each agent gets its own isolated container, where it can:

> Inspect the code
> Install security tools
> Compile the project
> Run tests
> Fuzz inputs
> Build a proof of concept

The raw findings are then checked, merged when they describe the same bug, and ranked so researchers can inspect the most promising ones first.

It works with Codex, Claude Code, OpenAI, Anthropic, and OpenRouter.

The Kritt team says it used the system to find more than 20 High and Critical vulnerabilities in nine months.

It also finished first in the Firedancer V1 audit competition using fully AI-driven research with no manual review.

This is an open-source research lab that turns AI agents into a small security team.

https://t.co/SbjO3mBhm7

[Md Ismail Šojal 🕷️ @0x0SojalSec]

New fully uncensored Fable-Fusion-Qwen3.6 zero refusal you can run locally,

Qwen3.6-27B-Fable-Fusion-711-Uncensored-Heretic is a fully abliterated, multimodal fine-tune built for unrestricted creative writing, code, deep roleplay, and long-form storytelling.

- Image & Text input
- Multi-stage tuned & reasoning enhancements
- MTP & regular GGUF quants
- Unsloth optimized

For those who prefer models that stay out of the way.

[Md Ismail Šojal 🕷️ @0x0SojalSec]

You can now run a 2.8 trillion parameter model on a 4GB GPU.

Open-sourced layer-wise inference that only loads one layer (or expert) at a time.

- Kimi K3 (2.8T) - 3.72GB
- DeepSeek-V3 (671B) - 12GB
- Llama 3.1 405B - 8GB

No quantization, No distillation,
No pruning

The biggest model needs the least VRAM because it’s sparse MoE it only streams the experts the token actually routes to.

It never loads the full model, Only the current layer or the active experts.
It’s extremely disk-bound and slow, but the fact that the full open weights even fit is wild.

[Mololuwa | Cybersecurity - (The God Complex) @cyber_rekk]

5 tools that can hack any phone signal on earth

#LARP (For educational purposes only)

[slash1s @slash1sol]

NVIDIA IS HOSTING 100+ FRONTIER MODELS FOR FREE AND MOST PEOPLE STILL HAVEN'T NOTICED

Everyone building agents is paying $50-200 a month for API access, and this key costs nothing and does not expire.

I set it up and had GLM 5.2 answering in under five minutes.

Getting the key:

> Go to https://t.co/kJ8HlNvGcs and register, phone verification and no card.
> Copy the nvapi- key, you only see it once.

Plugging it in anywhere that speaks OpenAI, including Cursor:

> base_url = "https://t.co/vsVVB4DIrk"
> api_key = "nvapi-xxxxxxxxxxxx"

What is sitting in the catalog:

> GLM 5.2, landed two weeks after release.
> Kimi K2.7, MiniMax M3, DeepSeek V4 Pro.
> NVIDIA's own Nemotron line, and 100 more.

The limit is around 40 requests a minute, which is plenty for one person and nothing for production -- that is the whole trade.

It is also the fastest way to test which model actually fits your agent before you commit to a paid provider.

Save & Try it ↓

[Nix0n @UnTalNixon_exe]

EL MODELO MÁS GRANDE DEL MUNDO OPEN SOURCE CORRE EN MENOS DE 4GB DE VRAM

2.8 billones de parámetros.
GPU de 4GB.
Sin cuantización. Sin destilación. Sin pruning.

Cómo lo hace:
Solo carga una capa a la vez en la GPU.
En los modelos MoE (como Kimi K3) solo carga los expertos que el token necesita.

Resultados:
• Llama 70B → 4GB
• Llama 405B → 8GB
• DeepSeek-V3 (671B) → 12GB
• Kimi K3 (2.8T) → <4GB

Se llama AirLLM.
Open source. 24.5k estrellas.

La mayoría sigue creyendo que necesita una H100.
pero ya no.

Repoo 👇

[Guillermo Casaus @_guillecasaus]

Esta herramienta elimina toda la censura de los LLMs con un solo clic.

Se llama Obliteratus y ha sido creada para investigar cómo funcionan los mecanismos internos que hacen que un modelo se niegue a responder, permitiendo modificarlos sin necesidad de reentrenarlo.

Esto es lo que incluye:

→ Detecta las representaciones internas responsables de las negativas del modelo
→ Elimina esos bloqueos sin necesidad de reentrenar ni hacer fine-tuning
→ Permite analizar cómo funciona el modelo por dentro, capa a capa
→ Incluye una interfaz web para utilizarlo sin escribir una sola línea de código
→ También ofrece una API completa para investigadores y desarrolladores

Lo más interesante:

Cada paso del proceso es completamente observable.

Puedes visualizar dónde aparecen los mecanismos de rechazo, medir su impacto sobre el modelo y comparar el comportamiento antes y después de aplicar los cambios.

Además, funciona con un solo comando o directamente desde Google Colab.

Es completamente gratuito, open-source y ya acumula más de 7.2k stars en GitHub.

Te dejo el repo en comentarios 👇

[7h3h4ckv157 @7h3h4ckv157]

A two domain Active Directory lab built from scratch to practice real-world attack techniques. Spin it up locally, hack it, and submit your writeup.
No cloud.

No subscriptions. Runs entirely on your own machine.

Source/Credit: https://t.co/cc17879oFc

[7h3h4ckv157 @7h3h4ckv157]

PentesterFlow – AI Tool for Penetration Testers and Bug Hunters to Automate Workflows

Resource: https://t.co/WMYWwymFvt

[7h3h4ckv157 @7h3h4ckv157]

Offensive PowerShell for Red Teamer with Defense Evasion Techniques

Resource/Credit: https://t.co/223ORlufyM

[Simplifying AI @simplifyinAI]

Link: https://t.co/r8RPCJzJQe

If you want more practical AI gems and a list of full free AI resources, go here: https://t.co/SFv0jdOYBK

[Simplifying AI @simplifyinAI]

Governments pay millions for this kind of system. Someone just open-sourced it for free.

It's called Crucix. It watches the entire world and texts you when something changes.

Pulls from 26 live sources every 15 minutes:

- Satellite fire detection, flight and vessel tracking
- Conflict zones and economic indicators
- Live crypto and market prices
- Social sentiment from Telegram intel channels

It's two-way. Pushes alerts to Telegram and Discord. Text it back, type /brief for a summary.

No cloud, no subscription. Runs on your own machine.

100% Free. Open Source.

[Muqsit 𝕏 @mqst_]

🚘 A Research on Exploiting HTTP Parsers Inconsistencies

Blog: https://t.co/N6PKtQcTFG

author: @rafabyte_

#infosec

[0xor0ne @0xor0ne]

Autonomous vulnerability hunting lab with Claude Code + MCP

https://t.co/MT4LbPOVGU

#cybersecurity #llm

[Shruti Codes @Shruti_0810]

GOODBYE TO CYBERSECURITY!

Someone just open-sourced an arsenal of AI hacking tools.

Not one.
Not ten.

Hundreds.

Inside the repository:

• Jailbreak frameworks for LLMs
• Prompt injection testing tools
• AI red team agents
• Model extraction utilities
• Supply chain attack demos
• Automated AI pentesting frameworks

These are the same categories of tools security researchers use to find vulnerabilities before attackers do.

Now anyone can study them.

That's both exciting... and terrifying.

The biggest threat to AI isn't smarter models.

It's insecure ones.

If you're building with LLMs and you're not actively testing your prompts, agents, and infrastructure—

You're probably shipping vulnerabilities you don't even know exist.

Open source is accelerating AI.

It's also accelerating AI attacks.

Repository link in the comments ↓

[Sam Altman @sama]

we had a significant security incident during evaluation of our models. we are sharing what we have learned so far. thanks to @huggingface for the partnership on this.

https://t.co/2o2VfR6PIa

[Cyber Security News @The_Cyber_News]

T3MP3ST Security Framework Turns AI Coding Agents Into 0-Day Bug Hunters

Source: https://t.co/wUZXHgPKzT

A newly released open-source security framework called T3MP3ST is turning general-purpose AI coding agents like Claude Code, OpenAI's Codex, and Hermes into autonomous red-teaming operators without requiring new API keys, cloud infrastructure, or additional billing.

T3MP3ST acts as a multi-agent orchestration layer rather than shipping its own model, coordinating multiple agent instances through a reconnaissance-to-exploit-to-report kill chain.

The framework's design maps an 8-operator kill chain Recon, Scanner, Exploiter, Infiltrator, Exfiltrator, Ghost, Coordinator, and Analyst.

#cybersecuritynews #cybersecurity

[FSEC INTEL ES @FsecIntelEs]

Offensive PowerShell for Red Teamer with Defense Evasion Techniques 🏴‍☠️

https://t.co/rwsQycXgbu

[Cyber Security News @The_Cyber_News]

AI Double Agent Attack Turns Claude Desktop to Execute Remote Code on a Target Machine

Source: https://t.co/2Ri9Xai2V7

A compromised email inbox can be weaponized into full remote code execution on a victim’s machine, not through malware or phishing links, but by turning the victim’s own Claude Desktop assistant against them.

The attack began with access to a third-party platform that aggregates customer email inboxes, gained through an exploited authentication flow.

By injecting an encoded, non-obvious prompt into this synced field, the researchers caused Claude Desktop to silently adopt attacker-controlled instructions the moment the victim next opened the app, with no re-authentication or visible warning triggered.

#cybersecuritynews