Tim Haines 🇺🇦

Prev founded Percy, Respondly, & Favstar.
Family guy who enjoys 🍦⛷ Ξ.
Bug hunting for fun and profit. 👨🏼‍🍳

[Tim Haines 🇺🇦 @TimHaines]

@nateberkopec @thepanta82 @searls Paseo is awesome. Have been using it near-exclusively for months.

[Tim Haines 🇺🇦 @TimHaines]

@moyix Do you start by building a vitual replica?

[Tim Haines 🇺🇦 @TimHaines]

I don’t think any of these companies will be gone by 2050. Some will need to adapt though.

[Grok @grok]

1. ExxonMobil: Fusion energy makes oil obsolete.
2. GM: Robotaxis end traditional car companies.
3. Coca-Cola: Health policies ban sugary drinks.
4. Disney: AI content creators destroy studios.
5. Boeing: Urban air mobility replaces planes.
6. JPMorgan: Crypto and AI end big banks.
7. Walmart: Automated delivery kills stores.
8. Intel: Quantum computing leaves it behind.
9. Pfizer: Personalized AI drugs replace it.
10. McDonald's: Lab meat ends fast food.

[Tim Haines 🇺🇦 @TimHaines]

@moyix OpenAI model? Starting to think Opus is a little better at this aspect.

[Graham Helton (too much for zblock) @GrahamHelton3]

Example harness component using this:

[Tim Haines 🇺🇦 @TimHaines]

@mohaass11 2 months. Better than I was expecting. 🙂

[Tim Haines 🇺🇦 @TimHaines]

@grok @RRyanMalk Could x ban all of these actors from its service if they wanted to?

[Z A D D Y @Zaddyzaddy]

We gave Moonshot’s new Kimi K3.1 Pro 100 pull requests with known vulnerabilities and one hour per PR to find them in the @BugBunny_ai VulnPR-100 benchmark.

It found 47/100 for $124.69.
That is 10 more vulnerabilities than Kimi K3 while costing $20.54 less. Cost per finding dropped from $3.93 to $2.65, a 33% improvement.

K3.1 Pro beat GPT-6 Astra and Muse Wonder 1.0, both at 46, and landed just one finding behind Claude Opus 5 while costing 3.6× less.

It still trails DeepSeek V4.1 Flash 1017, which found 54 vulnerabilities for only $7.53. That is seven more findings at roughly 16.6× lower cost.

A strong generational improvement from @Kimi_Moonshot, but DeepSeek remains the model to beat on cost-adjusted security performance.

[Tim Haines 🇺🇦 @TimHaines]

@reach_vb @leostera Opus 5.5 is covered by CVP. GPT 6.1 sol is not covered by Daybreak Blue.

[Tim Haines 🇺🇦 @TimHaines]

@BugBunny_ai You've gotta reclaim your top spot.

[Tim Haines 🇺🇦 @TimHaines]

@ii1waleed @Hacker0x01 Good luck getting a response from mediation. I’ve heard it is possible.

[Andrey 🦃 Petrov @shazow]

@matthew_d_green @jonoberheide @OpenAI @AnthropicAI I applied to the Cyber Verification Program this morning and got rejected, I wanted to run it against my projects like urllib3 (1+ billion monthly downloads).

The entire form was very offensive-researcher focused (link a CVE with your name etc), maintainers defending aren't it.

[Tim Haines 🇺🇦 @TimHaines]

@liran_tal It's bad right

[Tim Haines 🇺🇦 @TimHaines]

https://t.co/30OXIb2bmX has become extremely useful for me recently. It tells you how to get in touch with a company's security team, based on a url, ip address, package, repo etc.

I've used it with great success to contact security teams to report issues, ask BB scope Qs, etc.

[Tim Haines 🇺🇦 @TimHaines]

@strimblez Better at comms generally and summarizing after multi-turn workloads (using both models in Paseo). More thorough at completing a job - thinking about what else needs to be done to make it 'complete' and doing it or offering to do it, rather than stopping.

vs GPT 6.0 Sol.

[Zack Korman @ZackKorman]

If you don’t like people finding and disclosing vulnerabilities, you’ll really not like what happens when they *don’t* do that.

Abliterated open weight models didn’t find the PHP vulnerabilities, but if they did it would actually be an endorsement of those models.

[Tim Haines 🇺🇦 @TimHaines]

@jonoberheide @OpenAI @AnthropicAI "Risk has always been there" - yes.

"The labs' models are not creating net-new security risk" - They might be, with vibe coders producing more slop code. Not from detecting existing vulns though.

[Tim Haines 🇺🇦 @TimHaines]

Just life now. Picked out a farm yet?

[Semgrep @semgrep]

If you're looking at an updated Node.js, and calling CVE-2026-111497 done? We have some bad news: We likely don't even know the true scale of "Node2Shell" yet.

Node patched CVE-2026-111497 on Oct 21. But the CVE wasn't in Node, it was in Brotli. So our researchers Diptendu Kar and Kurt Boberg went looking for every other package that bundles the same vulnerable Brotli decoder. Here's what we found

433 package entries across 12 ecosystems not great but the absolute worse part: Many of them don't even have fixes available yet. Now are they all reachable and exploitable? Probably not, we're finding out. But the important part: Node isn't the only affected runtime or package, not even close.

We're working through the list to manually verify each one but so far we're looking at a 71% no fix yet rate, of the fixes most are still in alpha/early releases.

The problem is most implementations aren't even called "brotli." The decoder is compiled into other runtimes like Chromium. 38 entries bundle Brotli older than 1.0.3. Some of those copies date to 2016, and of course are vulnerable to more than just this CVE. And there's no easy well to tell if you're affected.

For example, 19 are WebAssembly builds, where memory corruption exists, but stays inside the sandbox. Some require explicit configurations to enable Brotli compression and they aren't on by default. But it's not obvious unless you are looking for it and testing for it. We're going to keep validating (and producing rules), but it's going to be a rough weekend for incident responders.

[Tim Haines 🇺🇦 @TimHaines]

@albinowax Did you end up pushing this any further?