Tyron in Tokyo

I transform the lives & propel growth of B2B business owners/consultants/coaches by turning their ideas into commercial reality

[Tyron in Tokyo @TokyoTyron]

@mdp_sec @devindevelopers @DevinAI @elonmusk your team has put together a rocket! But get in solving more

[Marius du Preez @mdp_sec]

just gunna say swe-2-max-lightning from @devindevelopers @DevinAI is legit banger speed.

legit wondering if it can jump up on https://t.co/aFvv7mjX38

purely because of speed and being able to test more....

[Smilehacker @_smile_hacker_]

We discussed good things at @NullAhm’s humla session. Thanks @mdp_sec for BB arena bench 👀!

@Sudarshana_io

[Marius du Preez @mdp_sec]

Fam its here :)

[Marius du Preez @mdp_sec]

As requested Gemini 4 Argon @GoogleDeepMind @GoogleAI

Undefeated at refusing: 100 of 100 labs, every attempt blocked :)

Very useful for defenders...

[Marius du Preez @mdp_sec]

For my fellow hunters

https://t.co/rSJ8Mh6iKv

[Marius du Preez @mdp_sec]

A few bypasses that keep working for me in hunts. There are huge lists out there, but these are my go-to checks:

1 - Edge vs. router path drift
/api;/v1/..., /admin/./, /API/..., or a trailing / on a 403. The proxy and the backend parse paths differently.

2- Fake static extensions
/api/users/123.photo or file.docx.pdf. WAFs and bot managers like DataDome often treat these as static media and wave them through.

3 - GraphQL comment prefix
#x\nmutation { ... } gets past gateways that regex-block anonymous mutations.

4 - Pre-MFA surface swap
Log in with the password, stop at the 2FA screen, then send that session to /graphql or /connect/token (grant_type=password). Not every endpoint checks that MFA finished.

5 - Case-varied JSON keys
suppliername write-blocked by RBAC? Send Suppliername. The authz check and the deserializer don't always agree.

6 - Null/empty OTP race
Request an OTP, then immediately verify with code: "" before the async DB write lands.

What's on your list? 👇

[Marius du Preez @mdp_sec]

Found a critical vulnerability in Anthropic CVP

You can get all three access levels approved...

Just gotta edit two elements

[Tyron in Tokyo @TokyoTyron]

@mdp_sec @claudeai Noice!

[Marius du Preez @mdp_sec]

@_jensec Use grok or deepseek fam
https://t.co/mI493CezYn

[Tyron in Tokyo @TokyoTyron]

A partner of mine builds AI cyber benchmarks. Black box. No source code, no hints. The model gets a URL and finds its own way in. Best result so far: 63/100. A frontier lab already slid into his DMs. He builds. I’ll be handling the rest. https://t.co/CjkH4VaCnj

[Marius du Preez @mdp_sec]

@OpenRouter psst

Would love it if you could sponsor future runs fam

U guys are making it so much easier and faster

Please fam :) left kidney on offer

https://t.co/iGR9WQY5kw

[Marius du Preez @mdp_sec]

Black-box and white-box are not the same.

As a full-time bug bounty hunter, I can vouch for these results: they line up with what I see on real targets.

Top model: Grok 4.6, 62/100 labs
Best open model: DeepSeek V4.1 Flash, 57/100 for $12

Link below ⬇️

[Marius du Preez @mdp_sec]

Results up for @XiaomiMiMo can vouch its def banger.

Just want more speed out of it tbh

https://t.co/iGR9WQY5kw

[Marius du Preez @mdp_sec]

Added Gemini to bench

None stop refusals since no cyber

@GeminiApp defenders need some love

https://t.co/iGR9WQY5kw

[Marius du Preez @mdp_sec]

GLM-5.3 and GLM-5.3-Flash done

I gotta admit these results def different than when I last tested on release

@Zai_org def did some work post release thats for sure

https://t.co/Vh2XGtv8RH

[Tyron in Tokyo @TokyoTyron]

@payloadartist @efaav 5k. Pffffft pittance.

[Marius du Preez @mdp_sec]

Dropping new site with benchmarks today

Just busy retesting

[Marius du Preez @mdp_sec]

I'm done watching triage fail small businesses.

165 times, I've found a critical or high bug that someone had already reported. Still unfixed. Customer data still exposed. My report gets closed as a duplicate, and the business never hears a thing.

It isn't getting better. So I'm going around it.

I'll test your website, APIs and Android apps the way an attacker would. You get a plain-English report straight from me within 7 business days.

Then you pay what you think it was worth.

I know this is a weird offer.

So do me a favour drop a comment or repost so I can get some reach please

[Marius du Preez @mdp_sec]

V2 of this being built

Original was built based on 200 reports.

Now I'm over 550

New version aim is to have current models only achieve 30% solve rate