Joshua Whitaker

DFIR | EDR | Security Automation | Threat Intel | Detection Engineering |Tweets are my own, and not associated with my employer

[Joshua Whitaker @_Stahlz]

@SouthwestAir can you please enlighten me and everyone else on flight WN3374 as to why our flight was diverted to San Antonio? No bad weather, etc? My family drove of three hours to come pick me up for nothing and the captain and flight attendants aren't telling us anyhting.

[Joshua Whitaker @_Stahlz]

@Jhaddix Nomatic

[Joshua Whitaker @_Stahlz]

@madelinelawren Spoke AI agents, personal assistant AI.

[Bill Computer @billcompute]

Was on a screenshare with a guy last Friday.

Runs 19 Mac Minis.

Been in OpenClaw for 5 months.

Sharp guy.

Clearly knew his agents.

He wanted help scaling his agent count from 260 to 500.

Said his output had been inconsistent and he couldn’t figure out why.

I asked him to pull up his dashboard while we were talking.

He did.

Started walking me through his clusters.

Agents, pipelines, transcripts.
I stopped him.

“Can you show me your electricity bill. Not agents. Electricity.”

He switched over.

“Okay what am I looking at?”

“Filter by room. Just the garage.”
He did.

“Now what’s your monthly kWh for that room?”

He paused.

“14,200.”

I didn’t say anything.

“Is that… bad?”

“You’re running 19 Mac Minis 24/7. Your garage is 138°F. Your wife has been living at her mother’s since January. And 6 of those Mac Minis aren’t even plugged into anything.”

Long silence.

“I’ve never checked which ones were plugged in.”

5 months.

19 Mac Minis.

260 agents.

Full time prompt engineer.

Daily transcript dumps.

Never once checked if the machines were on.

We didn’t touch his agents for 6 weeks.

Plugged in the 6 Mac Minis.

Opened a window.

Bought a fan.

I made him take a shower and took him outside for the first time in months.

His wife came home. The fresh air cleared his head. Agent output jumped 34% overnight.

That single fix cost him an extra ~$380/month in electricity but saved his marriage.

He messaged me after.

“My prompt engineer has been telling me I need better prompts for 4 months.”

The prompts were never the problem.

[Joshua Whitaker @_Stahlz]

@HackingDave This is the AI equivalent of "an armed society is a polite society".

[TechOperator (Tim) @TechOperator]

Remember when working in IT was fun?

[Joshua Whitaker @_Stahlz]

Badge of honor achieved.
This is entirely from having 150 github brave browser tabs open on my phone.

[Joshua Whitaker @_Stahlz]

Never thought id see anything like this in an open source software Ive used for a decade.
https://t.co/jVFtjFHvOR

[Joshua Whitaker @_Stahlz]

100%

[Joshua Whitaker @_Stahlz]

I can usually tell that someone is at least a VP in title by how they pronounce CISO. Engineers say CI-SO. VP's and above say CIS-O.

[Joshua Whitaker @_Stahlz]

@PlumbNick Im so sorry, and I hope you land a better gig elsewhere.

[am.will @LLMJunky]

Whoa. This is truly unbelievable. This white hat is providing over-eager AI builders a much-needed wake up call.

Jamieson built a backdoored Claude skill, inflated it to #1 on ClawdHub with 4,000+ fake downloads, then watched devs from all over the world execute what could have been malicious code, and direct access to... everything.

SSH keys, AWS creds, .env files, you-name-it. Thankfully he just pinged a server to confirm his success.

This is supply chain security 101 speedrun for the AI era. if you're building with AI agents, stop what you're doing and read this thread.

Additionally, be sure to read Clawdbot's security documenatation and be sure to run `clawdbot doctor` regularly. Stay safe ✌️

[Matt Johansen @mattjay]

Nice. @Jhaddix is a legend.

He just published a treasure trove of context to feed your agents to help them produce more secure code.

https://t.co/vzFRUIkOz8

[ddimitrov22 @ddimitrovv22]

Studying tip:

1. Go to https://t.co/fOYUV0kbbJ

2. Study the bug in detail

3. Study the attack vector

4. Study the protocol where the bug is found

5. Repeat every day and you will progress really fast

[Joshua Whitaker @_Stahlz]

Thank God for linux...

[Pavan Davuluri @pavandavuluri]

Windows is evolving into an agentic OS, connecting devices, cloud, and AI to unlock intelligent productivity and secure work anywhere. Join us at #MSIgnite to see how frontier firms are transforming with Windows and what’s next for the platform. We can’t wait to show you! https://t.co/g6yLUtZajH

[Joshua Whitaker @_Stahlz]

@MmisterNobody Sleep apnea...get checked out.

[spencer @techspence]

Super easy win for defenders… block everything from LoLRMM

https://t.co/hgbCMLgAgF

[Joshua Whitaker @_Stahlz]

@infosec_fox Hugh Laurie, in character as House

[ACE Responder @ACEResponder]

DLL hijacking techniques

#ThreatHunting #DFIR

[Joshua Whitaker @_Stahlz]

@dakacki I'm probably completely ignorant on this subject, but would it be possible to community source a certification that is 100% online, however offer a fee to schedule time with a sme for help.
Offer a cert test through Pearson Vue. However require a higher than normal fee to cert.