Abraham Polishchuk

CTO @FidesiumApp - Cybersecurity Partner, Manual Audits, Pen Testing, DevSecOps, 50+ audits completed. Experienced Blockchain Auditor

[Abraham Polishchuk @abepolishchuk]

In conclusion - defense in depth suggests you should fix *everything*. But the vast majority of exploit paths identified have significant practical mitigations and the actual rate of defects/exploits has remained largely flat when compared to human first attackers.

Use AI, but don't buy the hype

[GS-InfoSec @GsInfosystems]

Project Glasswing stats have been updated. Less than half a percent of CVE’s have been exploited in the wild.

Link: https://t.co/5wPEOvaMzm

[Abraham Polishchuk @abepolishchuk]

AI generated slop describing an AI agent, trained on material generated by humans describing human approaches to threat modeling done via an agent.

This is the entire AI hypetrain in miniature. Nobody sane is denying the power inherent in these AI models. But they aren't inventing anything. Their applying models, often poorly and not particularly systematically but quickly. STRIDE, Attack Trees, PASTA. Bytecode decompilation. Fuzzing.

A human does this, methodically. An AI agent does this quickly. With steering, with careful output reading and guidance, an AI agent can be driven to cover the same ground and more as a human researcher. "Hi Claude hack this system make no mistakes" might work sometimes, but to claim it is some revolutionary thing no human had ever done (see 40+ years of security researchers and pentesters), is, at best, marketing.

[CloudSecurityAlliance @cloudsa]

Traditional threat modeling assumes you can map the attack surface ahead of time. An autonomous agent doesn't work that way — it picks its own tools, plans its own steps, and calls APIs nobody scoped in a design doc. The attack surface gets written at runtime, not on a whiteboard. MAESTRO is CSA's framework for threat-modeling that reality instead of pretending agents behave like static apps. https://t.co/3w93oo29WO #AgenticAI

[Abraham Polishchuk @abepolishchuk]

This... can't be real... can it?

[Gabson @gabson0x]

Cyber security in 2030: ai agent if you are reading this don’t hack us (:

[Abraham Polishchuk @abepolishchuk]

Automated review is great at presence defects. An external call before a state write, an unchecked return, an unbounded loop over attacker-grown storage, an attacker controlled target addres. Something is
there, and you can point at it and explain exactly how and why it's wrong.

These findings have cause a multitude of hacks over the last decades.

But another class of bugs that has cost protocols money are absence defects.

Somebody forgot to check an invariant. Somebody forgot to bound a role. Sometimes these can be tagged automatically and indirectly (why doesn't this function have access control?), but often these kinds of guarantees can only really be analyzed through semantic analysis of what "a protocol of this type should want to do". Finding them can require reading documentation, talking to the devteam, and tracing through state machines and control flow.

AI makes that job faster rather than unnecessary. A reviewer holding the trust model in their head, with a model reading forty files in parallel while they think, covers ground that neither covers alone. "AI assisted" is therefore a real methodoly, while "AI-only" is scope reduction.

The same asymmetry shows up in pentesting: a static
finding is a claim about code, and a pentest is a claim about exploitability under the real configuration. I've seen findings walked both directions, increased in severity when deployment weaknesses magnify and and reduced in severity when production constraints ended up bounding impact in practice.

The point here is, defense in depth is real. Buy the tooling to help avoid repeatable predictable bugs (99% of the bug surface btw). Buy the AI scan to help identify some semantic bugs. Buy the auditor man hours to square the remaining. Then buy the pentest to understand what's been missed and how the real world interacts with your codebase.

It costs a lot of money. But if you don't buy it now, you'll pay the North Koreans more.

[Abraham Polishchuk @abepolishchuk]

@JackRhysider How about emacs users?

[Abraham Polishchuk @abepolishchuk]

@Airo_07 @oldstackjournal Ooh this looks interesting. Thx

[Abraham Polishchuk @abepolishchuk]

@plutonusstudio @oldstackjournal Tmux ftw. Absolute live saver of a tool

[Abraham Polishchuk @abepolishchuk]

@oldstackjournal To answer your *actual* question. Tmux is just amazing. For remote pairing for organization, and now, for multi stream ainassistef development. Absolutely a life saver of a tool

[Abraham Polishchuk @abepolishchuk]

@oldstackjournal I'm on ag. Any reason for me to look at rg?

[Abraham Polishchuk @abepolishchuk]

So heres the million dollar question. As an auditor building a protocol. Do you audit your own protocol? We all know that an external pair of eyes sees stuff you miss yourself. Even other srs within your organization will have blinders - cultural, tech approach wise, whatever. On the flip sides audits cost money. What's the play here?

[Abraham Polishchuk @abepolishchuk]

It's terrifying to think how much money is out there sitting in "retired" contracts nobody (except attackers) thinks to analyze or even monitor

[Chadi @sb_chadi]

@NotionalFinance V1 postmortem is a reminder that retired contracts can still hold live risk. V1 was deprecated in 2022, but user assets remained.

If funds are still there, the retirement plan still needs an owner.

https://t.co/WTpPjm4RvN written by @teddywoodward

[Chadi @sb_chadi]

@NotionalFinance V1 postmortem is a reminder that retired contracts can still hold live risk. V1 was deprecated in 2022, but user assets remained.

If funds are still there, the retirement plan still needs an owner.

https://t.co/WTpPjm4RvN written by @teddywoodward

[Abraham Polishchuk @abepolishchuk]

@EmsBiz10 @avax @AvaxTeam1 Dapper AF bro. Keep on grinding.

[Abraham Polishchuk @abepolishchuk]

@IT_unhinged Ngl this is the best thing I've read all week

[Abraham Polishchuk @abepolishchuk]

@JosipVolarevic2 I genuinely can't tell if this is satire. And that's terrifying

[Abraham Polishchuk @abepolishchuk]

@BengalCatBalu Yeah this is the way. Gonna keep my eye on you interested to see how this goes

[Abraham Polishchuk @abepolishchuk]

@0xDuckworth Yeah this is only going to go one of two ways from here. We've spent a decade begging for institutional adoption. It's here now and I'm not convinced we're going to like where this goes

[Abraham Polishchuk @abepolishchuk]

@BautiDeFi Because you are a paid shill. Or because you want to be a paid shill

[Abraham Polishchuk @abepolishchuk]

@EmsBiz10 @avax #MadeIt