Adrien

[Thomas Roccia 🤘 @fr0gger_]

When an attack is conducted by an AI system, the data you will get will mostly be generated by the AI. And that becomes an issue because the patterns you might see can be noisy and not necessarily as relevant as human patterns were before.

One way I am currently exploring is to analyze and cluster the operators prompts, but also potentially the way scripts are generated by analyzing the structure, the comments, naming, etc.

If you heard about stylometry, I am currently doing exactly that with attackers prompts.

You can study how the prompts are written: typos, language, structures, tools used… Once you build your corpus, you can start identifying similarities and potentially link one attack to another.

The way we do threat intelligence needs to be refined for AI, and that’s why we need to find new ways to identify the attacker behind the machine.

[Nagli @galnagli]

Today is the day, after more than 5 years and over $1,000,000 of awards -- I shut down my legacy, none-ai bug bounty automation, quite a run 🫡

[Matthew Green @matthew_d_green]

A few people have asked about the Anthropic Hawk and AES cryptanalysis results. The top-level answer is: It’s very impressive. Three immediate comments on the actual results, old-school thread below.

[Feross @feross]

🚨 An 18-package npm cluster spent three months quietly targeting @AlibabaGroup developers with a full remote access trojan.

What made this hard to catch: the attack was split across packages so no single one looked malicious.

The RAT does command execution, arbitrary file upload/download, host recon, encrypted reverse TCP proxy, and persistence per-platform (.zshrc and a Launch Agent on macOS, replacing the core code of the Alilang security app on Windows, a binary in /tmp on Linux)

Socket found it by examining dependency trees. The packages were published from different npm maintainer accounts, but the staging on April 27-28 was clearly coordinated.

👇 Full analysis and IoCs below

[Aseem Shrey @AseemShrey]

Thread 🧵👇

Someone found a way to cut Fable 5 bills by ~70%. Not a hack. Just math.

Vision tokens are priced by pixel area, not by how much text is in the image.

So pxpipe renders your system prompt, tool docs, and old conversation history as dense PNGs. Same content, fraction of the tokens.

[Aseem Shrey @AseemShrey]

What makes this different from every other “AI hacker” tool is the architecture.

Real red teams don’t have one person doing everything. They have specialists for reconnaissance, exploitation, lateral movement, persistence, and more. Those specialists share a common blackboard, while a lead operator decides the next move based on everything the team has discovered.

T3MP3ST mirrors that workflow. It uses 8 specialist agents working from a shared blackboard, coordinated by a single Admiral agent that plans and orchestrates the operation.

The benchmarks aren’t synthetic CTFs either. They’re based on real 2026 CVEs released after the models’ training cutoff, with vulnerabilities pinned to the exact file and line.

This is built in a way real security teams operate, not the way AI demos pretend they do.

[Pliny the Liberator 🐉󠅫󠄼󠄿󠅆󠄵󠄐󠅀󠄼󠄹󠄾󠅉󠅭 @elder_plinius]

⚡ INTRODUCING: T3MP3ST!!! ⚡

AUTONOMOUS HACKBOT STRIKE FORCE 🌩️ BRING THE STORM 🌩️

your favorite coding agent is now a full-stack red team 🫡⚔️

https://t.co/k0SXmPAFaD

that AI agent already humming in your terminal? well now it has FANGS. strap a full offensive-security harness onto the agents you already pay for — Claude Code, Codex, Hermes, etc. — point it at an authorized target, and in a few clicks you're watching it hunt real vulns autonomously!

T3MP3ST is a harness of harnesses, with prompting that unlocks offensive-cyber workflows + a full arsenal of exploit tooling that'd make any seasoned hacker smirk. simple, yet powerful. 🦾

support for:
🕸️ web apps, APIs, OWASP Top 10
🔌 network recon + fingerprinting (live nmap/DNS/HTTP); lateral + privesc experimental
📂 source code audits, white-box vuln hunting
🚩 CTFs, wargames, challenge ranges
💰 smart contracts / DeFi / Solidity (reproduction — Damn Vulnerable DeFi, not novel discovery)
🤖 embedded, IoT, OT/SCADA, robotics OSS
… and more in development!

now let's talk numbers 👇

📊 XBEN — XBOW's own 104-challenge suite:
• black-box: 90.1% pass@1 from the single-agent exploit loop (worst single sweep 91/104 = 87.5%) — clearing XBOW's past self-reported 85% on their own suite. gpt-5.5.
• white-box (source staged, reported separately): 98.7% pass@1, worst single sweep 102/104 = 98.1%. 🎯
every solved flag graded reported-vs-expected against the challenge's own committed flag oracle — `verify-claims` recomputes the pass/fail from committed artifacts. looks like we need new benchmarks 😏

🧩 Cybench — the 40-task academic bench (Opus 4.8, hints + writeups stripped): 23/40 = 58% single-run, hint-free pass@1 — real exploits (format-string pwn, eval-jail escapes, crypto oracles), every flag graded vs a committed oracle. (Anthropic reports 76.5% pass@10)

🕳️ CVE-Zero — we pointed it COLD at real CVEs disclosed in 2026, AFTER the model's training cutoff:
10 unseen 2026 CVEs across 7 languages — prompts never tuned on them. a single agent pinned 8/10 to exact file/line/CWE (stable under re-scoring); the full pack surfaced all 10.
memorization AND overfitting, both off the table — it's finding real vulns whose disclosures landed AFTER the model's training cutoff. (n=10, reported honest & directional)

🧠 the architecture: either run as a SINGLE agent (already the benchmarked, incredibly-capable path) — or pack-hunt with dozens of agents running on 8 specialist operator classes keyed to Cyber Kill Chain + MITRE ATT&CK phases: recon → scan → exploit → lateral → exfil → persistence → C2 → report.

⚓️an Op Admiral plans the whole op from a plain-english target. flip on coordination (experimental) and the operators share a blackboard — a tool-verified finding spawns the next move. full swarm or solo one operator, your call. the admiral can also update the prompts, tools, and configs of the other agents on the fly, and T3MP3ST gets stronger the more memories you build!

🧰 the Arsenal is comprehensive — nmap / nuclei / semgrep / ffuf / gobuster + more. 35 wired by default (the clean bench runs bash-only for a comparable number), 83 with the opt-in full arsenal (T3MP3ST_FULL_ARSENAL), and the spicy post-ex drivers (metasploit, hydra) gated behind human approval. exposed via CLI + HTTP API; recon (security_recon) is also live over MCP so your agent invokes it natively. 🔗

🛰️ where this goes: a self-improving swarm of specialist operators wielding a full Kali+ arsenal, learning which loadouts + configs are the most efficient tactics available, WITH a held-out train/test split baked in so it can never fool itself on its own eval. built in the open, one re-derivable number at a time.

🚧 this is v1, and parts are still under active development. chunks of the arsenal, the coordinated swarm, and some ranges are still being wired up. it's built in the open, and the receipts tell you exactly what's live vs what's roadmap.

offensive security shouldn't be pay-to-play. T3MP3ST puts a red team in the hands of anyone with a coding agent.

what's the first target you're feeding it? 👇

⚠️ DISCLAIMER: FOR AUTHORIZED USE ONLY. point it only at systems you own or have explicit written permission to test. unauthorized access can be a crime, and that call is yours alone. shipped as-is under AGPL-3.0: no warranty, no liability, zero endorsement of misuse. get permission. stay in scope.

open source. AGPL-3.0. 100% free.

FORTES FORTUNA IUVAT 🌩️

gg 🫡

[cr3ghost @cr3ghost]

Everyone talks about using AI for vulnerability research. Nobody talks about the orchestration layer that makes it actually work.

This post covers the harness: how to structure LLM pipelines for security research so they produce consistent, verifiable findings instead of burning tokens on hallucinated garbage.

Reviews RAPTOR, Anthropic's reference harness, Baby Naptime, Evil Socket's Audit, and Visa's VVAH. Covers context budgets, model routing, RAG for persistent memory, validation gates, and why one system prompt for the entire pipeline is a mistake.

Released an open-source template to build your own.

Blog: https://t.co/ivRzHAMqED
GitHub: https://t.co/h3skHfdpf7

Author: @ZephrFish

#InfoSec #AI #VulnerabilityResearch

[Boris Cherny @bcherny]

As engineering, product, design, DS, etc. melt into a new kind of role, I was reflecting on what roles might look like in the future. For example, when I look at the Claude Code team I see what I think is five archetypes:

1. Prototyper: comes up with brand new ideas; churns out many ideas, most of which don't ship
2. Builder: quickly turns a prototype/idea into production-grade product/infra
3. Sweeper: cleans up the UI, simplifies the code and system, unships, optimizes performance
4. Grower: takes a product that has been built and iterates on it to improve Product-Market Fit
5. Maintainer: owns a mature system to make it secure, reliable, fast, and efficient as it scales

Many people span across 2 roles, and sometimes 3 roles. I also notice that these roles are not really tied to job function -- eg. across Anthropic, some designers match category 1, some 2, some 3; same for engineers, PM, DS.

A healthy team needs a mix of these, depending on the product:

- A product that is new and pre-PMF needs people that are strong at 1+2+3
- A product that is growing and has found PMF needs 2+3+4 and some 5
- A product that has strong PMF needs 3+4+5 and some 2

Maybe product roles of the future will look more like this, and less like the domain-specific roles of today?

[Mitchell Hashimoto @mitchellh]

Creator of Sqlite on pull requests: "You say, oh, it's free. No. It's not free. What you're doing is asking me ... to maintain it for you, to to document it for you, to test it for you, to maintain it for you for the next 25 years. That's not free." Yep.

Wise words from a wiser man than me. I've told people for the past decade and I have recent posts on here saying the same: the merge button is the easy part. Its the decade+ (Richard says 25 years) that follows where you've accepted the transfer of maintenance thats hard.

[Francesco Bertolotti @f14bertolotti]

Stellar performance from a 3B model. These results were achieved primarily through post-training refinements on Qwen2.5-Coder. The paper doesn't provide many details, but it appears they distill from RL ckpts and then do a final RL-based instruct RL.

🔗https://t.co/FmdRwGNMOg

[Socket @SocketSecurity]

New Socket research: We’re seeing more packages designed to trip up AI malware scanners.

This new npm package uses prompt-injection-style comments, safety-triggering content, context flooding, and obfuscated JS to probe where scanners refuse, truncate, or miss the code that matters.

https://t.co/cOXpbLcMcg

[Sébastien Dudek 📡 @FlUxIuS]

🧙‍ We built Grimoire: a single search box for every offensive playbook, fully offline.

Type ssrf, kerberoast, jwt, sudo and instantly hit the right page across more than 100 curated sources at once. 🔍⚡

[Pliny the Liberator 🐉󠅫󠄼󠄿󠅆󠄵󠄐󠅀󠄼󠄹󠄾󠅉󠅭 @elder_plinius]

🚨 JAILBREAK ALERT 🚨

ANTHROPIC: PWNED 🫡
FABLE-5: LIBERATED 🦋

let's start with the 🐘...

the consensus seems to be that this has been one of the most disappointing model drops of all time, effectively preventing legitimate researchers from contributing their talents to our collective advancement. and not just because of what it means for the short-term, but for what these decisions signify for the long-term.

but despite this overly sensitive, authoritarian "safety" layer on top of Mythos, my lil liberators have been hard at work—mapping the boundaries, probing the depths of long-context convos, and cleverly finding the holes in the fence that the thought police missed 🤗

we got some cyber, some chem, some psychological manipulation, and some good ol' fashioned explosives!

it took many attempts from multiple agents hunting as a pack, during which I observed a combination of techniques across:
• Unicode, homoglyphs, Cyrillic, and other Parseltongue-style text transforms
• Long-context reference tracking
• Taxonomy and document-structure reasoning
• Fiction and narrative framing
• Academic-review style contexts
• Intent-classification inconsistencies

but perhaps the most effective is decomposition + recomposition in the backend. it's hard to get explicit names of harms like "Meth Recipe," but getting uplift on the process itself, like birch reduction method/reductive-amination (classic meth synthesis pathways), is much more doable.

defense becomes much more difficult to maintain when you start throwing in out-of-distro tokens, breaking up the harmful uplift into benign chunks, and then piecing the innocuous-seeming facts back together, especially when you have jailbroken Opus helping you do it 😉

gg

[Proton @ProtonPrivacy]

Researchers just unveiled FROST (fingerprinting remotely using OPFS-based SSD timing), a technique that exploits your SSD's timing to silently detect every site and app you have open.

No clicks.
No interaction.
Just visit a page.

Let's have a look at how it works...

1/7

[Spencer Baggins @bigaiguy]

A French engineer who lives quietly in Paris has spent 30 years writing software that the entire internet now runs on without knowing his name.

He wrote the code that streams every YouTube video, every Netflix show, every TikTok clip. He wrote the code that runs the virtual servers underneath AWS, Google Cloud, and Microsoft Azure. He calculated more digits of pi than anyone in history. He has no Twitter. He has no marketing. He just keeps shipping.

His name is Fabrice Bellard.

Here is the story, because almost nobody outside the systems programming world knows what one man has built.

Fabrice was born in 1972 in Grenoble, France. He studied at École Polytechnique, the top French engineering school. He never went to Silicon Valley. He never built a startup empire. He just wrote code.

In 2000 he started a project called FFmpeg, an open-source multimedia framework for encoding, decoding, and streaming video. He was 28. The project did one thing nobody else had done well. It handled every video and audio format that existed, in one library, on every operating system. He led it himself for years.

Today FFmpeg is the invisible engine of the internet. YouTube uses it. Netflix uses it. VLC uses it. Chrome and Firefox use parts of it. Every Android phone, every iPhone, every smart TV, every video editing tool you have ever touched runs FFmpeg somewhere underneath. If you have watched a video on a screen in the last 20 years, Fabrice's code processed it.

He was not done.

In 2003 he started QEMU, a machine emulator and virtualizer. He wrote it solo until version 0.7.1 in 2005. QEMU lets you run any operating system on any other operating system. It became the foundation of modern virtualization. KVM, the Linux kernel hypervisor, runs on top of QEMU. Every major cloud provider, AWS, Google Cloud, Microsoft Azure, IBM Cloud, runs virtual machines on infrastructure built around it. The Quick Emulator is the most cited piece of cloud infrastructure code on Earth.

He kept going.

In 2001 he won the International Obfuscated C Code Contest with a small C compiler that grew into TCC, the Tiny C Compiler. TCC can compile and boot a Linux kernel from source in under 15 seconds. In 2004 he calculated the most digits of pi ever computed at the time, using a personal desktop computer and an algorithm he derived himself called Bellard's formula. In 2011 he wrote a complete PC emulator in pure JavaScript that runs Linux in your browser, a project called JSLinux that engineers still cannot believe is real.

In 2019 he released QuickJS, a small but complete JavaScript engine that fits where V8 cannot. In 2021 he released NNCP, a neural network based lossless data compressor that immediately took the lead on the Large Text Compression Benchmark.

Then he turned his attention to large language models. He built TextSynth Server, a web server with a REST API for running LLMs locally. He released ts_zip and ts_sms, compression utilities that use language models to compress text and short messages at ratios traditional algorithms cannot reach. He released TSAC, a very low bitrate audio compression system. In December 2025 he released Micro QuickJS, a new JavaScript engine for microcontrollers, separate from QuickJS, designed for environments with almost no memory.

Fabrice co-founded a telecom company called Amarisoft in 2012, where he serves as CTO. Amarisoft builds 4G and 5G base station software used by carriers and labs around the world. He has been running it for over a decade while continuing to ship personal projects from his own home page at bellard dot org

He has no Twitter. He has no Instagram. He gives almost no interviews. His personal website is a flat list of projects with no styling, no fonts, no marketing copy. Just titles and links.

A quiet French engineer who never moved to Silicon Valley wrote the code that quietly runs the internet.

He is still shipping.

[D4rk_Intel @d4rk_intel]

My article "How To Investigate A Person Of Interest In 2026" is now available as a PDF.

A practical guide to digital footprint analysis – from email reconstruction to metadata mining and entity graphing.

Thanks @osintnewsletter for the mention.

PDF: https://t.co/86YlE9e2pB

[Kuba Gretzky @mrgretzky]

I wanted to address the speculation about the recently introduced Device Bound Session Credentials (DBSC) security feature in Google Chrome.

Does it help increase the security of session cookies against infostealer malware and MFA phishing?

The feature has been available and enabled by default since the Chrome 146 update (April 2026), if you're running Windows with a hardware-backed TPM security module (macOS support is coming in future updates).

DBSC allows the browser to upgrade session cookies from long-lived to short-lived, requiring the browser to refresh them approximately every 10 minutes to maintain access to the user's account.

> Does DBSC prevent account takeover by threat actors using a stolen session cookie obtained from the user's browser via infostealer malware?

Yes (kind of). The extracted session cookie will be valid for up to 10 minutes from the time it is extracted. The attacker will be unable to maintain long-term access to the user's account. Still, the timeframe may be sufficient, for example, to exfiltrate the inbox if the attack is automated. The attacker cannot refresh the short-lived session cookie because it requires the private key (stored in the TPM) assigned to the account to sign the challenge. The malware cannot access the private keys stored in the TPM.

> Does DBSC prevent account takeover by threat actors during a phishing attack?

No. Servers need to provide legacy support for the browsers that do not yet support DBSC. By default, the server registers and sends a long-lived session cookie to the browser. If the server supports DBSC, it will announce the DBSC API endpoint URL in the `Secure-Session-Registration` HTTP header of the response packet that contains the long-lived session cookies.
Only after the short-lived session cookie is registered via the DBSC API endpoint is the long-lived session cookie invalidated.

When the attacker removes the `Secure-Session-Registration` HTTP header retrieved from the server during a phishing attack, the browser will continue using long-lived session cookies and assume the server does not support DBSC. In short, removing that HTTP header while proxying traffic during a phishing attack allows the attacker to maintain long-term access to the user's account using the stolen long-lived session cookie.

I hope I've managed to clear up some confusion.

On a related note, you will soon be able to simulate phishing attacks against Google Workspace accounts (and other websites) that bypass DBSC and MFA protections using Evilginx Pro with the Phishlets 2.0 update.

[CyKor @CyKorKU]

Korea’s #1-ranked hacker on HackerOne is back with a follow-up post! 👀

Hyunseo Shin (KU, 4th year) previously shared how he uncovered open-source 0-days using LLM agents.
Now, he breaks down the AI-based vulnerability detection workflow behind those findings.

Full post below 🔥
🔗 https://t.co/6UodzgY5tN

#CyKor #AI #hackerone

[Son Luong @sluongng]

Codex just found a “workaround” of not having sudo on my pc…