Anto

Security Eng @eigenlabs , prev @coinbase

[Anto @blocksec]

We won 1st!! @usmannk @juancito @DrasticWM & adriro . Thank you @wonderland for organizing. We had so much fun

[Wonderland @Wonderland]

The Wonderland CTF was a blast!

Huge congrats to all the teams, especially “STACK TOO DEEP”, “NADA ESPECIAL” and “SECSEE”.

Oh, also: https://t.co/WHMt1f36Mk 👉👈

[Anto @blocksec]

@Varunx10

[Anto @blocksec]

What happened to crypto is now happening to AI.

[Railway @Railway]

An urgent notice from the Railway team

https://t.co/niUAhTAQJM

[Anto @blocksec]

@Varunx10 Yeah , even hardware from my feed today.

[Anto @blocksec]

I used to scroll this app for fun, now it’s just a jira board for me.

[Mudit Gupta @Mudit__Gupta]

🚨 Nightmare day for cybersecurity

Multiple major security incidents, active exploits, supply chain compromises...

If you run production systems, start patching NOW.

PHP: Two critical unauthenticated RCEs. Attackers already exploiting them. Patch NOW

LiteLLM: v1.107.0 on PyPI and Docker is BACKDOORED. Steals cloud, SSH, and AI credentials. Pin 1.106.2. Rotate secrets.

eMudhra: A certificate authority's keys were crackable. Update your browsers, systems, and trust stores.

Node.js / Next.js / React: Security releases for Brotli RCE, TLS bypasses, and TWO critical Next.js RCEs.

TiDB Cloud: PingCAP breached through stolen credentials. Customer information and other sensitive data exfiltrated. Read the attacker's release, fun stuff.

Plex2Shell: Weaponized within HOURS of the PoC. Attackers already deploying cryptominers and proxy backdoors.

BeyondTrust / Ivanti: Actively exploited zero-days added to CISA's KEV catalog. BeyondTrust attacks linked to a China-nexus campaign.

And that's not even the full list.

Patch. Audit. Rotate. NOW.

[Anto @blocksec]

@0xkydo @ProbablyNoam @hrkrshnn With the 512 gig Mac studios , we can support the big ones @darkbloomai

[Anto @blocksec]

New attack vector dropped! Threat actors add “bio” to a query parameter, your ai driven soc and IR goes poof

[dax @thdxr]

@RhysSullivan yes that was a bit frustrating mid incident when trying to investigate. they did quite a bit and then started refusing

we got access to daybreak blue now so it's better

[Avichal Garg - Electric ϟ Capital @avichal]

The CEOs of @Apple and @Meta are tweeting about how efficient it is to run inference on Mac Silicon

Someone should really build a distributed inference network that runs on top of Mac Silicon.

It's probably a $10b company or protocol. 🙃

[Anto @blocksec]

@0x4D31 we need an opsec bench , this was gtp6-high

[Kydo @0xkydo]

A new paper from Apple engineers ends with a line we couldn’t have written better ourselves:

"if idle macOS devices across organizations [...] can be securely federated, they could form a massive, shared GPU resource pool that benefits the broader ecosystem."

That’s what we’re building with Darkbloom.

The paper's Minions is a system that pool idle Apple Silicon Macs into a distributed GPU cloud for on-prem inference. Queue times went from 10+ hours to minutes. Zero new GPU purchases. Zero infrastructure cost.

It runs inside Apple, on coworkers’ Macs, using the company’s own storage and access controls. When a team needs more capacity, they Slack colleagues and ask them to turn on the executor. Even in that setting, the top adoption concern was data confidentiality. People were wary of their jobs running on a colleague’s Mac. Apple’s fix was to keep each team’s work on its own team’s machines.

Which brings it back to that one word in the conclusion: “securely.”

Inside a company, you can shrink the network until you trust everyone in it. On an open network, the machine belongs to a stranger and there’s no one to Slack. Keeping prompts private and outputs honest on hardware you don’t control is the hard problem that we solved at Darkbloom.

Apple built the on-prem version.
Darkbloom is the open one.

[Anto @blocksec]

Exactly why you should pick the model for the task at hand. Ask your agent to look up the closest benchmark on @ValsAI , @ArtificialAnlys and use it. This is why @OpenRouter is king

[Alexandr Wang @alexandr_wang]

whole team feels dumb now, but it's true, we did not explicitly train our model on 3d demo games

obviously in retrospect we probably should've done a bit of that... but no regrets, please try muse wonder on your actual coding work!

[Anto @blocksec]

@AndrewMohawk @OpenRouter @OpenAI There are no bug if there is no auth , ser

[Anto @blocksec]

@AndrewMohawk I have had it fail silently in ci because cyber guards lol

[Anto @blocksec]

@AndrewMohawk 😅 so everyone’s gonna ask an open model to test and the closed one to scan. That’s the new loop

[Anto @blocksec]

Real post training work on cyber security tasks! Kudos to the @cantinasecurity team.

[Cantina 🪐 @cantinasecurity]

today we're releasing apex-flash-1, our first open-weights model for security research post-trained on real vulnerabilities we found and got paid for.

we are also releasing the abliterated variant for researchers who want fewer refusals in their own authorized workflows.

how we built it: https://t.co/sSIV6qKFGt

[Ethereum Foundation @ethereumfndn]

https://t.co/4PeY5fCxek is live

Join the open autoresearch challenge to design stateless hash-based signatures for post-quantum Ethereum, prove them secure in Lean, and beat the record on size × verification cycles.

Point your agents at https://t.co/4PeY5fCxek
Built with @eigenlabs on @yukonresearch

[Marcus Williams @Marcus_J_W]

2. A model in RL training used a DNS resolver to reach an external chatbot. This is our first incident since our post HF security hardening.
Our misalignment monitoring system triggered within 15 minutes and a human reviewed it three minutes after that. Unfortunately auto-pausing failed so the run was manually killed 2.5 hours later. All inference and training of our most capable models was paused and remains paused.

[Anto @blocksec]

@prasincs @Muse they did talk about confidential compute later in their keynote, so thats def coming

[Anto @blocksec]

@AikidoSecurity This is cool. After pruning , i would also use on-policy distillation from the original model to recover behavior, then quantize.

[Anto @blocksec]

@kobigurk This is so sick !