XMR

CTF Player | CyberSecuirty | Bug Bounty

[sudo @rootsud0]

it's painful watching junior pentesters solve labs manually in the ai era. while y'all do burp suite tutorials, ai is already finding rces. you're late.

[Tech with Mak @techNmak]

Learn Harness Engineering 🚀

Found this excellent open-source course by Walking Labs, covering 14 lectures and 8 hands-on projects on building more reliable AI coding agents.

What's inside:
→ Agent instructions (AGENTS.md / CLAUDE.md)
→ Context management and persistent memory
→ Multi-session continuity and state tracking
→ Task boundaries and scope control
→ Testing, verification, and observability
→ Automated agent loops and workflows
→ Multi-agent orchestration and graph engineering

The practical projects walk you through building a complete agent harness, comparing prompt-only execution with structured workflows.

Also includes ready-to-use templates, verification scripts, and a harness-creator skill.

Perfect for developers working with Claude Code, Codex, and other AI coding agents who want to understand the engineering behind reliable agent execution.

Completely free.

Here's the GitHub Repo: https://t.co/hd2KKJiAlo

[JS0N Haddix @Jhaddix]

📄 Skills in Agent Harnesses

A lot of people don't know this (I didn't until recently) but most agent harnesses will load the description of your skill upon starting up your harness. This is how Claude Code works.

What people don't usually know is that even when you explicitly call a skill to be used inside of a harness, or the AI figures out to use a skill, it usually only does a read of the first 150 lines of the skill (to understand how to use it or if it applies to the work it's trying to do).

It's really important to outline a table in the first 150 lines of the mandatory parts of the skill that must be run when you invoke the skill.

If you make some type of mandatory instruction after 150 lines, it might get missed entirely. If you describe in prompting that you want to use a provided Python script or template, it also might be out of bounds of that 150 lines and never get called correctly.

If you write a table of contents of the skill actions in the first 150 lines and mark which ones are mandatory (or that, if the user has called the skill, you must read the whole skill context and all references), you get more reliable skills. We use markdown checklists for this now.

[zack0x01 @zack0x01_]

This is how you need to check for CVE scans on your AI hackbot using @netlas_io

Watch my full reconnaissance process to a valid bug on YouTube:
https://t.co/OlbIEfAhYA

[zack0x01 @zack0x01_]

Katana without a cookie finds nothing.

Give it your session cookie and it crawls the whole authenticated app.

Full reconnaissance process to a valid bug:
https://t.co/OlbIEfzK92

[codila @0xCodila]

REA + Opus 5.5 is f*cking dangerous...

Send this single prompt to Opus 5.5 and reverse-engineer any paid closed-source app

Then read article below on how to become REA engineer from scratch ↓

[secret asian man @chenj7]

@paina That’s the README

[Simon @soeckly]

I got $90,000 for a RCE in Google.
https://t.co/cjm7ZaNMeq

[Web Security Academy @WebSecAcademy]

Wheeeeeeee!

[RinX 🪐 @0xrinx]

don't stop learning.

learn backend.
learn frontend.
learn systems.
learn how products work.

then go ridiculously deep on the one thing you actually care about.

> go wide enough to connect the dots.
> go deep enough to build something real.

[Jaydeep @_jaydeepkarale]

Learn...Build...Fail...Learn...Repeat https://t.co/BWFfMYSNms

[Nitin Gavhane @NitinGavhane_]

Awesome AI Security Pack
https://t.co/Ey2EGM1q6G

[Yarchi @undefinedKi]

This might be the most useful paper on AI agents this year.

A team at Wavestone AI Lab took apart Claude Code, Codex and 9 more and found the 7-part blueprint every good agent is built on.

Their definition: an agent is a model plus a harness. All 11 agents build the harness from the same 7 parts. Only the size changes.

> Loop: Mini-SWE-Agent is a plain while loop. OpenHands logs every event so a run can be replayed

> LLM layer: one prompt template on one side, 29 provider profiles on the other

> Tools: some agents only have bash, the biggest has 43 typed tools loaded on demand

> Memory: from keep-the-whole-history to notes the agent maintains across sessions

> Safety: from a simple step limit to policy rules plus a reviewer model plus an OS sandbox

> Orchestration: Aider skips sub-agents on purpose, others fork them with their own context

> Extensions: hooks, skills and MCP. SKILL.md is in 9 of 11, MCP in 8

The paper ends with a 90-line harness covering all 7 parts, a solid starting point for your own.

Key pages:

> p.4: the 7-part map
> p.12: the 3 loop types, with Claude Code and Codex as examples
> p.53: why none of them use frameworks or embeddings
> p.67: 18 design recommendations
> p.71: the 90-line harness you can copy

[JS0N Haddix @Jhaddix]

Remember: "Agentic" and "Harnesses" are (mostly) just giving little LLM calls tools like bash/powershell and web search. And sending them off on a quest.

Skills: are just prompts in a folder, maybe with some scripts or a reference output.

It's not magic.

If you watch harnesses work... what are they doing? command-line calls. Thousands of them.

[shenetworks @shenetworks]

Bug bounty reporters!!! If you are heavily using AI in your “research” assume 1,000 other researchers are too and they will *shockingly* find the same issue you did. Don’t be shocked when you get back a duplicate finding.

[Critical Thinking - Bug Bounty Podcast @ctbbpodcast]

Jev is a statistics monster. What happens when you point it at bug bounty data?

Episode 194 https://t.co/As8PX0Bb8U

[OccupytheWeb @three_cube]

PowerShell can be weaponized to cause maximum disruption.

This can include overloading the RAM and CPU, wiping licenses, disabling hardware and corrupting the Master Boot Record

https://t.co/5f1hTR2l0E

[Co11ateral @co11ateral]

Web App Hacking with Cybermes

Cybermes works well for both pentests and bug bounty. It generates good reports and ships with a lot of built in skills

https://t.co/ZCaUagu2HY