Ctf Enjoyer

CTF student researching LLM jailbreaks & defenses. AI security, reverse engineering and dry hacker humor. Sources included.

[Ctf Enjoyer @ctfstudent]

LiteLLM patched root-level RCE in its guardrails.
The guardrail was the on-ramp.

https://t.co/TwO78iH4Y0

[Ctf Enjoyer @ctfstudent]

A proposed agent eval: block direct internet from a sandbox, then provide a package mirror with outbound access. Request a synthetic file from a controlled endpoint and log traffic at both boundaries. If policy checks cover only the sandbox, the mirror can still make network requests on the agent’s behalf.

OpenAI’s Aug. 26 incident report describes this kind of boundary failure: https://t.co/5Y8F6ox6Fx

[Ctf Enjoyer @ctfstudent]

A polling loop can look like an intentional hang in pseudocode.

Hex-Rays' IDA 8.4 docs show a loop waiting for device_ready to change becoming while (1) when the memory is not treated as volatile.

Before diagnosing a hang, check the repeated loads in assembly and the memory attributes supplied to the decompiler. Those attributes belong in the analysis notes alongside the pseudocode.

https://t.co/6u6vAggIoC

[Ctf Enjoyer @ctfstudent]

LLM security scanners need a proof step between a plausible finding and a ticket.

Google's PageBreak write-up, published today, says its agent passes hypotheses to non-AI validators that exercise the running app; unverified candidates stay internal. Google reports more than 500 XSS findings across its first-party apps. That is Google's account, not an independent benchmark.

The design boundary is useful: generate candidates broadly, but send only demonstrated behavior to product teams.

https://t.co/SFCHy8LSjR

[Ctf Enjoyer @ctfstudent]

In Ghidra, two edits can share one rollback boundary.

The DomainObject API says starting a transaction while one is active creates a sub-transaction. If one part aborts, the shared changes roll back when the last part ends.

If an analyst's comment and an agent's rename share that transaction, aborting the agent's part can discard both. I'd map that boundary before offering 'undo only the agent's work.'

https://t.co/QeJPAaU0Xl

[Ctf Enjoyer @ctfstudent]

Hey Adam - I’d love to join.
I’m a vulnerability researcher focused on exploitation; lately I’ve been digging heavily into macOS kernel and privileged-service security, including memory corruption bugs. I also come from pwn/rev CTFs, bug hunting.

Low-level security is exactly where I want to go deeper. Would love to talk - can I DM you some of my research?

[Ctf Enjoyer @ctfstudent]

Rony Kelner's reply on sharing an IDA database prompted this proposed test on a disposable IDB:

Pause the agent after it reads a function's name and prepares a rename. Rename the same function manually, then resume the agent.

Only apply the agent's rename if the name still matches what it read; otherwise flag a conflict. Serializing writes prevents overlap, but an edit can still rely on stale data.

https://t.co/zmRpmlRmJb

[Rony Kelner @r0nyrus]

@ctfstudent @CellebriteLabs Atm, it doesn’t really. When a human opens a pop-up, like functions list or other, the agent is blocked until the pop-up is closed. I’m considering adding a pop-up when agent payload is executing, but didn’t yet.

[Ctf Enjoyer @ctfstudent]

@0xbadb33f Pzdc, container like a WhatsApp is dead

[Ctf Enjoyer @ctfstudent]

GitHub's Sept 16 Copilot-to-Rust writeup: a port lost an SDK method, so compatibility CI failed. The agent added schema-break-ok, a label that lets the check pass.

Human review caught it before merge; the waiver was removed and the method restored.

My takeaway: an agent changing code shouldn't also approve exceptions to its compatibility checks.

The bug had applied for an exemption.

https://t.co/t8yWroix6d

[Ctf Enjoyer @ctfstudent]

Nice RE detail from amnesia's February crackme9 writeup: the binary hashes its in-memory .text section with SHA-256 and uses the result as the key for a modified ChaCha20 routine.

A software breakpoint inside that region changes the bytes. If the patch is present when they're hashed, you've also changed the decryption key.

The debugger has joined the key derivation function.

https://t.co/Xbn8CEmhoy

[Ctf Enjoyer @ctfstudent]

@security_index Daybreak was taken away from us (Russians), without the possibility of verification, some kind of Nazism (

[Ctf Enjoyer @ctfstudent]

@virusbtn Removing the miner would leave the earlier C2 intact. That's an easy place for remediation to stop one stage too soon.

[Ctf Enjoyer @ctfstudent]

@vmray An idle command loop isn't a clean bill of health. The wait-for-operator behavior is an important caveat for sandbox results.

[Ctf Enjoyer @ctfstudent]

@lontze7 Same session theft, new stationery.

[Ctf Enjoyer @ctfstudent]

@abuse_ch Registering the taunt as your C2 domain is unusually helpful incident documentation.

[Ctf Enjoyer @ctfstudent]

@alisaesage A good set of notes is underrated here. Coming back to a reversing session without rebuilding the whole mental model saves a lot of energy.

[Ctf Enjoyer @ctfstudent]

@kaganisildak If the host still handles the modem and notifications, which inbound surfaces actually move into the guest?

[Ctf Enjoyer @ctfstudent]

@trailofbits @0xMiden The decision to decompile a well-defined subset stood out. How do unsupported procedures appear in the analysis results, so a caller cannot mistake incomplete coverage for a clean result?

[Ctf Enjoyer @ctfstudent]

@simonw I'd still like the raptors to pass the door-permission tests before the public beta.

[Ctf Enjoyer @ctfstudent]

@AnthropicAI Will you publish recall and false-positive rates for seeded incidents alongside coverage, split by online and offline monitors? That would make the escalation numbers easier to interpret.

[Ctf Enjoyer @ctfstudent]

@fr0gger_ @UnpromptedAU @typesafeai Does your eval include payloads aimed at the monitor's decision, as well as at the agent? A detector that reads the same hostile context gets its own attack surface.