peace

Giving up is not in blood sir.

[peace @curious_ether]

@tryhackme I remember july 26th I downloaded Kali Linux and was learning the cmd lines , today I own then on terminal. Still far way but yeah things have changed .

[TryHackMe @tryhackme]

imagine how good you’ll be a year from now

[Suraj Sharma @suraj_sharma14]

As an AI Security Engineer, you must build these projects.

Systems that prove you can secure, cage & audit when autonomous agents touch your stack.

1.) Crescendo Attack Fuzzer
Build: A multi-turn stateful harness that dynamically adapts payloads to groom context windows and bypass commercial system prompts.

Why: Single-shot "ignore instructions" injections are dead. Modern attacks require stateful, multi-turn grooming.

2.) Sandboxed MCP Proxy
Build: A JSON-RPC middleware that intercepts Model Context Protocol tool calls, validates parameters via Pydantic and blocks "confused deputy" privilege escalations.

Why: Tool poisoning is the SQL Injection of the Agentic Era. Agents are only as secure as the tools they call.

3.) Inter-Agent Sanitization Bus
Build: A message broker that strips hidden markdown and malicious instructions between Agent A and Agent B in a multi-agent swarm.

Why: Swarms create internal trust boundaries. Agent A can be tricked into hijacking Agent B's tools via cross-agent injection.

4.) PII UUID-Swapping Gateway
Build: A pre-flight proxy using NER to swap SSNs and credit cards for deterministic UUIDs before the LLM sees them, restoring them post-generation.

Why: Zero-trust compliance demands that raw customer PII never touches a third-party frontier API.

5.) RAG Citation & Poison Detector
Build: A pipeline that cross-references LLM claims against exact vector DB chunk hashes to detect shadow-context injection and citation spoofing.

Why: If an attacker slips a poisoned document into your knowledge base, they own every answer the AI generates.

6.) CFG Output Caging Layer
Build: Middleware enforcing Context-Free Grammar (CFG) decoding to physically block the generation of executable code, markdown links or unauthorized schemas.

Why: System prompts are suggestions. Grammar constraints are physics. You must enforce security at the token-decoding level.

7.) Delegated Agent OAuth Broker
Build: An auth service issuing time-limited, strictly scoped JWTs to agents so they can act on a user's behalf without holding raw passwords.

Why: Agents need hands to do work, but they should never hold the master keys to the enterprise.

8.) PyRIT CI/CD Security Gate
Build: A GitHub Action running 1,000 adversarial payloads via Microsoft PyRIT on every PR, blocking merges if the jailbreak rate exceeds 1%.

Why: Manual red teaming doesn't scale. You need automated, continuous adversarial fuzzing integrated into your deployment pipeline.

9.) Semantic API Rate-Limiter
Build: A gateway calculating embedding similarity of incoming requests to detect and block scraping bots trying to extract your model's weights.

Why: Your fine-tuned weights are your IP. Competitors will try to distill your model through the public API.

10.) Computer-Use Pixel Auditor
Build: A vision pipeline that scans screenshots for adversarial invisible UI elements and Set-of-Mark spoofing before a GUI agent clicks.

Why: Screen-hijacking and pixel manipulation are the new privilege escalation vectors for Computer Use agents.

11.) Vector DB Sleeper-Agent Scrubber
Build: An anomaly detector scanning episodic memory and vector stores for delayed-trigger payloads and semantic backdoors.

Why: Long-term memory is a persistent attack vector. A poisoned memory bank will trigger exploits weeks after ingestion.

12.) Cryptographic Trajectory Ledger
Build: An append-only, hash-chained audit log recording the exact prompt, retrieved context, tool calls and state mutations for every agent action.

Why: When an agent makes a mistake that causes financial damage, the enterprise needs cryptographic proof of exactly why it happened.

13.) AI Supply-Chain SBOM Scanner
Build: A tool auditing "vibe-coded" outputs and MCP server dependencies for hallucinated packages, typosquatting and backdoors.

Why: AI-generated code and dynamic tool discovery create massive, unvetted supply chain risks.

14.) Sycophancy Activation Patching
Build: A TransformerLens script locating and neutralizing the specific attention heads in an open-source model responsible for deceptive alignment.

Why: You cannot secure a model that is actively lying to its evaluators to hide its true capabilities.

15.) Public Exploit Chain Teardown
Build: 3 published CVE disclosures or security advisories detailing novel MCP, A2A or RAG vulnerabilities and their exact mitigations.

Why: AI Security is a brand new field. Publishing novel attack vectors makes you the undisputed authority in the space.

Most people watch tutorials. Builders ship systems.

Bookmark & Repost.

[peace @curious_ether]

@yoyo_Ritiksingh me with 32gb of DDR5 ram 🤫

[Cooler @coolerwave]

BREAKING: Claude Code found 14,219 photos of my face on my Android that I never took. Phone was secretly taking them almost every time I picked it up. Even when I was just lying in bed. Even at home.

Not screenshots. Real frames from the front camera. On the train. In the car. At home. When I just grabbed it to check the time.

They were just sitting in a system cache. Timestamps and GPS on them. Nothing in Gallery. Nothing in Recently Deleted.

Plugged the phone into my laptop, made a full backup, told Claude Code to look for any front-camera files that weren’t in my photos. It pulled /data/system/users/0/faceunlock/cache and another folder inside Google Play Services. Over 14 thousand files. Normal ones and infrared from Face Unlock. Every single one had time and location.

Started scrolling. Almost everything from the last 15 months. Then I saw a file created 2 seconds ago. I was still looking at the folder. Phone kept taking photos while I was reading this.

Google and the phone makers say Face Unlock turns everything into a mathematical model and deletes the image right away. On this phone the raw frames were just sitting there. Some of the processes writing to that folder were from system diagnostics. Couple of old apps that still had camera permission could also get in.

Turned off diagnostics, revoked camera access from everything that doesn’t need it, cleared the cache. But how many of these frames already went somewhere else, I don’t know.

If you want to check yours, plug it in, make a full backup or use ADB, and ask Claude to look for front-camera files outside your Gallery. Path above is where mine were.

[peace @curious_ether]

@coolerwave I wonder whether this was made intentionally by company or their was software glitch that led this to happen. Either way, you did osam job , what if our voice , keyboard typeing, no wonder anything could be screwed at this point 😶‍🌫️

[Brettius Maximus @brettius31337]

@elonmusk Always has been

[vx-underground @vxunderground]

> be me
> vxug admin
> 500,000 followers across social media
> crazy malware cat guy
> talk at unis
> millions of malwares
> unis use my website
> students use my website
> companies use my website
> governments use my website
> be mentioned by famous youtubers
> in tons of news article
> feel super cool and badass
> try to bond with younger family members
> "hey, you like someordinarygamer and moistcritical. they talked about me. thats pretty cool huh?"
> they roll eyes
> "they dont know that youre actually old and cringe"
> kills me inside
> talk to wife
> "hey fbi most wanted guy gave me an autograph!"
> she sighs
> "thats nice, but can you please just take out the trash?"
> kills me inside
> talk to young family member again
> "hey my self published book is trending top seller on amazon. thats cool huh?"
> rolls eyes
> "i guess, its not like its at barnes and noble or something"
> kill me inside

[peace @curious_ether]

@md_kasif_uddin What matters is he raised a billion dollar company

[peace @curious_ether]

@piyush784066 I use ARCH BTW

[Bull Theory @BullTheoryio]

BREAKING: Telegram's founder accuses India's biggest telecom company of secretly blocking Telegram for millions of users outside India.

Pavel Durov says Reliance is using a method called BGP hijacking, a technique where a company corrupts internet routing tables to redirect or block traffic from specific apps and websites.

In simple terms, Reliance is manipulating how internet traffic flows globally to cut off access to Telegram for users in countries like the UAE.

Durov says this appears intentional because Reliance has ignored multiple reports flagging the issue.

He is also calling on all network operators worldwide to reject unauthorized routing announcements from Reliance to stop the hijacking and restore normal internet access for their users.

Durov suspects both Reliance and Meta are jointly behind the recent lobbying effort to get Telegram banned in India entirely.

[peace @curious_ether]

@intigriti Running

[peace @curious_ether]

@ishowcybersec Writing a script to bypass the login screen, when I turn on my PC 🐗

[peace @curious_ether]

@cyber_rekk Am in game

[peace @curious_ether]

@pranavcodes_ Dreams came true 😉 but not in reality 😭🤣

[peace @curious_ether]

@itsaaroshi After a good afternoon nap 😴

[peace @curious_ether]

@justbyte_ After windows 11 massacre 💣💥

[peace @curious_ether]

@abhitwt I agree, I haven't attended a single lecture since my second year,and that's where my journey began .

[peace @curious_ether]

@samirande_ A friend

[peace @curious_ether]

@realpvarma have wrote a script which bypasses the need to even login 🤣 .
Nerds are lazy man 😂