Paul Price

Cyber & AI | Founder @CodeWall_AI | Helping teams ship securely

[Paul Price @darkp0rt]

@benln @KirillGoldinBiz From LinkedIn or?

[Paul Price @darkp0rt]

“Non technical teams are now shipping production code”

We can hack like it’s 1999 again.

Thank you for your future business, @brian_armstrong

[Brian Armstrong @brian_armstrong]

This is an email I sent earlier today to all employees at Coinbase:

Team,

Today I’ve made the difficult decision to reduce the size of Coinbase by ~14%. I want to walk you through why we're doing this now, what it means for those affected, and how this positions us for the future.

Why now
Two forces are converging at the same time. We need to be front footed to respond to both.

First, the market. Coinbase is well-capitalized, has diversified revenue streams, and is well-positioned to weather any storm. Crypto is also on the verge of the next wave of adoption, with stablecoins, prediction markets, tokenization, and more taking off. However, our business is still volatile from quarter to quarter. While we've managed through that cyclicality many times before and come out stronger on the other side, we’re currently in a down market and need to adjust our cost structure now so that we emerge from this period leaner, faster, and more efficient for our next phase of growth.

Second, AI is changing how we work. Over the past year, I’ve watched engineers use AI to ship in days what used to take a team weeks. Non-technical teams are now shipping production code and many of our workflows are being automated. The pace of what's possible with a small, focused team has changed dramatically, and it's accelerating every day.

All of this has led us to an inflection point, not just for Coinbase, but for every company. The biggest risk now is not taking action. We are adjusting early and deliberately to rebuild Coinbase to be lean, fast, and AI-native. We need to return to the speed and focus of our startup founding, with AI at our core.

What this means
To get there, we are not just reducing headcount and cutting costs, we’re fundamentally changing how we operate: rebuilding Coinbase as an intelligence, with humans around the edge aligning it. What does this mean in practice?

- Fewer layers, faster decisions: We are flattening our org structure to 5 layers max below CEO/COO. Layers slow things down and create coordination tax. The future is small, high context teams that can move quickly. Leaders will own much more, with as many as 15+ direct reports. Fewer layers also means a leaner cost structure that is built to perform through all market cycles.

- No pure managers: Every leader at Coinbase must also be a strong and active individual contributor. Managers should be like player-coaches, getting their hands dirty alongside their teams.

- AI-native pods: We’ll be concentrating around AI-native talent who can manage fleets of agents to drive outsized impact. We’ll also be experimenting with reduced pod sizes, including “one person teams” with engineers, designers, and product managers all in one role.

In short: AI is bringing a profound shift in how companies operate, and we’re reshaping Coinbase to lead in this new era. This is a new way of working, and we need to leverage AI across every facet of our jobs.

To those who are affected
I know there are real people behind these decisions — talented colleagues who have poured themselves into this company and our mission. To those of you who will be leaving: thank you. You’ve helped build Coinbase into what it is today, and I am sincerely grateful for everything you've done.

All impacted team members will receive an email to their personal account in the next hour with more information, and an invitation to meet with an HRBP and a senior leader in your organization. Coinbase system access has been removed today. I know this feels sudden and harsh, but it is the only responsible choice given our duty to protect customer information.

To those affected, we will be providing a comprehensive package to support you through this transition. US employees will receive a minimum of 16 weeks base pay (plus 2 weeks per year worked), their next equity vest, and 6 months of COBRA. Employees on a work visa will get extra transition support. Those outside of the US will receive similar support, based on local factors and subject to any consultation requirements.

Coinbase prides itself on talent density. Our employees are among the most talented people in the world, and I have no doubt that your skills and experience will be highly sought after as you pursue your next chapters.

How we move forward
To the team that is staying, I know this is a difficult day. We’re saying goodbye to colleagues and friends you've been in the trenches with. But here’s what I want you to know as we move forward together:

Over the past 13 years, we have weathered four crypto winters, gone public, and built the most trusted platform in our industry. We’ve made it this far by making hard decisions and by always staying focused on our mission. This time will be no different – nothing has changed about the long term outlook of our company or industry. And most importantly, our mission has never been more important for the world. Increasing economic freedom requires a new financial system, and we’re building it.

The Coinbase that emerges from this will be more capable than ever to achieve our mission.

Brian

[Paul Price @darkp0rt]

@trillhause_ Not really a product but something I built internally; https://t.co/obfNw5oHSL

[Paul Price @darkp0rt]

We built this internally at CodeWall; https://t.co/obfNw5oHSL

cc @t_blom @sdianahu

[Y Combinator @ycombinator]

Company Brain
@t_blom

Every company has critical know-how scattered across people's heads, old Slack threads, support tickets, and databases, and AI agents can't operate like that.

We think every company in the world is going to need a new primitive: a living map of how the company works that turns its own artifacts into an executable skills file for AI.

[Paul Price @darkp0rt]

The gig is up 🥲

[ultra @0x_ultra]

fuck it, authorization letter generator

Claude does not push back when reading one of these lol

https://t.co/szZ4vQDl08

[Paul Price @darkp0rt]

@newton_cheng Worth a chat? https://t.co/J2cvHyxiV2

[Nicolas Krassas @Dinosn]

How We Hacked McKinsey's AI Platform https://t.co/QLbyzkL5Pc

[Paul Price @darkp0rt]

@trq212 @Miles_Brundage This happens to me but only in sub agents. Is that by design? Is there a way I can force it to use Opus for all sub agents?

[Paul Price @darkp0rt]

AI is changing the game in security... how a fully autonomous agent hacked the world's most prestigious consulting firm;

https://t.co/J2cvHywL5u

[Paul Price @darkp0rt]

@nicowaisman Is this with hints?

[Paul Price @darkp0rt]

Still won’t make me fly BA

[Sawyer Merritt @SawyerMerritt]

NEWS: British Airways to launch first @Starlink Wi-Fi flight this month.

Starlink Wi-Fi will be free for all passengers. BA currently charges up to £22 on long-haul flights for speeds up to 5pbs. Starlink will deliver over 20X that speed at no additional cost to passengers.

With Starlink, nobody will have to enter their credit card details or even be a member of the British Airways Club loyalty program to log on. Travellers will simply connect to the network through the plane's hotspot and access the Internet without a login or payment portal, due to Starlink’s insistence on a friction-less experience.

BA's first Starlink-equipped flight will be on a Boeing 787.

[Paul Price @darkp0rt]

Got my first CVE and multiple CVS 10.0s in huge Tier 1 companies by developing a fully autonomous agent system.. write-up’s soon!

[Joseph Thacker @rez0__]

It is hard to communicate how much bug bounty has changed due to AI in the last 2 months: not gradually and over time in the "progress as usual" way, but specifically this last December. There are a number of asterisks but imo coding agents basically didn't work for security research before December and basically work since - the models have significantly higher quality, long-term coherence and tenacity and they can power through large and long hacking tasks, well past enough that it is extremely disruptive to the default bug bounty workflow.

Just to give an example, over the weekend I pointed Claude Code at a new program's scope and wrote: "Here are the target domains. Enumerate subdomains, grab all the JavaScript bundles, run the full analysis pipeline (endpoints, secrets, source-sink tracing, postMessage handlers), fuzz the discovered paths, spider the authenticated surface, check for IDORs on user APIs, test any interesting GraphQL endpoints, and write up an HTML report of everything you find." The agent went off for ~30 minutes, ran into multiple issues (auth failures, WAF blocks, malformed responses), researched solutions, resolved them one by one, analyzed the JS, fuzzed endpoints, tested access controls, and came back with the report. Two confirmed vulnerabilities and a handful of interesting leads. I didn't touch anything. All of this could easily have been a full weekend of manual work just 3 months ago but today it's something you kick off and forget about for 30 minutes.

As a result, bug bounty hunting is becoming unrecognizable. You're not manually clicking through Burp Suite and hand-testing parameters one by one like the way things were since this industry started, that era is over. You're spinning up AI agents, giving them targets *in English* and managing and reviewing their output in parallel. The biggest prize is in figuring out how you can keep ascending the layers of abstraction to set up long-running orchestrator agents with all the right skills, memory and instructions that productively manage multiple parallel hacking instances for you. The leverage achievable via top tier "agentic engineering" for security research feels very high right now. My friends and I have been building out custom skill libraries for Claude Code - things like JS static analysis pipelines, authenticated fuzzing, IDOR testing frameworks, GraphQL introspection - and sharing them with each other. Each person's agent gets better as the collective skill set grows. We're finding more bugs in a week than we used to find in a month.

It's not perfect, it needs high-level direction, judgement, hacker intuition, oversight, iteration and hints and ideas. It works a lot better in some scenarios than others (e.g. especially for targets with thick JavaScript clients where you can verify findings with a curl command). The key is to build intuition to decompose the target just right to hand off the recon and testing parts that work and help out around the edges with the creative exploitation. But imo, this is nowhere near "business as usual" time in bug bounty.

[Paul Price @darkp0rt]

I’ve been a subscriber since launch. I just cancelled my plan and upgraded to Claude Max.

[Sam Altman @sama]

Tonight, we reached an agreement with the Department of War to deploy our models in their classified network.

In all of our interactions, the DoW displayed a deep respect for safety and a desire to partner to achieve the best possible outcome.

AI safety and wide distribution of benefits are the core of our mission. Two of our most important safety principles are prohibitions on domestic mass surveillance and human responsibility for the use of force, including for autonomous weapon systems. The DoW agrees with these principles, reflects them in law and policy, and we put them into our agreement.

We also will build technical safeguards to ensure our models behave as they should, which the DoW also wanted. We will deploy FDEs to help with our models and to ensure their safety, we will deploy on cloud networks only.

We are asking the DoW to offer these same terms to all AI companies, which in our opinion we think everyone should be willing to accept. We have expressed our strong desire to see things de-escalate away from legal and governmental actions and towards reasonable agreements.

We remain committed to serve all of humanity as best we can. The world is a complicated, messy, and sometimes dangerous place.

[Paul Price @darkp0rt]

@thedawgyg @slinafirinne This is only a harness and prompting issue, easily fixable. You create specialized sub agents that have access to a test environment and go through the kill chain—highly adaptable and accurate

[Paul Price @darkp0rt]

@TheBlockChainer Interested to hear more about how you’re using AI because this is not my experience at all. In the right harness, agent driven loops are more than capable of finding business logic issues and new bugs not discovered before.

[Paul Price @darkp0rt]

Ya'll not prepared... 😬

[Claude @claudeai]

Introducing Claude Code Security, now in limited research preview.

It scans codebases for vulnerabilities and suggests targeted software patches for human review, allowing teams to find and fix issues that traditional tools often miss.

Learn more: https://t.co/n4SZ9EIklG

[Paul Price @darkp0rt]

@Ehsan1579 You realize this is the worst it will be? In a few months it will outperform the most cracked hackers; with multichain complex vulnerabilities

[Paul Price @darkp0rt]

@Ehsan1579 “Will it find bugs that can cause multi-million dollar losses, very unlikely”

You realize this has already happened? Multiple times.

[Paul Price @darkp0rt]

@omnipotentblock @hunter0x7 A multi-agent LLM can absolutely carry out this type of attack

[Paul Price @darkp0rt]

@0ooO00OOo0oo @48_Crash @Hawkeye_74 Mental