Fabio

Computer Security Ph.D. | AIxCC hacker | Shellphish | AI whisperer | co-founder

[Brandon Falk @gamozolabs]

I kinda feel bad for the tech bros in cyber security that spend 8-10 hours a day writing agents, prompts, solving hard problems, and handholding AI all day long all to say that AI did all the work completely on its own and fully unguided when they find a good bug.

[Kabir Acharya @Kabir4charya]

I've been seeing posts all over about the state of CTFs post-LLM. I've seen many attempts to explain why this is just a new evolution of CTFs, but I fundamentally disagree. I believe the original spirit is gone and I've written why in my blog.

https://t.co/tgUZOGkhGV

[Wiz @wiz_io]

🚨 BREAKING: Wiz Research discovered Remote Code Execution on https://t.co/SvN2lGsnbO with a single git push

The flaw in @github allowed unauthorized access to millions of repositories belonging to other users and organizations 🤯

[Christoffer Bjelke @chribjel]

We hired a junior developer to write the simple code, so we don't have to spend a ton of money on tokens for those basic/primitive tasks

[Fabio @degrigis]

@seanhn I am struggling to answer this question too. Aggressive testing would help preserving "software semantic", but the price to pay is almost certainly monstrous codebases and inevitable software enshittification...

[Fabio @degrigis]

@realGeorgeHotz I 100% believe indeed we should ramp down rhetoric. The psychosis is real.
https://t.co/RDriNFYIMp

[Fabio @degrigis]

@m19o__ @tjbecker So, in my experience it does. Especially when flooded by dozens of warnings with no backing, the ones with a poc that crashes one of their harnesses get prioritized. And, yes, exploits are the ultimate proof against stubborness, but my argument is that they shouldnt be needed.

[Fabio @degrigis]

@m19o__ @tjbecker "How effective security controls are" != "Which bugs should be prioritized".
E.g., a validated sanitizer crash in the jit is more than enough motivation for patching. Using a full exploit for this is too expensive and too sensitive to FN.

[Fabio @degrigis]

@caseyjohnellis Sent a PM here :)

[Fabio @degrigis]

@caseyjohnellis hey there, can you send me a PM? Would love to discuss an interesting idea for bugcrowd.

[LiveOverflow 🔴 @LiveOverflow]

Huge respect for actually doing something 👏
Experimenting with anti AI rules in CTF and writing post mortem

[Fabio @degrigis]

THIS. Weirdly enough, it seems like AIxCC was an "Eureka moment" for few people. I remember many colleagues calling our work "slop" and now I see them being totally shocked. Tbh, I think AIxCC could be one of the main reasons why current models are so good at security.

[Tim Becker @tjbecker]

It's shocking how many people didn't know LLMs can find novel real-world vulnerabilities.

AIxCC deserved more attention

[Justin Elze @HackingLZ]

Y'all know there is a middle ground between people saying it's still BS, and people who are pilled and thinking everything is cooked overnight...

[Fabio @degrigis]

So, @AnthropicAI used 350 Claude's rounds to create a full exploit chain for CVE-2026-2796 (which is really cool).

https://t.co/2UK8snyYb6

But, I think the cool part of the story is that to confirm that bug, you only need 13minutes and $11 to get some real evidence :D

[lcamtuf @lcamtuf]

Frankly, I'm appalled by the prospect of LLMs taking offensive security research jobs from honest, hard-working fuzzers

[Fabio @degrigis]

"LLM harnessing is dead"

[ claude code leak ]

"LLM harnessing is magical!"

[Fabio @degrigis]

@tylerni7 @dreselli Not this year, too early for us :)

[tylerni7 @tylerni7]

Sometimes I think "why would a software security company raise $100M, how can you even spend that much money on engineering?"

Then I go to RSA and learn the money is for what really matters: paying for booths, ice cream, car wraps, baristas, parties, action figures, billboards..