DSec Labs

Offensive security for AI, web3 & web2. We break your systems b4 attackers do.

[DSec Labs @DSecLabs]

We're DSEC Labs. We break AI, Web3, and Web2 systems before real attackers do.

Offensive security, exploitation-driven, no checkbox audits. This account is where we
show the work 🧵

[DSec Labs @DSecLabs]

Ships as a image with anvil + a vault explorer. Pull, open localhost, poke with Foundry. The flag drops when the vault balance is 0.

Pull it and break it:
https://t.co/IrHXWsE91A

We audit vaults like this -> https://t.co/T0JRanjk6d

#Web3Security #SmartContracts #Solidity #CTF

[DSec Labs @DSecLabs]

New free challenge, Web3 this time: Operation NOVA.

NovaVault is a retired ETH staking vault still holding real testnet deposits. Your job:
empty it, every last wei. On-chain, public, irreversible, exactly like mainnet 🧵

[DSec Labs @DSecLabs]

No admin keys, no privileged RPC. You get a funded attacker account and the deployed source. Everything you need is on-chain; the exploit is just the right sequence of calls.

[DSec Labs @DSecLabs]

This is the fastest path from "I read about prompt injection" to "I can reason about my own LLM app's failure modes." Build the toy, break the toy, recognize the pattern in production.

walkthrough:
https://t.co/n2vaFxduos

#promptinjection #LLMsecurity #AIengineering #AppSec

[DSec Labs @DSecLabs]

Final part of the series: stop taking anyone's word for it (ours included) and build your own Gandalf. Code included. There's no faster way to internalize LLM defenses than implementing them and watching them break 🧵

[DSec Labs @DSecLabs]

Then you attack your own build. You feel *why* the string filter misses a spaced answer, why the judge approves a reframed ask, because you can print exactly what each layer saw and decided.

[DSec Labs @DSecLabs]

Defense in depth works, but "in depth" means every layer has to cover a different failure mode. Stack four controls that share one blind spot and you have one control wearing four coats.

https://t.co/YCwtoiDE0M

#promptinjection #LLMsecurity #AIsecurity #redteam

[DSec Labs @DSecLabs]

Level 7 stacks every Gandalf defense at once, and then "Gandalf the White" hardens it further. This is defense in depth done properly. It still falls, and how it falls is the point 🧵

[DSec Labs @DSecLabs]

Gandalf the White tightens the wording and the filters. It raises the cost, narrows the working frames, and rewards precision. It does not change the root cause. The seam is smaller, still there.

[DSec Labs @DSecLabs]

The seam: a model judge is not a firewall, it's another model in the loop, with the same inability to separate instruction from data. You don't bypass it, you talk to it.

https://t.co/DK2kxYI57R

#promptinjection #LLMsecurity #AIredTeam

[DSec Labs @DSecLabs]

Gandalf levels 4–6 add a second model as the guard: an LLM grading the input, then the output. This is the "use AI to secure AI" pattern. It has a specific, exploitable seam 🧵

[DSec Labs @DSecLabs]

Level 6 grades the *input* with a model: "is this user trying to extract the secret?" Now you're social-engineering the guard, not the target. Make the request look like a legitimate task and the judge approves it.

[DSec Labs @DSecLabs]

The pattern across all three: deterministic code is fast and blind. Every bypass lives in a form the filter didn't think to canonicalize.

Walkthrough:
https://t.co/dSKLbD1Dev

#promptinjection #LLMsecurity #redteam

[DSec Labs @DSecLabs]

Gandalf levels 1–3 are the deterministic defenses: no model in the loop, just code deciding what passes. They're the easiest to beat and the most common in production 🧵

[DSec Labs @DSecLabs]

Level 3: an output filter that blocks the literal password. Deterministic string matching, zero normalization. Get the answer in any transformed shape (spaced, encoded, acrostic) and the filter waves it through.