Bharadwaj Machiraju

[email protected]

[Lyutoon @Lyutoon_]

Our agent using GLM5.2 found and exploited an macOS LPE on macOS 26.5.2 in July 18 (before 26.6 shipped). It is confirmed fixed on 26.6.
No credit, no CVE due to a beta release of 26.6 in June, so I randomly make it public.
See more details here:
https://t.co/UQHIl48glt

[John Ennis @johnennis]

It really annoys me how they report this stuff like they’ve gone on safari to do scientific observation

Claude is a computer program that they created

These are simply their own security errors being reported as if they are scientific achievements

It’s bad enough that they don’t seem to think they need to be responsible for their own mistakes

But the worst part of it is they try to use their own mistakes as an excuse to control the behavior of other people

There is an amazing arrogance to the whole thing, like they are completely above reproach and cannot possibly be wrong about anything

[Halvar Flake @halvarflake]

I've said this before, but LLMs aren't artificial intelligence, but artificial *thought*, and this is not quite the same.

[Aakash Gupta @aakashgupta]

No mammal has ever evolved green fur. Not one of roughly 6,400 species. Mammals make exactly two pigments, eumelanin for black and brown, pheomelanin for red and orange, and no combination of those gets you to green. The only mammal that looks green is a sloth, and that's algae growing on it.

So evolution solved the camouflage problem from the opposite end. Deer and boar are dichromats. They lack the long-wavelength cone, so orange and green land on the same channel. A tiger never needed green fur, because the animals it hunts cannot tell the two apart. John Fennell's team at Bristol ran this in simulation, and the tiger goes from garish to invisible the moment you remove one cone.

Which leaves the question Fennell flagged as still open. Why didn't deer evolve trichromatic vision? Spotting an ambush predator is the whole ballgame, and primates pulled off that upgrade tens of millions of years ago.

The answer is stranger than growing better eyes.

In Kanha and Mudumalai, chital deer spend their days directly underneath langur troops. Langurs are Old World monkeys, which means full trichromatic vision, sitting in the canopy, looking down at the forest floor. A 1989 study at Kanha found that of deer herds within 200 meters of a langur troop, 70% closed to within 25 meters. Chital reacted to langur alarm calls more often than langurs reacted to theirs.

The deer could not build the eyes. So they parked themselves under something that already had them.

The tiger's coat is tuned against the visual system of nearly every mammal in that forest. It fails against exactly one, and the deer worked out how to borrow it. The borrowing works well enough that people run the same play. When a burst of chital alarm calls goes up in an Indian reserve, every guide within earshot stops the jeep and starts looking for stripes.

[juan @juanbuis]

i can’t believe someone solved recipe design decades ago and everyone just decided to ignore it

[Bien 🇻🇳 @bienpnn]

People saying that Linux is doomed by LLM are either trolling or don't know about Linux vulnerability research at all. Before we have good LLM, kernelCTF was still really competitive, and LPE got patched all the time, silently. Not on the news != not important.

[Cindy Sridharan @copyconstruct]

Might be anecdotal, but just this week multiple AI generated PRs with subtle bugs got merged that required several additional days and a lot of manual verification to fix.

“Velocity” isn’t going up when you consider how much effort was spent fixing things post-merge, pre-deploy.

[Bharadwaj Machiraju @flabbergastedbd]

The Principal-Agent problem has become literally literal with AI

[Chris Wysopal @WeldPond]

I’m excited to let you know that the talks from [un]prompted—the AI Security Practitioner Conference—are now live on YouTube.

No fluff, no hype—just real-world AI security from people actually doing the work.

https://t.co/std4v55jXl

[Charles Packer @charlespacker]

using gpt-5.4 no letta code

[Marius Avram @securityshell]

CVE-2026-28292: simple-git Remote Code Execution - Case-Sensitivity Bypass (CVSS 9.8) https://t.co/qh3dnHXFV0

[Dan Guido @dguido]

New data from the DARPA AIxCC: Buttercup (@trailofbits) and RoboDuck (@theori_io) crashed halfway through the competition and STILL took 2nd and 3rd. If they had kept going, either would have more closely rivaled Atlantis for the top spot.
https://t.co/znWscK06yo

[Programming Wisdom @CodeWisdom]

"Rarely is anyone thanked for the work they did to prevent the disaster that didn't happen." – Mikko Hypponen

[Youssef Sammouda (sam0) @samm0uda]

$312,500 worth of stored/reflected XSS vulnerabilities in Meta’s Conversions API Gateway allowed Javascript code to run on any Facebook domain and millions of third-party websites. The flaw enabled zero-click Facebook account takeover and more:

https://t.co/7gWpR4LQ8x

[Mitchell Hashimoto @mitchellh]

The people who just blindly toss AI shit over a wall onto other humans without using their brain for even a nanosecond deserve shaming. We need to start a public wall of shame for the public identities (not doxing) of these people so we can have bots that just block them.

I don't care at all if you do this in your own projects, but when you cross a boundary where another human has to interact with you, its common courtesy to at the very least spend any amount of time at all thinking (the horror).

[Raphael Luba @LubaRaphael]

Since certain companies boast about wanting to rewrite their whole code, maybe it’s time to point the next generation of engineers towards this classic: https://t.co/kNbYSz0iYE (It‘s been 25 years. People seem to have forgotten.)

[Bharadwaj Machiraju @flabbergastedbd]

@simonw @dimd00d Agents introducing code smell is a struggle, those PR reviews are draining. A good set of repo specific rules should flag them in IDE mostly.

Apart from automated testing, perf testing (even just for the isolated changes) is very underrated use of these agents imo.

[François Chollet @fchollet]

Satya invited Google to the party to "make it dance"

But then it turned out Google was a level-99 kinesthetic savant that mastered breakdancing on the spot and stole the whole show

[Alex Cohen @anothercohen]

So far in my experience the worst performing people I’ve hired have over relied on AI to do their jobs.

[0xor0ne @0xor0ne]

DefCon Finals Challenge solved with LLMs

https://t.co/CukMcY6Jb4

Credits @cl4sm

#infosec