Ian Gorrie

I improve infosec and infrastructure programs.

[Ian Gorrie @gorrie]

@Support can you guys chill? I'm just making some social media accounts for my next book series.

Making it impossible to log in or interact with your moderation system is pretty ironic considering the content of the upcoming series.

[Lxyv @wholyv]

this is the worst day in the modern human history…

> axios attack occurred. 100M devices at risk of malware attack.

> claude code source code got leaked, people literally put it on github. which confirms maybe mythos will probably not be the best model.

> 4TB of secret data leaked from Mercor.

> opus consuming entire limits in two prompts.

> google announced how crypto is at severe risk after quantum made it possible to break crypto in just 10k qubits.

[Clément Dumas @Butanium_]

⚠️ Supply chain attack in progress: someone is squatting Anthropic-internal npm package names targeting people trying to compile the leaked Claude Code source.

`color-diff-napi` and `modifiers-napi` — both registered today, same person, disposable email. Do NOT install them. 🧵

[Mark Ermolov @_markel___]

Intel SGX has fallen! Its most important key is in our hands: we extracted the Global Wrapping Key from an instance of the Intel Gemini Lake platform

[Ian Gorrie @gorrie]

Who's making the cryptobro remake of Brewsters/Satoshis Millions?

[Polymarket @Polymarket]

Bitcoin is projected to crash below $45,000 this year. https://t.co/YTvlpcPIjX

[shirish @shiri_shh]

Holy shit… 4TB of job INTERVIEWS, RESUMES, and AI SECRETS just leaked from a $10 BILLION startup.

MERCOR uses AI to match people with high-paying gigs and literally records your face, voice, KYC docs and keeps it forever to “match” you with jobs.

Your FACE + VOICE + ID could be on the dark web right now.

Hackers (Lapsus$) claim they stole 4 TB through the company’s Tailscale VPN:

- 211 GB of candidate resumes and personal data
- Terabytes of video interviews + passport + KYC docs
- Almost 1 TB of source code

damn that Claude Mythos "God Tier" at Cyber stuff got into the wrong hands lol

[vittorio @IterIntellectus]

this is actually insane

> be tech guy in australia
> adopt cancer riddled rescue dog, months to live
> not_going_to_give_you_up.mp4
> pay $3,000 to sequence her tumor DNA
> feed it to ChatGPT and AlphaFold
> zero background in biology
> identify mutated proteins, match them to drug targets
> design a custom mRNA cancer vaccine from scratch
> genomics professor is “gobsmacked” that some puppy lover did this on his own
> need ethics approval to administer it
> red tape takes longer than designing the vaccine
> 3 months, finally approved
> drive 10 hours to get rosie her first injection
> tumor halves
> coat gets glossy again
> dog is alive and happy
> professor: “if we can do this for a dog, why aren’t we rolling this out to humans?”

one man with a chatbot, and $3,000 just outperformed the entire pharmaceutical discovery pipeline.

we are going to cure so many diseases.
I dont think people realize how good things are going to get

[hackaday @hackaday]

Open Source Radar Has Up To 20 KM Range https://t.co/DPXyOWCOBH

[Ian Gorrie @gorrie]

I've made my kickoff blog post for my high effort defense of trolling. It's a trilogy.

https://t.co/pBscCp5uej

[Andy Nguyen @theflow0]

I ported Linux to the PS5 and turned it into a Steam Machine. Running GTA 5 Enhanced with Ray Tracing. 🤯

[Archie Sengupta @archiexzzz]

Just hacked a VC-funded Voice AI company. I now have their prod data.

I now have access to all:
> medical information of customers
> call recordings, phone numbers, contact names
> email addresses
> all SYSTEM_PROMPT for all agents they are running
> API keys and Secrets
> org data
> OAuth Provider IDs
> all webhook_events

Mostly, I did IDOR and BAC attacks to get the data. I was able to retrieve all table columns and other access vulnerabilities. Once I had that, it was very easy to bypass and get all the data.

[chiefofautism @chiefofautism]

an open source AI tool was just caught BREACHING 600+ Fortinet firewalls across 55 COUNTRIES

fully AUTONOMOUS, zero human in the loop

its called CyberStrikeAI

100+ offensive security tools baked in, nmap, sqlmap, metasploit, nuclei, burpsuite, the entire attack chain automated

you literally chat with it

> hack this target, make no mistakes

AI agents coordinate the attack themselves, one does recon, another scans, another exploits, another writes the report, they talk to each other and adapt based on what they find

this is cobalt strike meets chatgpt except its free, open source, and backed by a state actor

[Ian Gorrie @gorrie]

@ghnynex After a couple years of fighting against the nature of transformers, it seems the frontier people have had a change of heart.

We have not yet felt the impacts of such, besides NYC banning it, of course.

[Ian Gorrie @gorrie]

Very current year.

[Ζηνων o Carlos @ZenoEleatis]

After testing it myself, I can say there are a thousand reasons why making this tool public is a bad idea, a very bad one, even if the engineering is brilliant and the creator is someone I deeply respect. No amount of good intention outweighs the structural risk this tool introduces.

It’s already out there, likely cloned and audited by now. While those of us in certain areas are familiar with ablation techniques, OBLITERATUS introduces novel methods that neutralize guardrails with surgical precision.

Looking at the profiles and backgrounds of those amplifying this, it’s clear this tool is reaching actors who shouldn't have access to this level of power.

This is exactly what those 'boring protocols' were designed to prevent. Since the genie is out of the bottle, the least we can do is be honest about the risk we’re facing.

[Ian Gorrie @gorrie]

rate his EDC

[FBI Director Kash Patel @FBIDirectorKash]

Last night, John Daghita – a U.S. government contractor who allegedly stole more than $46 million in cryptocurrency from the U.S Marshals Service – was arrested on the island of Saint Martin by the French Gendarmerie’s premier elite tactical unit in a joint operation with the @FBI.

Thanks to the International Cooperation Team Serious Crime Unit of the French Gendarmerie National in Saint Martin, and the Groupe d’intervention de la Gendarmerie nationale of Guadeloupe for the outstanding coordination.

FBI will continue working 24/7 with our international partners to track down, apprehend, and bring to justice those who attempt to defraud American taxpayers—no matter where they try to hide.

[Ian Gorrie @gorrie]

@NeuralSpace_

[Ian Gorrie @gorrie]

What were your namesakes doing in the 1400s? Mine were gettiing killed by the king.
https://t.co/MxYv6rNuC1