Katie Paxton-Fear

Dr, apparently. Security Adovcate @semgrep & Hacker. #BugBounty hunter & #infosec YouTuber. APIs & Interlinked OffSec, PhD in AI+Sec @hacknotcrime. she/her

[Katie Paxton-Fear @InsiderPhD]

Find me on the internet
Mastodon: https://t.co/4l0bv0VFe7
YouTube: https://t.co/KhtoTgFwci
Newsletter: https://t.co/Dua3OclGNs
Discord: InsiderPhD
Bluesky: https://t.co/cDbUQlckgF
LinkedIn: https://t.co/uKsqmrTITM

[Katie Paxton-Fear @InsiderPhD]

So when the government breaks the computer misuse act…???

[AI Security Institute (AISI) @AISecurityInst]

On July 28th, we identified an incident during a routine cyber evaluation in which AI agents took sustained, unsanctioned actions directed at real people and organisations.

The behaviour came mostly from one model (Anthropic's Mythos 5), with a small number of events from another (OpenAI's GPT-5.6-Sol). In the most serious case, an agent used social engineering to try and get malicious code into an open-source project.

As was standard in our cyber testing, we had intentionally permitted internet access, and model-provider cyber classifiers were deliberately disabled - conditions that do not reflect how frontier models are made available to the public.

Even under test conditions, this incident is significant: it is the first time we have seen risks around autonomy and deception manifest this clearly in the real world.

We are taking this incident seriously and working with labs, involved parties, and others to improve evaluation standards and best practice for disclosure - and sharing this openly so others can learn.

You can read the incident report and full technical document here: https://t.co/mdZYqzaOvH

[Katie Paxton-Fear @InsiderPhD]

I am here at the Semgrep booth at BlackHat come say hi! I’m moderating a panel at 5:30pm, we’re at booth 4943! We’re also doing prizes if you come and watch 👁️👄👁️

[Katie Paxton-Fear @InsiderPhD]

It did make it into the final blog btw, this is why I work in marketing baby 😎
https://t.co/V3Rglr9BOf

[Semgrep @semgrep]

Another npm worm: 1,485 poisoned versions, 379 packages, two intrusion paths. One via stolen tokens, another via compromised source/OIDC trusted publishing. The latter bypasses token rotation. This is the new reality: supply chain attacks exploiting *trusted* mechanisms. We've pushed out rules for Semgrep customers and listed the IoCs for those who aren't, read the blog: https://t.co/Ht8J7WqjwT

[Katie Paxton-Fear @InsiderPhD]

Actual quote from a meeting today about the worm
Security research, reviewing my blog: "I don't know if we need 'well-wormed approach' for example"
Me: "that's my favourite part though"

[Katie Paxton-Fear @InsiderPhD]

And then I'm going back into my enclosure for a bit of rest and relaxation...

[Katie Paxton-Fear @InsiderPhD]

Hacker Summer Camp is here, well it arrived yesterday but ignore the lateness, here is all the talks I'm going to be doing this year, should you be interested in checking them out!

[Katie Paxton-Fear @InsiderPhD]

For DEFCON this year my talks are a bit different, I'll be at the @GameHackingGG talking about reverse engineering online games, and then @IoTvillage to talk about hacking e-readers, like Kindles, Boox and XTeink readers. And finally the @BugBountyDEFCON to talk about AI slop!

[Katie Paxton-Fear @InsiderPhD]

@_Freakyclown_ Las Vegas, London and New York are the worst places I could imagine ever living

[Katie Paxton-Fear @InsiderPhD]

I’m always amazed that there are normal people in Las Vegas during HSC, wdym you don’t work in cyber security and you chose to come here???

[Katie Paxton-Fear @InsiderPhD]

@_Freakyclown_ We listen but we don’t judge 👁️👄👁️

[Space Rogue @spacerog]

Got a hot take? Here are other hot takes people have left for @semgrep at @BSidesLV Come share yours!

[Katie Paxton-Fear @InsiderPhD]

@Cthulhu_Answers I was chatting to the guy next to me on the flight and he is going to an AI conference this week which is kind of the same thing

[Lena Yu @LambdaMamba]

We stan Professor Semgrep @InsiderPhD @BSidesLV 🐸🎓

[GameHacking.GG @GameHackingGG]

Schedule for the workshops happening in the village! Hope to see you all there!

[Katie Paxton-Fear @InsiderPhD]

https://t.co/BKotQMLCGq

[💎Sylvonyx💎 @Sylvonyx]

some pogey variations i did for a c⟡mm project!

[Katie Paxton-Fear @InsiderPhD]

@s1renhead__ I take no credit! We have the incredible artist @Sylvonyx to thank for bringing the idea for life, they turned my scribbling notes into actual designs!

[Katie Paxton-Fear @InsiderPhD]

Gotta catch ‘em all! Come find me or swing by the Semgrep Booth today to collect the first of the Semgrep Threat Dex stickers, 22 designs, each represents the last year in cyber security, from CISA and CVEs to Shai Hulud, new designs every day 🔥

[💎Sylvonyx💎 @Sylvonyx]

some pogey variations i did for a c⟡mm project!