Kirill Firsov

Co-founder and CTO of @FearsOff | Protecting the World’s Top Crypto Exchanges & Financial Institutions | Cybersecurity Enthusiast

[Kirill Firsov @k_firsov]

Our latest research is out!

If you missed a good write-up for nice vulnerabilities, I brought you one!

Enjoy the reading! @FearsOff @Cloudflare

[Kirill Firsov @k_firsov]

claude --dangerously-skip-permissions --model claude-opus-4-8
Let's go! #anthropic

[Kirill Firsov @k_firsov]

@hetmehtaa I like your self-criticism 😂

[Kirill Firsov @k_firsov]

@rez0__ As many people as many opinions. Both of them are doing what it has to in a certain way

[Kirill Firsov @k_firsov]

@uglybyte @h4x0r_dz He did

[Kirill Firsov @k_firsov]

@Cointelegraph I claim it too, write a post about it now.

[Kirill Firsov @k_firsov]

@zachxbt Nice one. How it was recognized in the beginning that the device was linked to a DPRK worker though? I understand the connection in the end but before doing that via luckyguys it has to be some sign for that.

[Kirill Firsov @k_firsov]

@hetmehtaa It's a simple status set by him :) You got me tho

[Marwan Hachem @mar1hachem]

Kudos to the teams of @Bitrefill and @FearsOff for handling this incident with the utmost professionalism and transparency.

‘What doesn’t kill you makes you stronger’, especially in cybersecurity.

[Kirill Firsov @k_firsov]

@IceSolst He got good views count though, I guess that was the plan

[Kirill Firsov @k_firsov]

@vigneshrajan_10 Try looking at it from a different angle, that's a way to level up.

[Kirill Firsov @k_firsov]

So much drama today, people losing their minds over this "new" feature from Anthropic, calling it the death of pentesting and bug bounties. Even stocks tanked for companies that have nothing to do with it. Why?
Because most investors in this space don't know shit about security or what Claude AI actually dropped. We have been running vulnerability scans with various AI models, including Opus 4.6 for months already. This release is basically just a handy button to run what used to be a chain of prompts doing the exact same thing.
Investors: Buy back in.
Bug hunters and pentesters: relax and level up with it. Anthropic’s social media team: Bravo! This clickbait worked out!

[Claude @claudeai]

Introducing Claude Code Security, now in limited research preview.

It scans codebases for vulnerabilities and suggests targeted software patches for human review, allowing teams to find and fix issues that traditional tools often miss.

Learn more: https://t.co/n4SZ9EIklG

[Kirill Firsov @k_firsov]

@RoseSilicon No, not right now. Humans still pick better targets or those're missed by AI. better handle evasion in tricky envs and so on...

[Kirill Firsov @k_firsov]

@AiNomadDev Right??

[Kirill Firsov @k_firsov]

Thanks for the article, a good reading. Many points make sense. Remember times where sqlinj were left and right? That time has gone, then was time for path traversal, still there but much less. Now we assume we should see less any other types of vulnerabilities because AI covers them, yet don't forget it's now AI who writes them in the first place. Besides that I have in mind so many scenarios where I can find a bug but AI won't, at least for now. So let's use a quote from the article: no need to panic but embrace AI

[Kirill Firsov @k_firsov]

@ctbbpodcast No, you can't. It was fixed before I published it

[Kirill Firsov @k_firsov]

@hetmehtaa But why if you here on X in your feed see everything :)

[Kirill Firsov @k_firsov]

@S1r1u5_ Same. Zero seconds of real suspense, yet it sells the "I’m nervously waiting" vibe though.

[Kirill Firsov @k_firsov]

@h4x0r_dz Smallah

[Kirill Firsov @k_firsov]

Stealing a violin doesn't make you a musician. Hacking/buying a cert doesn’t make you "elite" either. It just makes you a criminal... and the one who cheated on the test and still can’t do the job.

If your definition of skill requires breaking the law, you don't have any.

But go on with the "no cert = skid" detective work

[Kirill Firsov @k_firsov]

You don't need them for pentesting companies either.

Most hackers don't have any certs, so why would some corporate bureaucracy tell me I'm not qualified to work with them just because I lack some XXX certificate?

OK, let's wait until you get hacked and see how well that bureaucracy holds up then.

[Intigriti @intigriti]

|￣￣￣￣￣￣￣￣￣￣￣|
You don't need certs
to be successful in
bug bounty
|＿＿＿＿＿＿＿＿＿＿＿|
\ (•◡•) /
\ /
---
| |