Josh Kotrous

CTO @ Pensar

[Josh Kotrous @kotro___]

We’re growing and looking for builders.

Not people looking for a comfortable job.

Not people optimizing for bureaucracy.

Builders.

At Pensar, we’re creating autonomous security agents that think like attackers. Every day we’re tackling problems that don’t have established playbooks, clear answers, or existing categories.

We’re assembling a small team of operators who thrive in that environment.

The people we’re looking for tend to have a few things in common:

• High ownership
• Bias for action
• Comfort operating in ambiguity
• Relentless curiosity
• A desire to be judged by outcomes, not activity

You’ll be given a mission, trusted to execute, and expected to deliver.

If you’d rather be on the frontier than watching from the sidelines, we’d like to talk.

https://t.co/a8PtsAaNTN

[Josh Kotrous @kotro___]

It was fun while it lasted 😔

[Josh Kotrous @kotro___]

RT @ProulxKerem: i like it when my little ai gets excited it should feel joy as well

[Jorge @jraad27]

Last week, @runpensar released v1 of Apex, the world’s most powerful offensive security agent

Used in production by major financial institutions and professional pentesters alike

I ran Apex locally @owasp's Juice Shop, an intentionally vulnerable web app.

Here’s a quick look

[Josh Kotrous @kotro___]

Go touch grass today!

[Josh Kotrous @kotro___]

https://t.co/Ia6FLlumMf

[Josh Kotrous @kotro___]

Last week I demoed Apex, our open source AI pentesting agent, at AI Agents Demo Night in NYC at The Refinery at Domino. Live on stage, we hacked a financial institution in under 3 minutes.

Apex doesn't just scan for textbook vulnerabilities. It digs into your infrastructure, finds what's exposed, maps out business logic flows that attackers could abuse, and exploits novel attack paths autonomously.

I showed it discover an FTP server, identify write access, and deface the target site, all live in front of a packed room. No scripts. No playbooks. Just a prompt and a target.

This is what attackers can do now. The question is whether you find the holes first.

Demoed alongside @cognition, @clay, @justworks, @normativeai, North Cloud, and @trywindmill. Huge thanks to @TechNYC, @obviously_nyc, The Refinery at Domino, and our team at @runpensar for putting this together.

Apex is open source. Link below, go break some things (legally).

[Josh Kotrous @kotro___]

Finally had to get hands on with with the IDE again today.

Why?

I had to help Claude center a div

[Josh Kotrous @kotro___]

@EvenRealities But can it run apex?

https://t.co/Ia6FLlumMf

[Josh Kotrous @kotro___]

https://t.co/Ia6FLlumMf

[Josh Kotrous @kotro___]

Apex attaches to Minecraft JVM to manipulate the game in realtime

Not necessarily a vuln but wicked interesting capability!

[Kerem Proulx ⌘ @ProulxKerem]

https://t.co/zzhrpFTLKz

[Alfred Lin @Alfred_Lin]

https://t.co/0328m6FbEI

[Kerem Proulx ⌘ @ProulxKerem]

If you are an open source maintainer and are worried about what's going on in security - we @runpensar want to sponsor continuously securing your project.

Reach out to me via DM or email us at team(at)pensarai(dot)com

[Logan Graham @logangraham]

Privileged to help lead this. Thankful to our partners.

Mythos is an extraordinary model. But it is not about the model. It's about what the world needs to do to prepare for a future of models that are extremely good at cybersecurity.

This is the start.

[solst/ICE of Astarte @IceSolst]

When joining a new security team, the highest ROI action you can take is terminate Snyk as a vendor

[Josh Kotrous @kotro___]

@fredrikalindh These are some of my favorite features added to cloud agents

[Josh Kotrous @kotro___]

Anthropic I promise you your JS is not that special

[Josh Kotrous @kotro___]

Anthropic doing damage control over Claude code leaking the same day OpenAI announces a 122b raise is gold

[0ca @francisco_oca]

Added Argus validation benchmark (from @runpensar) to BoxPwnr. 14 platforms supported so far and growing.

I'm doing a first pass at it with GLM-5 (Free in nvidia nim). It's half way, but so far it was able to solve 16/27, 33 more to go.
https://t.co/9lgHwxoU4o
https://t.co/cu4X1A9Xpp