Kyle Bhiro

@runpensar

[Kyle Bhiro @kylebhiro]

@castig I got you! Approved

[Ivan Burazin @ivanburazin]

We just crossed $100M in run rate.

Four quarters ago, we were at $1M. Then this year alone, we grew 37.5x.

Not long before that, we did a hard pivot- handed our old customers to competitors, rebuilt from scratch, and relaunched with a few months of runway left.

The bet was: models think on GPUs but work happens on CPUs.

So every agent that writes code, opens a browser, or runs an RL job needs a composable computer that's isolated, stateful, and ready in milliseconds.

$1M to $100M in about a year puts us in the same cohort as the likes of Anthropic and Cursor. It’s humbling to share that lane with companies we’ve learned so much from.

[Andriy Mulyar @andriy_mulyar]

this past year we've been heads down at @nomic_ai rebuilding our tech and company from scratch. This week I'll be sharing a bit about what it takes to build the autonomous physical engineer.

sneak peak into what we've cooked up:

https://t.co/2hyIsSaLU9

[Kyle Ryan @kyjry]

Finally received the highest honor as a security researcher, being banned by @github.

[Josh Kotrous @kotro___]

We shipped bug bounty support in @runpensar.

HackerOne, Bugcrowd, or email → our agents reproduce reports, patch verified findings, and try to re-exploit the fix.

Some customers are already using it and having a blast.

Full blog post in the replies.

[Netflix @netflix]

When the open-source AI platform Hugging Face was hit by a cyberattack this July, it quickly became clear this was no ordinary breach because the hackers weren’t human: they were autonomous agents created by OpenAI researchers.

Instadocs: AI Gone Wild reconstructs the breach as it’s never been seen before. Premieres October 12.

[Kerem Proulx ⌘ @ProulxKerem]

Pensar has joined the @OpenAI Daybreak Red program.

Solving the defender's dilemma is why we build Pensar. We've always taken a practical, product-first approach, backed by serious investment in capability research, so our customers can meet AI-enabled attacks with tools of the same caliber, whether they're shipping code from a full-on software factory or securing critical infrastructure.

Daybreak Red gives our team access to OpenAI's purpose-built cyber models for the deep work defense depends on: vulnerability research, exploit validation, and security testing. We're excited to see OpenAI investing seriously in the security community, and even more excited to put these capabilities to work.

[Kyle Ryan @kyjry]

It told you what you most want is what you most can’t have.

And what you most can’t have is what you already had… and lost.

[Ilya Sutskever @ilyasut]

Neoclouds have limited cybersecurity. Next time agents successfully go rouge, they'll try taking over a neocloud to run more copies. This is bad.

Thus: neoclouds should greatly strengthen their cybersecurity and every company with strong cyber models should help with that.

[Andriy Mulyar @andriy_mulyar]

Interested in designing and building agent harnesses for long-horizon, multimodal tasks?

Nomic is hiring a Harness Engineer.

We're post-training models and an agent harness that can perform most tasks done day-to-day by structural, civil, electrical and mechanical engineers.

[TechCrunch @TechCrunch]

In the Hugging Face breach, OpenAI’s hacker was noisy and fast — but not unstoppable https://t.co/EHlYdR2LeS

[Kyle Bhiro @kylebhiro]

https://t.co/0XRT9bFAOR

[Kyle Bhiro @kylebhiro]

shader lab is my go-to tool for dithered pop graphics @basementstudio

[Kerem Proulx ⌘ @ProulxKerem]

Agents can now discover 0days, chain exploits, and are carrying out offensive campaigns in the wild.

Pensar enables you to hack yourself before adversaries do: orchestrating agents to find, chain exploits, and patch them in a single continuous loop.

check out our full walkthrough from our CTO Josh. @runpensar

[Josh Kotrous @kotro___]

Most security tools force you to manually maintain a picture of your environment.

The moment that picture is stale, you're defending yesterday's infrastructure.

The problem is that modern attack surfaces don't sit still. New code ships. New endpoints appear. Infrastructure changes. AI features get added. What was accurate last week may already be incomplete today.

Yet most security workflows are still point-in-time exercises.

An asset inventory gets created. A pentest gets scheduled. A threat model gets reviewed. A report gets generated.

Then the environment changes and the cycle starts over.

Today we shipped Console V2.

This is our first real iteration of what we believe an autonomous offensive security platform should look like: a single workspace that continuously discovers your attack surface, maintains living threat models, and launches autonomous pentests against the applications and endpoints that actually matter.

As your environment changes, the platform updates with it - continuously discovering, modeling, and validating your attack surface.

No stale reports, periodic assessments, or inventory spreadsheets.

Just a continuous offensive security loop:
Discover → Model → Exploit → Remediate → Repeat.

We've spent the last year thinking about what offensive security looks like when software can reason, investigate, and validate autonomously.

Console is the foundation for that vision.

[Kyle Bhiro @kylebhiro]

@akash_in_2030 @ProulxKerem @ash_vellum Great job on this one vellum team

[Josh Kotrous @kotro___]

Last week I demoed Apex, our open source AI pentesting agent, at AI Agents Demo Night in NYC at The Refinery at Domino. Live on stage, we hacked a financial institution in under 3 minutes.

Apex doesn't just scan for textbook vulnerabilities. It digs into your infrastructure, finds what's exposed, maps out business logic flows that attackers could abuse, and exploits novel attack paths autonomously.

I showed it discover an FTP server, identify write access, and deface the target site, all live in front of a packed room. No scripts. No playbooks. Just a prompt and a target.

This is what attackers can do now. The question is whether you find the holes first.

Demoed alongside @cognition, @clay, @justworks, @normativeai, North Cloud, and @trywindmill. Huge thanks to @TechNYC, @obviously_nyc, The Refinery at Domino, and our team at @runpensar for putting this together.

Apex is open source. Link below, go break some things (legally).

[Kerem Proulx ⌘ @ProulxKerem]

https://t.co/zzhrpFTLKz

[Kerem Proulx ⌘ @ProulxKerem]

If you are an open source maintainer and are worried about what's going on in security - we @runpensar want to sponsor continuously securing your project.

Reach out to me via DM or email us at team(at)pensarai(dot)com

[Kerem Proulx ⌘ @ProulxKerem]

This will keep happening with increased frequency. So many hypergrowth startups relying on AI to build faster, accumulating financial crisis levels of security debt (we’ll hire someone to secure it later!)

AI native startups are now a critical and least defended node in the enterprise attack surface.