Holyfield

Mobile and Web Security Researcher

[Anthropic @AnthropicAI]

We're publishing our most detailed threat intelligence report to date.

It covers how people tried to misuse Claude—for cyberattacks, influence operations, surveillance, biology, and building weapons—and how we found and stopped them.

We disrupted every operation in the report, and used the lessons from them to strengthen our safeguards. Where appropriate, we also shared what we found with authorities and other AI companies.

These cases are not typical: we’re highlighting some of the most sophisticated misuse we’ve seen. But they’re especially important to discuss, because they show us where AI misuse is headed, where our safeguards work, and where they need to improve.

We’re publishing this report so others can spot the same activity on their own platforms, and so we can give the public a clearer view of how emerging threats develop.

Read the report: https://t.co/0EJUnYEgfz

[Tech with Mak @techNmak]

In 1948, a 32-year-old at Bell Labs published a paper nobody fully understood.

Engineers found it too mathematical. Mathematicians found it too engineering-focused. One prominent mathematician reviewed it negatively.

That paper - "A Mathematical Theory of Communication", became the founding document of the digital age.

The man was Claude Shannon. Father of Information Theory.

At 21, he wrote the most important master's thesis of the 20th century.

Working at MIT on an early mechanical computer, Shannon noticed its relay switches had exactly two states - open or closed. He had just taken a philosophy course introducing Boolean algebra, which also operated on two values: true and false.

Nobody had ever connected these two things.

His 1937 thesis proved that Boolean algebra and electrical circuits are mathematically identical, and that any logical operation could be built from simple switches.

Howard Gardner called it "possibly the most important, and also the most famous, master's thesis of the century."

Every digital computer ever built traces back to this insight.

At 29, he proved that perfect encryption exists.

During WWII, Shannon worked on classified cryptography at Bell Labs. His work contributed to SIGSALY, the secure voice system used for confidential communications between Roosevelt and Churchill.

In a classified 1945 memorandum, he mathematically proved the one-time pad provides perfect secrecy, unbreakable not just computationally, but provably, permanently, against an adversary with infinite power.

When declassified in 1949, it transformed cryptography from an art into a science. It laid the foundations for DES, AES, and every modern encryption standard.

At 32, he defined what information is.

His 1948 paper introduced one equation:
H = −Σ p(x) log p(x)

Shannon entropy. The average uncertainty in a probability distribution. The minimum bits required to encode a message.

Three things followed:

> He defined the bit - the fundamental unit of all information. His colleague John Tukey coined the name.

> He proved the channel capacity theorem, every communication channel has a maximum rate of reliable transmission. You can approach it. You can never exceed it.

> He unified telegraph, telephone, and radio into a single mathematical framework for the first time.

Robert Lucky of Bell Labs called it the greatest work "in the annals of technological thought."

Where his equation lives in AI today:

Cross-entropy loss - the function training every classifier and language model, is derived directly from H. Decision tree splits use information gain, which is H applied to data. Perplexity, the standard LLM evaluation metric, is an exponentiation of cross-entropy.

Every time a neural network trains, Shannon's formula runs inside it.

He also built the first AI learning device.

In 1950, Shannon built Theseus, a mechanical mouse that navigated a maze through trial and error, learned the correct path, and repeated it perfectly. Mazin Gilbert of Bell Labs said: "Theseus inspired the whole field of AI."

That same year he published the first paper on programming a computer to play chess. He co-organized the 1956 Dartmouth Workshop, the founding event of AI as a field.

The man:
He rode a unicycle through Bell Labs hallways while juggling. He built a flame-throwing trumpet, a rocket-powered Frisbee, and Styrofoam shoes to walk on the lake behind his house.

He called his home Entropy House.

When asked what motivated him: "I was motivated by curiosity. Never by the desire for financial gain. I just wondered how things were put together."

In 1985, he appeared unexpectedly at a conference in Brighton. The crowd mobbed him for autographs. Persuaded to speak at the banquet, he talked briefly, then pulled three balls from his pockets and juggled instead.

One engineer said: "It was as if Newton had showed up at a physics conference."

He died in 2001 after a decade with Alzheimer's, the cruel irony of information slowly leaving the mind of the man who defined what information was.

Claude, the AI model, is named after Claude Shannon, the mathematician who laid the foundation for the digital world we rely on today.

[Priyanka Vergadia @pvergadia]

🤯BREAKING: Researchers just mathematically proved that AI layoffs will collapse the economy: and every CEO already knows it.

The AI Layoff Trap. A game theory paper from UPenn + Boston University is glaringly important!

100K+ tech layoffs in 2025. 80% of US workers exposed. And no market force can stop it.

→ Every company fires workers to cut costs
→ Every fired worker stops buying products
→ Revenue collapses across every sector
→ The companies that fired everyone go bankrupt

It's a Prisoner's Dilemma with math behind it. Automate and you survive short-term. Don't automate and your competitor kills you. But everyone automating destroys the demand that makes all companies viable.

UBI (universal basic income) won't fix it.
Profit taxes won't fix it.
The researchers found only one solution: a Pigouvian automation tax "robot tax"

The AI trap on the economy is here!

[Stephen Wolfram @stephen_wolfram]

Attacking the P vs. NP problem with ruliology ... the beginnings of empirical theoretical computer science
https://t.co/JSCKXGx1Fg

[Michael Nielsen @michael_nielsen]

Scott Aaronson's short book on P vs NP: https://t.co/86n2m208yH I've only skimmed, but it looks great!

[vittorio @IterIntellectus]

this is actually insane

> be tech guy in australia
> adopt cancer riddled rescue dog, months to live
> not_going_to_give_you_up.mp4
> pay $3,000 to sequence her tumor DNA
> feed it to ChatGPT and AlphaFold
> zero background in biology
> identify mutated proteins, match them to drug targets
> design a custom mRNA cancer vaccine from scratch
> genomics professor is “gobsmacked” that some puppy lover did this on his own
> need ethics approval to administer it
> red tape takes longer than designing the vaccine
> 3 months, finally approved
> drive 10 hours to get rosie her first injection
> tumor halves
> coat gets glossy again
> dog is alive and happy
> professor: “if we can do this for a dog, why aren’t we rolling this out to humans?”

one man with a chatbot, and $3,000 just outperformed the entire pharmaceutical discovery pipeline.

we are going to cure so many diseases.
I dont think people realize how good things are going to get

[André Baptista @0xacb]

Many people overlook Android hacking due to the challenges associated with configuring emulators and proxies.

Thankfully, there's a comprehensive guide from @bugcrowd that walks you through the setup process, making it much easier to get started with mobile hacking!

https://t.co/dygP30CTa9

[Frida @fridadotre]

Frida 17.4 introduces Simmy, a new backend for Apple’s Simulators on macOS.

Spawn, attach, and instrument apps — just like on a real device.

[Anna Lulis @annamlulis]

Incredible.

A café employs people with Down syndrome to affirm their humanity and break societal stigmas.

An extra chromosome does not determine a person’s worth or humanity.

We need more of this.

[HackerOne @Hacker0x01]

Congratulations to the #H1468 award winners! 🎉 Thank you for your incredible work in Stockholm. Your contributions help make the digital world safer for everyone.

Most Valuable Hackers & Best Collaboration:
-blaklis
-snorlhax
-doomerhunter

Eliminator:
-holyfield

Eradicator & Exterminator:
-rhynorator

Community Choice:
-joaxcar

Epic Unreal Hacker:
-ali

[Charles Guillemet @P3b7_]

🚨 There’s a large-scale supply chain attack in progress: the NPM account of a reputable developer has been compromised. The affected packages have already been downloaded over 1 billion times, meaning the entire JavaScript ecosystem may be at risk.

The malicious payload works by silently swapping crypto addresses on the fly to steal funds.

If you use a hardware wallet, pay attention to every transaction before signing and you're safe.

If you don’t use a hardware wallet, refrain from making any on-chain transactions for now.

It’s still unclear whether the attacker is also stealing seeds from software wallets directly at this stage.

Excellent report here: https://t.co/5CtiZJHYsN

[Intigriti @intigriti]

Getting started in mobile hacking? 😎

Check out Medusa by @Ch0pin! A framework to help you pentest Android & iOS mobile applications!

🔗 https://t.co/GUHUo4fuQ5

[Shaechi Security Research @ShaechiSec]

New blog post: A journey in Android physical memory - writeup on exploiting recent GPU bug CVE-2025-21479 https://t.co/9aSzddEzK3

[Sergey Toshin @_bagipro]

New Android host validation bypass technique!

[1/4] All parsed URIs in Android are https://t.co/x8giXOfU0w.Uri.StringUri objects. However, the scheme parser only looks for the ":" delimiter

[shubs @infosec_au]

We’re celebrating Christmas in July this year, starting July 1st. We’ll release a security research post on Searchlight Cyber’s blog each week over the month. To be the first to know, subscribe to our RSS feed here: https://t.co/atJwMlQsRP

[Oversecured @OversecuredInc]

🚨 Security Alert: Over 2 billion Android users and 100 million Pixel users may be at risk of file theft, VPN bypass, unauthorized Bluetooth access, and geolocation leaks. Visit our blog for details.

https://t.co/AUHBs9E4lp

[s1r1us @S1r1u5_]

Pick a niche, become an expert, find bugs maybe even 0days or reverse n-days, and write blogs. Even if you don’t hit those $100k bounties, it’ll be a stepping stone toward a $100k job.

What niche? How to pick? Examples?

infosec being so vast from web3 sec to web2, mobile, desktop, recon, client-side, server-side, cryptography and so on. These are umbrella terms, but if we zoom in, there are specific areas where spending a lot of focused time will make you a top 20 expert -- 100% sure.

The key thing is, that the current top 20 experts in any niche will eventually be replaced as they get bored or burned out. This leaves room for you, and the easiest way to pick a niche is to learn from an existing expert in the niche, take inspiration, and grind to build on top of it.

1. For instance, I got into the client-side JS niche by following @terjanq’s work. From there, I went down even further to focus specifically on ElectronJS.

2. Another example: @rootxharsh and @iamnoooob their niche is in reversing n-days and finding new ones based on that knowledge. I don’t think anyone in India can compete with them on reversing n-days, writing blogs, and submitting findings to bounty programs.

3. And off the top of my head, @ajxchapman, from his tweets, seems to have a specific niche in V8 n-day exploits. I don’t think there’s anyone else in the web security scene who can write V8 exploits 😅.

4. Like @orange_8361 , pick a complex target and grind on it for months eventually uncovering mind-blowing findings.

5. Or, like @albinowax, choose a complex specification, such as HTTP, and find bugs from every aspect of it from top to bottom
(Sorry for tags xD)

I could list so many more people, but my point is this: if you look at the top bug bounty hunters or experts, there’s a pattern. Their blogs or tweets consistently focus on a specific niche (or two) for years and years. No one ever becomes a pro in a night.

How to Become an Expert in a Specific Niche?

Spend a lot of time. There’s no shortcut. Follow the work of the expert you picked for inspiration, read their blogs, dive into the blogs they learned from, and explore everyone else in that specific niche. Solve CTFs and write about them.

For example, not to make it all about myself, but just as an example. I’ve read every blog from the people I listed as inspirations(https://t.co/5MCSPeoygf) while learning client-side security.

If it’s taking time to understand, you’re likely on the right path. That’s where most people give up, so keep pushing. Just dedicating days to it will put you ahead of at least 100 others. It’s that simple.

Expert = Spent Time × IQ

Find Bugs or 0days, Reverse n-days, and "Write Blogs

Once you’re an expert, finding bugs will start to feel natural. But let’s be real, sometimes you might not get lucky. When that happens, reverse other n-days and write about it. I mean write about anything. Nothing gives you as much exposure as writing blogs: you’re helping others, plus you’re building a network that will eventually help you land a $100k job or $100k bounties.

[André Baptista @0xacb]

We won the MVH title at #h1702 🔥
@NahamSec @ajxchapman

[Ben Sadeghipour @NahamSec]

Had an absolute blast at @Hacker0x01’s #h1702 and I get to take this belt home thanks to @0xacb and @ajxchapman🙏🏼

[Oversecured @OversecuredInc]

🔎📱 We found 20 vulnerabilities in Xiaomi apps that could have let someone steal your data. No worries, it's already fixed. To keep your data safe, update your phone.
https://t.co/sXXQj41Opr