Michael

swe @enclaveai

[Yanir Tsarimi @Yanir_]

To exploit this to RCE you need:

1. ASLR disabled (or some way to leak info)
2. The nginx server configuration to have a "set" + "rewrite" directives. The rewrite has to have '?' in its replacement rule (second arg)

So the attack surface is probably much less than what it seems.

Nice finding and the part about the exploitation is also great, I recommend reading the blog.

[Tal Hoffman @talhof8]

We just shipped v1 of code security review at @EnclaveAI.

A lot has already been said about SAST, AI SAST, and everything in between. We're putting exploitability at the center, with cloud & runtime context coming next!

Free plan is pretty generous (credit card needed), but happy to drop more credits in, if needed (DM me).

[Enclave @EnclaveAI]

Everyone is worried about AI replacing developers. They are looking at the wrong part of the equation.

The reality? AI is creating a gold rush for security professionals.

Look at the PocketOS story. An AI agent overstepped its trust boundaries, wiped a production database, and left the team digging through three-month-old backups.

As autonomous agents become a standard part of the stack, entirely new attack vectors arise. When you grant agents over-permissive access to your infrastructure, the number of ways a system can fail grows exponentially.

In an AI-native world, security is no longer just a department. It is the most important infrastructure a company owns and the hottest job in tech.

https://t.co/URzASaDGtj

[Yanir Tsarimi @Yanir_]

A year ago a friend asked me if LLMs could actually find real vulns.

I told him: maybe in 5 years.

A few weeks ago we started digging into OSS. What came back was bigger than expected. Vulnerabilities in packages sitting inside 100k+ repos, quietly affecting servers at Fortune 500s and major cloud infrastructure. Nobody had found them yet.

And I never opened Burp Suite once.

I just sat there staring at the screen. It felt surreal.

These weren't trivial bugs. Real back-and-forth, nudging, course correction. But the model got there. On critical infrastructure. On its own.

Here's the thing nobody talks about: the hard part isn't reproducing a known vuln. It's finding the one nobody's looked for yet. That's the gap we've been obsessing over.

That's what Enclave does. Autonomous security research, starting with the bugs hiding in the open source your stack depends on.

Still a lot to figure out. But I haven't felt this excited about security in a long time.

If you're a security researcher or work in AppSec, I'd love to show you what we're building. DMs open.

[Enclave @EnclaveAI]

The AI speed trap ends today. Enclave is officially out of stealth.

We have raised 6M in seed funding led by @8VC to solve a critical friction point: AI is writing code at 10x speed, but security oversight is still stuck in low gear.

[Michael @michag0d]

AI didn't kill developers. It killed average ones. ⚡

Since 2023:
— Entry-level hiring: down 73%
— Junior devs using AI: almost no productivity gain
— Senior experts using AI: completely pulling away

The split is brutal. And it's accelerating.

Bruce Lee had the answer in 1970.

Go so deep on one skill that no AI can touch you there. Use AI to handle everything else.

Human depth + AI breadth = an unfair advantage.

Full breakdown 🔗 https://t.co/w8976urapY

[Michael @michag0d]

agree with his type of attitude but disagree on how he would act, as a CTO his daily job (not talking about early days startup ofcourse, where rnd is CTO and 2.5 devs) is to steer the technological future of the company, and decide on big technological decisions, not rejecting prs or deciding to rewrite the entire codebase. You can look at his work with linux kernel, his role there resembles more some kind of CTO than CEO, and the results are great. Kinda sad we didnt get the chance seeing him as a CTO in enterprise company, dude keeps preferring just pure programming than any other thing lol

[Michael @michag0d]

Dream tech startup roster - who ya got?

CEO: Jensen Huang (keynote god)
CTO: Linus Torvalds (kernel king)
CPO: Steve Jobs (reality distorter)
CFO: Jack Bogle (risk slayer)
COO: Elon Musk (execution beast)

Obvious picks? Maybe. But why THESE? Drop your roster + hot takes below 👇

(Poll: Who’s the missing CMO?)

[Michael @michag0d]

Tagging the board:
@jensenhuang @Linus__Torvalds @elonmusk
what’s your vote for CMO?

[Dvir Segev @dvirsegev]

Developers are still required to be familiar with their codebase. You cannot expect to have a security breach and say, “It’s not me, it’s Claude!.”

[Michael @michag0d]

@SolanaSensei Hey sensei, would like to know if you hire SWE by any chance. Been following you for almost 4 years now and really appreciate you as a person, tried dm'ing you but dms not seem to be open.

[Michael @michag0d]

LinkedIn will be no longer used in 10-15 years from now.
I think all the job process, from application to job description and company pages will be managed in more general social media, like X for example.
And im starting seeing this already started.

[Michael @michag0d]

I have a saying i want to share, it seems like lots of ppl migrating their talks about technology and startup's from LinkedIn to X.
The only benefit Im seeing in LinkedIn rn is to build reputation and recognition among older ppl, who arent using X😅
My Prediction👇

[Michael @michag0d]

@ModestMitkus Hey man, would be happy to apply :)
DM's seem to be blocked, and form doesn't have functionality to upload CV, any mail/other way to share that with u?

[Michael @michag0d]

@nelntz משרות רימוט?

[Michael @michag0d]

@oknikzz satoshi nakamoto

[Michael @michag0d]

@SolanaSensei defi sounds cool

[Michael @michag0d]

@agb1985 @fdotinc sounds crazy dude, would like to read more about it

[Michael @michag0d]

@jacobmparis thats an interesting way to farm 2 followers

[Michael @michag0d]

@polar_sh didnt even know x supports job listing on pages, good luck guys