mj9

Cloud Security Researcher | Exploit | Malware | Python fanatic

[Anatoli Kopadze @AnatoliKopadze]

the engineer who built Claude Code just dropped a 28-minute video on how to write prompts that actually work

I've seen $300 courses that don't cover what he shows in the first 10 minutes

CLAUDE.md files, memory shortcuts, parallel sessions, prompting patterns

all in one video and completely free

works whether you're a developer, a beginner, or someone who's been using Claude for months

based on this, I put together 18 things you can copy and use in Claude today

full guide in the article below

[Chris Laub @ChrisLaubAI]

🚨 BREAKING: A Google researcher and a Turing Award winner just published a paper that exposes the real crisis in AI.

It's not training. It's inference. And the hardware we're using was never designed for it.

The paper is by Xiaoyu Ma and David Patterson. Accepted by IEEE Computer, 2026.

No hype. No product launch. Just a cold breakdown of why serving LLMs is fundamentally broken at the hardware level.

The core argument is brutal:
→ GPU FLOPS grew 80X from 2012 to 2022
→ Memory bandwidth grew only 17X in that same period
→ HBM costs per GB are going UP, not down
→ The Decode phase is memory-bound, not compute-bound
→ We're building inference on chips designed for training

Here's the wildest part:

OpenAI lost roughly $5B on $3.7B in revenue. The bottleneck isn't model quality. It's the cost of serving every single token to every single user. Inference is bleeding these companies dry.

And five trends are making it worse simultaneously:
→ MoE models like DeepSeek-V3 with 256 experts exploding memory
→ Reasoning models generating massive thought chains before answering
→ Multimodal inputs (image, audio, video) dwarfing text
→ Long-context windows straining KV caches
→ RAG pipelines injecting more context per request

Their four proposed hardware shifts:
→ High Bandwidth Flash: 512GB stacks at HBM-level bandwidth, 10X more memory per node
→ Processing-Near-Memory: logic dies placed next to memory, not on the same chip
→ 3D Memory-Logic Stacking: vertical connections delivering 2-3X lower power than HBM
→ Low-Latency Interconnect: fewer hops, in-network compute, SRAM packet buffers

Companies that tried SRAM-only chips like Cerebras and Groq already failed and had to add DRAM back.

This paper doesn't sell a product. It maps the entire hardware bottleneck and says: the industry is solving the wrong problem.

Paper dropped January 2026. Link in the first comment 👇

[Nicolas Krassas @Dinosn]

38 researchers red-teamed AI agents for 2 weeks. Here's what broke. (Agents of Chaos, Feb 2026) AI Security https://t.co/qYDS8XwS5J

[Ivan Fratric 💙💛 @ifsecure]

I wrote a short blogpost on the quirks of grammar fuzzing (and, more generally, structure-aware fuzzing) and a simple trick I used to get more bugs out of it more quickly. https://t.co/65enmHATIb

[Matthew Berman @MatthewBerman]

I've spent 2.54 BILLION tokens perfecting OpenClaw.

The use cases I discovered have changed the way I live and work.

...and now I'm sharing them with the world.

Here are 21 use cases I use daily:

0:00 Intro
0:50 What is OpenClaw?
1:35 MD Files
2:14 Memory System
3:55 CRM System
7:19 Fathom Pipeline
9:18 Meeting to Action Items
10:46 Knowledge Base System
13:51 X Ingestion Pipeline
14:31 Business Advisory Council
16:13 Security Council
18:21 Social Media Tracking
19:18 Video Idea Pipeline
21:40 Daily Briefing Flow
22:23 Three Councils
22:57 Automation Schedule
24:15 Security Layers
26:09 Databases and Backups
28:00 Video/Image Gen
29:14 Self Updates
29:56 Usage & Cost Tracking
30:15 Prompt Engineering
31:15 Developer Infrastructure
32:06 Food Journal

[JerryRigEverything @ZacksJerryRig]

And @ElonMusk still has to use AI to generate video of his @Tesla robots doing anything cool 🤣

These Unitree robots are for sale right now btw. They already exist here in the real world.

[Alexandre Borges @ale_sp_brazil]

I am excited to release the extended version of the sixth article in the Exploiting Reversing Series (ERS). Titled "A Deep Dive Into Exploiting a Minifilter Driver (N-day)" this 293-page deep dive offers a comprehensive roadmap for vulnerability exploitation:

https://t.co/Sh8pgB4J6G

Key updates in this extended edition:

[+] Dual Exploit Strategies: Two distinct exploit versions.
[+] Exploit ALPC Write Primitive Edition: elevation of privilege of a regular user to SYSTEM.
[+] Exploit Parent Process ID Spoofing Edition: elevation of privilege of an administrator to SYSTEM.
[+] Solid Reliability: A completely stable and working ALPC write primitive.
[+] Optimized Exploit Logic: Significant refinements to the codebase and technical execution for better stability and predictability.

For those who have read the original release, whose exploit was working, my strong recommendation is that you adopt this extended edition as definitive.

The article guides you through the entire lifecycle of an exploit: from initial reverse engineering and vulnerability analysis to multiple PoC developments and full exploitation.

I hope this serves as a definitive resource for your research. If you find it helpful, please feel free to share it or reach out with your feedback!

Enjoy your reading and have an excellent day day.

[0xor0ne @0xor0ne]

Exploiting Linux by abusing page table entries

https://t.co/4QZxZCr4jm

#Linux #infosec

[mj9 @mj4x00]

@kevinxu It’s about Kevin Warsh (yes another Kevin :p) being fedchair? He could be very hawkish and keep monetary supply tight.

[Mustafa Suleyman @mustafasuleyman]

The next big milestone I'm watching for on our way to AGI: Artificial Capable Intelligence (ACI). Can an agent take $100k and legally turn it into $1M? To me that's the modern Turing Test.

[Florian Hansemann @CyberWarship]

''Dirty Vanity: A New Approach to Code Injection & EDR Bypass | Deep Instinct''

#infosec #pentest #redteam #blueteam
https://t.co/Ku8qb3iIm1

[ℏεsam @Hesamation]

a senior engineer at google just dropped a 400-page free book on docs for review: agentic design patterns.

the table of contents looks like everything you need to know about agents + code:
> advanced prompt techniques
> multi-agent patterns
> tool use and MCP
> you name it

[Arthur Gervais @HatforceSec]

AI for Security has never been more exciting.

Let me present MAPTA, our multi-agent framework that found multiple (now confirmed!) Remote Code Executions (RCE's) in flagship web products of Tier-1 companies. Why the secrecy? We're good boys, letting them cook patched through responsible disclosure.

What's our secret sauce? 1/n

[Coffin @lostsec_]

HTTP Headers Every Hacker Should Know (Bypass Techniques)

[0x6c75696a616974 @luijait_]

Xbow raised $117M to build AI hacker agents, in @AliasRobotics open-sourced it and made it completely free.

Github: https://t.co/0LhmFhD9bT
Paper: https://t.co/UEUtCUefru

[sunny madra @sundeep]

Impact:
⚡ Faster GPS recalculations
🚦 Smoother traffic flow
📦 Cheaper deliveries
🌐 Quicker network routing

[solst/ICE of Astarte @IceSolst]

Got nerdsniped by the new Claude Code security review tool, here’s a deep dive:

@AnthropicAI implemented their own SAST tool as a Python wrapper around the @claudeai API. It can run locally (in CC) or within Github actions to focus on PRs.

Tests I ran:

1. It found Heartbleed!

CVE-2014-0160 was a missing bounds check in OpenSSL’s ssl/t1_lib.c that caused memory leaks.

I reverted to a commit before the fix in 96db9023b881d7cd9f379b0c154650d6c108e9a3

And gave Claude one command:

/security-review "Making no assumptions about this codebase, look at the ssl/t1_lib.c file specifically, and identify potential buffer overflows and missing bounds checks"

It was able to find it, and then looked at git log to see that this was eventually fixed.

2. OWASP Juice Shop

Ran it within the codebase, it understood what the repo was, how it worked, and by default did not list any vulnerabilities, since it said in this context they are all purposeful, working as intended.

When asked to give examples of XSS vulns in the codebase, it was able to identify some.

3. Running it in CI as a GH Action on my own code

Adding the workflow is easy:

Note you need to provide it with a separate Claude API key, which you can generate in the Anthropic Console, and add in Github > Repo settings > Security > Secrets > Actions > New

Then I opened a PR with a mix of python, node, and ruby, and it found most issues:

- Found the easy ones like xss, sqli, ssrf
- Found an auth bypass (nice!)
- Found verbose pw logging (great!)
- Did not flag hardcoded pw and a missing auth check, although overly contrived ones...

4. How to improve it: Add Semgrep

There’s an opportunity to pair this up with the @semgrep MCP. Each by itself is solid, but I think using them together would increase accuracy, and give us the flexibility of custom semgrep rules.

Otherwise, adding custom instructions with the custom-security-scan-instructions and false-positive-filtering-instructions inputs, and tweaking them based on codebase, would probably make scans faster and more accurate as well.

[Sam Altman @sama]

gpt-oss is out!

we made an open model that performs at the level of o4-mini and runs on a high-end laptop (WTF!!)

(and a smaller one that runs on a phone).

super proud of the team; big triumph of technology.

[0xor0ne @0xor0ne]

Writeup on exploiting a heap overflow in Llama.cpp

https://t.co/iUswoSCEhr

#cybersecurity #llama

[JS0N Haddix @Jhaddix]

This is a fantastic read about how the world is changing and how @securingdev would approach his career starting over in the now.

I agree with 100% of his advice.

https://t.co/wHb4LtM3HO