Patch Pasha

Securing AI before it hallucinates.Hacker, Pwner OSCP

[Patch Pasha @ModelWarden]

@JonnyJohnson_ @yarden_shafir @33y0re even if you deobfuscate the enclave boundaries, afaik they'd use to homomorphic encryption for vault storage

[OpenAI @OpenAI]

Building apps has never been easier.

With Sites, Codex can turn your work, ideas, and plans into an interactive website or app your team can explore, use, and share with a URL.

Rolling out to Business and Enterprise plans, before expanding more broadly.

[Derrick Choi @derrickcchoi]

My colleagues wrote up a great post on using Goals in Codex.

They go through when to use them, what changes when a Goal is active, and how to write Goals that give Codex a clear outcome, constraints and verification criteria.

Also how we designed Goals at the architecture level if you’re curious.

https://t.co/QQfjW2EbPO

[Mr. Buzzoni @polydao]

Atlassian's revenue: $1.79 billion last quarter
Atlassian's move: fire the engineer who built their infrastructure

his move: post a 38-minute breakdown of every system he built, free for anyone to copy

what he revealed:

> Envoy proxy instead of enterprise load balancers
> sidecar architecture for auth, logging, rate limits
> DynamoDB + SQS for async provisioning
> Packer + SaltStack for automated VM deployments at scale

Atlassian charges per employee across 350,000 customers

this guy just handed you the enterprise playbook for free

save this

[Cloudflare @Cloudflare]

Cloudflare's security team spent the last few weeks testing Anthropic's Mythos against fifty of our own repositories. What we learned about offensive AI, why faster patching is the wrong reaction, and what the architecture around vulnerabilities has to look like next. https://t.co/RSrRtIhgaV

[The Hacker News @TheHackersNews]

⚠️ Four malicious npm packages with 3,006 downloads were found delivering infostealers and Phantom Bot DDoS malware.

One package clones leaked Shai-Hulud worm code, while others steal SSH keys, cloud credentials and wallet data.

Full details: https://t.co/ItjZERMMDz

[ChatGPT @ChatGPTapp]

A preview for Pro users: a new personal finance experience in ChatGPT.

Pro users in the U.S. can securely connect financial accounts, see where their money is going, and ask questions based on the information they choose to connect.

Your full financial picture, now in ChatGPT.

[Turing Post @TheTuringPost]

https://t.co/joKTr99rGJ

[OpenAI @OpenAI]

You've been asking for this one...

Now in preview: Codex in the ChatGPT mobile app.

Start new work, review outputs, steer execution, and approve next steps, all from the ChatGPT mobile app. Codex will keep running on your laptop, Mac mini, or devbox.

[ℏεsam @Hesamation]

tech industry is optimizing itself to death.

[sui ☄️ @birdabo]

never deleting this app 💀

bro is gonna wake up with -$300k

[Kilian Lieret @KLieret]

The first ProgramBench task was just solved by GPT 5.5 high/xhigh. Interestingly, high/xhigh picked two different languages for the task (C vs Python). GPT 5.5 xhigh was significantly better than Opus 4.7 xhigh in all metrics. 🧵

[Microsoft Threat Intelligence @MsftSecIntel]

Microsoft is investigating mistralai PyPI package v2.4.6 compromise. Attackers injected code in mistralai/client/__init__.py that executes on import, downloads hxxps://83[.]142[.]209[.]194/transformers.pyz to /tmp/transformers.pyz, and launches a second-stage payload on Linux. The file name transformers.pyz appears deliberately chosen to mimic the widely used Hugging Face Transformers library and blend into ML/dev environments.

The main payload is a credential stealer, but it also includes country-aware logic; it avoids Russian-language environments and contains a geo fenced destructive branch that has 1-in-6 chance of executing rm -rf / when the system appears to be in Israel or Iran.

To mitigate this threat: isolate affected Linux hosts, block 83[.]142[.]209[.]194, hunt for /tmp/transformers.pyz, pgmonitor[.]py, and pgsql-monitor.service, and rotate exposed credentials.

[News from Google @NewsFromGoogle]

The Google Threat Intelligence Group has detected the first known instance of a threat actor using an AI-developed zero-day exploit in the wild. While the attackers planned a wide-scale strike, our proactive counter-discovery may have prevented that from happening. This finding is part of our new report on AI-powered threats.

[OpenAI Developers @OpenAIDevs]

Codex can now help you build AI apps and agents faster with OpenAI APIs using the OpenAI Developers plugin.

[Garry Tan @garrytan]

https://t.co/bqYU0I0prI

[OpenAI @OpenAI]

Today we’re launching the OpenAI Deployment Company to help businesses build and deploy AI.

It's majority-owned and controlled by OpenAI. It brings together 19 leading investment firms, consultancies, and system integrators to help organizations deploy frontier AI to production for business impact. https://t.co/GnyjGFaLLA

[Kyle Jeong @kylejeong]

https://t.co/ZRdHQha7y3

[OpenAI @OpenAI]

Codex now works directly in Chrome on macOS and Windows.

It’s even better at working with apps and sites in Chrome, and now works in parallel across tabs in the background without taking over your browser.

To get started, install the Chrome plugin in the Codex app.

[Anthropic @AnthropicAI]

Our security bug bounty program is now public on HackerOne.

We've run the program privately within the security research community, and their findings have strengthened our products. Now anyone can report vulnerabilities and get rewarded.

Read more: https://t.co/li1QvSTCMs