Abhijeet Pathak

I hack stuff

[0xor0ne @0xor0ne]

Series on using LLMs for vulnerability research (@ZephrFish)

MCP: https://t.co/MT4LbPOVGU
Harness: https://t.co/Boa1uD5BQu

#infosec #llm

[Nicolas Krassas @Dinosn]

A curated list of public-source, research, and commercial tools for AI security and AI-assisted cybersecurity https://t.co/2Hph20rz0c

[mRr3b00t @UK_Daniel_Card]

this has actual moving feet!

https://t.co/qCbspVmAq7

[Bug Bounty Insights 🪄 @bbr_bug]

wrote up the actual habit behind most of my repeat findings on programs I keep coming back to. not new payloads, not a new tool, just refusing to treat recon as something you do once at the start.

full thing here: https://t.co/AbbWEoLsdA

[Joseph Thacker @rez0__]

The hackbot @xssdoctor and I made has found 126 reportable bugs this year 😊 88 were High or Critical!! :)

Check it out: https://t.co/V15zqqx8XR

[JS0N Haddix @Jhaddix]

https://t.co/LjrbXS3PI7

[hacker.house @hackerfantastic]

How to find 0day using local LLM's and "recursive prompting". I used this approach on a NVIDIA DGX Spark using Qwen 3.6 heretic and LLAMA.cpp with LiteLLM and Openclaw. It successfully analyzed a complex FOSS code base and found a single high-risk RCE 0day.

[elvis @omarsar0]

So basically, prompt engineering isn't dead.

Jokes aside, great read!

You leave a lot on the table if you don't prompt agents to fill in your gaps and vice versa.

Enrich conversations with agents by brainstorming, planning, prototyping, visualizing (artifacts/explainers)...

[Aparna Dhinakaran @aparnadhinak]

https://t.co/j4beh1fjcR

[7h3h4ckv157 @7h3h4ckv157]

Local AI for Penetration Testing & Research

source: https://t.co/SpRXJ8nfR8

[Garry Tan @garrytan]

GBrain gives you searchable knowledge

[Thomas Roccia 🤘 @fr0gger_]

FuzzingLabs has created a curated repo of offensive MCP servers you can wire to your agents! 👇

https://t.co/qly5tBhU6J

[Anatoli Kopadze @AnatoliKopadze]

Former Meta top-tier engineer:

"I don't review the code anymore. I got to a point where I never catch anything the agents don't catch."

He runs 20-30 agents at once and ships 20-40 PRs a day, work that used to take a full team a month.

In 55 minutes he explains everything he knows and builds a fully working workflow from scratch.

Watch it, then read the full guide on building loops below.

[divyansh tiwari @DivyanshT91162]

50 USEFUL GITHUB REPOS

1. iFixAi — AI misalignment testing
→ https://t.co/70ZaaoerS3

2. public-apis — free APIs for everything
→ https://t.co/x0Lqj0ww9B

3. build-your-own-x — learn by building
→ https://t.co/B90mE5QXL7

4. developer-roadmap — learn any tech skill
→ https://t.co/RJyKUICbdr

5. free-programming-books — thousands of free books
→ https://t.co/2rIJ6mHZdO

6. system-design-primer
→ https://t.co/9rxbzvuWKH

7. coding-interview-university
→ https://t.co/KJRRiNB47r

8. the-art-of-command-line
→ https://t.co/sVkCByHcKn

9. project-based-learning
→ https://t.co/i4uFJZZYGy

10. you-dont-know-js
→ https://t.co/RihoXzQK5O

11. the-book-of-secret-knowledge
→ https://t.co/9zK6aUA50h

12. tech-interview-handbook
→ https://t.co/psMHXgUX8k

13. awesome-selfhosted
→ https://t.co/rb3ApMdnz3

14. javascript-algorithms
→ https://t.co/ew4KoQBTaL

15. 30-seconds-of-code
→ https://t.co/YjUvaPWR2G

16. github gitignore templates
→ https://t.co/gnA0OGX3lD

17. ollama — run LLMs locally
→ https://t.co/S8br6zjTG6

18. langchain
→ https://t.co/75poEyxIhD

19. n8n automation
→ https://t.co/yMQp32hMKm

20. openclaw — local AI assistant
→ https://t.co/4GfDslCxAQ

21. dify — AI app builder
→ https://t.co/jx5BZ1V51R

22. langflow
→ https://t.co/N4SGxEJTqg

23. mem0 — AI memory layer
→ https://t.co/84VphZ0ngp

24. browser-use
→ https://t.co/kqvG8Svs9b

25. crewAI
→ https://t.co/kcpPo5hJ3K

26. MetaGPT
→ https://t.co/WvgwvB0hNo

27. AutoGen (Microsoft)
→ https://t.co/EbcFiRvfgC

28. aider — AI coding assistant
→ https://t.co/9kUXJqtoS3

29. markitdown (Microsoft)
→ https://t.co/5Yvio0YkxI

30. open-webui
→ https://t.co/8EAekWQqW2

31. maigret — OSINT tool
→ https://t.co/3Fts219Qzw

32. TradingAgents
→ https://t.co/hhjynaYZaJ

33. stagehand
→ https://t.co/6Tq8Bc9ppR

34. firecrawl
→ https://t.co/onZ9Vi2dsn

35. transformers (HuggingFace)
→ https://t.co/pVz0Cq6a3g

36. vLLM
→ https://t.co/x66L8ezWXT

37. llama.cpp
→ https://t.co/PnMQT0ZhLG

38. llama_index
→ https://t.co/QbohueIy1Q

39. nanoGPT (Karpathy)
→ https://t.co/7kJza0m4uK

40. RAGFlow
→ https://t.co/5PMueXghET

41. supermemory
→ https://t.co/0rNcPtJmrE

42. awesome-claude-skills
→ https://t.co/YJ5iomRKVg

43. Bumblebee (Perplexity AI security tool)
→ https://t.co/lHUoBpiJhs

44. ComfyUI
→ https://t.co/i6HRTOqfDT

45. DeepSeek (official repo varies by model release)
→ https://t.co/tgACN508n5

46. Lobe Chat
→ https://t.co/t69VqkEIdD

47. freeCodeCamp
→ https://t.co/vpE8ScXQGM

48. system design + interview prep extras (bonus)
→ https://t.co/KJRRiNB47r

49. AI agents ecosystem (extra)
→ https://t.co/75poEyxIhD

50. automation + AI workflows (extra)
→ https://t.co/yMQp32hMKm

Save this before you forget it exists.

You'll come back to at least ten of these.

[divyansh tiwari @DivyanshT91162]

https://t.co/gfboe5NEe1

[Avi Chawla @_avichawla]

Google and Anthropic agree on one thing about retrieval.

They both moved it out of the app and turned it into a standalone service that agents invoke.

- Anthropic's MCP exposes retrieval as a tool that an agent invokes.
- Google ships it similarly, with its RAG Engine sitting under the Gemini agent platform next to MCP servers.

They did this because the old naive RAG setup was built as a one-time pipeline inside a single app, and it caused problems in two places:

- The first is stale embeddings. They reflect the source at indexing time, so the index drifts from the source when a doc or a row changes, and stays wrong until the pipeline is rerun.

- The second is coupled infrastructure. The retrieval logic sits inside one app, so another app duplicates the connectors, chunking, and embedding instead of reusing them.

Both failure modes are resolved by separating ingestion from query and running ingestion as a standing layer.

Ingestion runs continuously with content-hash sync, so only changed data is re-embedded, and the layer sits behind one API, so a chatbot and an agent hit the same index.

The agent then calls that layer as a tool inside a loop. It reasons, runs a search, reads the result, and issues a refined query, instead of retrieving once at the start.

The diagram below depicts all three stages, covering naive RAG, the standing layer, and the agent consuming it.

This helps, but it didn't solve all problems yet because across all three stages, the unit of retrieval is the same, i.e., a chunk of text.

And inherently, a chunk has no idea of a semantic boundary, version, or source info. The splitter cuts documents mostly on token count, so a single chunk can end mid-table or mid-argument.

Because of that, it can pull the top half of a table without the rows, or a conclusion without the reasoning that supports it.

Moving to a structured unit, embedding a question with its validated answer, addresses this.

My co-founder wrote a full breakdown on solving this. It replaces raw chunks with structured blocks that carry their own source and version.

The approach reduces corpus size 40x and improves vector relevance 2.3x.

Read it below.

[shmidt @shmidtqq]

https://t.co/IOwc8IKXsr

[divyansh tiwari @DivyanshT91162]

Repo:
https://t.co/cNWy2uQ4kB

[Swissky @pentest_swissky]

One Month Letting Claude Code Hunt Bugs For Me - @0xEdra
https://t.co/CTp7idMAtG

[Nicolas Krassas @Dinosn]

0liverflow/cve2poc: CVE2PoC is a tool that helps penetration testers, bug hunters, and security researchers quickly find public exploits or PoCs related to a CVE ID https://t.co/ggJxFLaMae