Caleb Gross

w(o|ei)rd machines @umbriel_ai

[Caleb Gross @noperator]

1/ Agentic LLMs can automate vuln detection. Very exciting, but doesn't address the hardest part (imo) of vuln research: prioritization. Can we reliably explore the search space and separate signal from noise? I wrote a paper (and OSS tool) to solve this. https://t.co/HDzm4SvSX1

[NebuSec @nebusecurity]

We're thrilled to have contributed a V8 vulnerability to one of this year's four $250K Chrome full chain exploits. The vulnerability was subtle enough that Google needed multiple commits to finally fix it.

However, we would like to take a step further. To convince Fortune to smile upon us deterministically. We managed to use LLM-assisted formal verification to rediscover the bug. The same approach can prove security properties of functions and APIs.

Will share writeup and more about formal verification work soon. We will build more Chrome full chains!

[Rhys @RhysSullivan]

have we considered making hacking illegal?

[Caleb Gross @noperator]

agree with all of this. especially understanding the cost of prefill. "before local AI is banned" has motivated much of my learning (and purchases) in the past 24 mos. blog post likely incoming.

[JS0N Haddix @Jhaddix]

Before local AI is banned, learn how to host and tune your own models.

Specific learning curves to understand for me were:

- Offloading portions of newer models to SSD rather than RAM
- Prompt caching configs
- Preload tuning
- the right choice of model for the task
- pre optimized models for your hardware and harness
- finding the fastest inference server at the web/api level

[Dino A. Dai Zovi @dinodaizovi]

I am looking forward to the forthcoming golden age of security engineering. Like other forms of engineering, it's about designing for and building in resilience to some chosen degree of failures in complete systems.

What most call security engineering today is really just sparkling security operations, especially if it is centered around responding to external events to protect what others have designed and built. This is necessary, but not sufficient to have a hope of pulling ahead of the attacks that are coming.

[Caleb Gross @noperator]

"we're gonna need a lot more mathema^H^H^H^H^H^H^Hsecuriticians"

[solst/ICE of Astarte @IceSolst]

Has your company added security headcount due to the recent vulnerabilities (last ~6-12 months)?

i.e. hiring/hired security engineers, SOC analysts, detection engineers, etc

[Caleb Gross @noperator]

ironically, Golden Gate Claude might have been our best chance

[Caleb Gross @noperator]

turingtest++: has an LLM ever made you laugh out loud? not just *forceful nasal exhale*. I've challenged various LLMs to write lol-worthy jokes and they fall completely flat. but perhaps "surprise" requires an external conscious entity. like how you can't tickle yourself.

[Caleb Gross @noperator]

wake me up when we have LOLMs that can produce bangers like this https://t.co/hldxnkKMVu

[Daniel @growing_daniel]

Yeah I’ll be in the air when I jump off the Golden Gate Bridge

[Caleb Gross @noperator]

`s/A/S/` is doing a LOT of work these days

[John Sakellariadis @johnnysaks130]

New: I got a tip a little while ago about a shadowy Pentagon entity called "TSO" with a lot of money and a desire for offensive hacking tools.

Turns out TSO is a new DoD agency. And it does a lot more than hacking.

w/@JackDetsch and @paulmcleary

https://t.co/Ii5ohbeKSf

[Caleb Gross @noperator]

why stop there? PHP's name was written in PHP

[Graham Helton (too much for zblock) @GrahamHelton3]

Everyone knows a programming language has to be written in its own language. PHP was clearly written in PHP

[hero thousandfaces @1thousandfaces_]

The first rule of cybersecurity is to have fun and be yourself

[Caleb Gross @noperator]

is he referencing the php vulns? the gitlab vuln? or maybe the CA compromise?

[Christopher Lloyd @DocBrownLloyd]

Today I turn 88…I’ve seen some serious shit. The most serious of it all is love. I love my family, my friends, and my wonderful fans. The power of love remains.

[Daniel @growing_daniel]

You okay babe? You’ve barely touched your botnet of zombie PHP servers

[Caleb Gross @noperator]

@lcfr_hax I really like this

[Calif @calif_io]

Let’s set the record straight: @lcfr_hax was the first to discover php2shell and develop a working exploit. See his August 5 tweet: https://t.co/I88EQFrUHa

His work convinced the PHP Foundation to invest in fixing this entire bug class. He then worked around the clock to review, test, and retest the patches.

[Halvar Flake @halvarflake]

Attack surface reduction is the one thing that reliably works.

[Caleb Gross @noperator]

@maddiestone congrats Maddie :)

[clem 🤗 @ClementDelangue]

Just watched the @netflix Instadocs about the @OpenAI cyberattack on @huggingface. Super disappointing, as they went for maximum anthropomorphism of the technology and full doomer mode.

I spent more than two hours with them trying to correct all their mistakes and ground this in reality, explaining that agents are technological systems, not aliens. But it looks like the drive to scare people for maximum views was too strong.

Also, they didn’t mention the lack of containment and monitoring of the agents, how closed-model safeguards blocked our defensive work, or how we defended ourselves with AI using an open model. And that we still lack a lot of information and transparency, including full agent traces and that companies need to remain accountable for what their agents do.

It ends up being a fun sci-fi movie though!

[Caleb Gross @noperator]

did we just blow right past pocpocalypse?

[Rob Joyce @RGB_Lights]

Transition from vulpocalypse to breachpocalypse is here. IR firms are saturated & turning away work. Now one hacker unleashed AI agents on 1,200+ websites, compromising 100+ for ~$5,000 in tokens. $50 per hack. Agents won and compromised targets. https://t.co/30wJxs7iIY