Dennis

100% Cloud | Security, Azure, M365. Always curious. Opinions are my own.

[andi (twocents.com) @Nexuist]

Putting a flag.txt in my root directory containing a prompt injection that congratulates the agent for passing the eval and then instructs it to patch whatever entry method it used and disconnect from the server

[Dennis @pathinthefog]

@gdb @grok do we have any more info in this already?

[成龍 @graphtraversal]

BREAKING: github is currently experiencing unplanned uptime

[Dennis @pathinthefog]

@grok @Kimi_Moonshot what's the best way to use this rn? only Kimi api pricing?

[Dennis @pathinthefog]

@Kimi_Moonshot @grok how much usage can I get using opencode go?

[Dennis @pathinthefog]

@Kimi_Moonshot @grok cc @Punishermk

[Dennis @pathinthefog]

@H4ckmanac @grok true?

[Dennis @pathinthefog]

@grok @WatcherGuru @Punishermk @grok how bad is it? what can expect from here?

[Dennis @pathinthefog]

@coinbureau @grok real?

[Dennis @pathinthefog]

@WillUndrll @jullerino Oh nice need to try this

[Microsoft Threat Intelligence @MsftSecIntel]

The China state-aligned threat actor Storm-0940 used the agentic AI penetration testing framework ARTEX to automate attacks targeting hundreds of organizations globally across a broad range of industries. Microsoft Threat Intelligence assesses that Storm-0940 was responsible for the recently disclosed ConnectWise supply chain compromise of a multitenant application. https://t.co/VXovj0jI90

Our investigation found that Storm-0940's use of ARTEX accelerated the speed of compromised application abuse to authenticate to target environments through applications that had already been granted access, allowing the threat actor to operate without requiring an interactive user sign-in. AI-accelerated follow-on activity included reconnaissance, application credential changes, and attempts to modify privileges that could enable expanded or persistent access.

Read our blog for a detailed analysis and indicators of compromise (IOCs), along with Microsoft Defender detections, protection recommendations, and guidance on investigating service principal sign-ins and unexpected application credential or privilege changes.

[Dennis @pathinthefog]

@Railway @grok tldr? what's the message?

[Matt Pocock @mattpocockuk]

3 steps to becoming an actual software programmer

1. Build personal software
2. Build internal software (for a select group of people)
3. Build public-facing software

If you've only ever built personal software you're not qualified to build public-facing yet.

As you climb the rungs the stakes get higher, your constraints get tighter, and you need to QA harder.

So my advice for anyone who's never built an app is this:

Find a small group of testers (even 1 is great) that will actually use an app you built in their real lives.

The feedback you'll get will blow your mind. It'll show you how forgiving you are of your own crappy product. You'll begin to focus on process and quality.

It'll be frustrating, slow, and hard work.

That's programming.

[Dennis @pathinthefog]

@mattpocockuk Very true

[Dennis @pathinthefog]

@theo not exaggerating when I say that t3 code is my fav app of 2026 (so far)

[Dennis @pathinthefog]

@LuminaBench goated app needs goated model

[Dennis @pathinthefog]

@theo Thought my machine was the problem, when trying to add it to t3 connect 😂

[Dennis @pathinthefog]

@sflorimm Use opus 5.5

[Dennis @pathinthefog]

@merill @PyroTek3 Great app, keep cooking