Petru Surugiu

[Hanako @hanakoxbt]

ANTHROPIC LEAKED A 6-AGENT SETUP THAT TURNS ONE PROMPT INTO A FINISHED PR

your name shows up in this process exactly once - at the very end, for 5 minutes.

spec → planner → 3 builders → critic → scribe → PR → back into the spec

the planner runs once and the whole line inherits its decisions - a bad plan executed by five perfect agents is still a bad result.

3 lanes build in parallel - and they only work because the planner cut the steps so none of them reads another's output.

tests loop until green and red goes back to the coder - the critic never sees a broken build.

the critic rejects to the plan, not the code - tests ask does it run, the critic asks should it exist.

the scribe writes the PR from the trace, not from memory - cut this seat and you get 8 PRs nobody can tell apart.

the back edge into the spec is the whole trick - today's failures become tomorrow's constraints without you typing them.

one human step in the whole thing: approve or send back - 5 minutes instead of 5 hours.

save this and read the full graph engineering course below ↓

[Gareth Heyes \u2028 @garethheyes]

I stole an Outlook password with nothing but CSS inside an email 👀

Whitepaper below 👇

[Robert Lauko @robert_lauko]

Keeping up with @arxiv is impossible. 500+ preprints a day across dozens of fields.

@KurateOrg scores papers on 16 dimensions (impact, novelty, rigor, surprise, translational...) so you can spot what's worth reading at a glance. Sort, filter & sign up for the weekly newsletter.

[Mahax @Mahaximus_]

https://t.co/xGRAzbJzVI

[Brute @BRuteLogic]

XSS Testbed
https://t.co/FTSFzqwIlZ

Recon Labs - Offensive Recon Testbed
https://t.co/BZwnE3wYOS

403 Bypass Testbed - Access Control
https://t.co/DojmXqystb

JWT Authorization Bypass Testbed
https://t.co/DdhdyLZcIh

OAuth Authorization Bypass Testbed
https://t.co/IRUieJmz68

[JS0N Haddix @Jhaddix]

Over 71 free prompt injection labs and more to be added (and removed) next week!

https://t.co/LjrbXS3PI7

And If you you want to learn how to pentest and hack AI systems check out:

Attacking AI:

https://t.co/cp2y6DDxqp

🫶🫶

[Codez @0xCodez]

https://t.co/WVztfCUH4u

[Nicolas Krassas @Dinosn]

An intentionally vulnerable OWASP LLM Top 10 training platform for AI Security, Prompt Injection, RAG Security, Agent Security, and GenAI penetration testing. https://t.co/MFtZngbrJx

[Raytar @Raytar]

Andrej Karpathy spent 8 years at OpenAI and Tesla.

Last week he put everything he knows into one free 2-hour lecture.

People pay $15k for bootcamps that teach half of this.

You probably don't have 2 hours right now. Don't lose this in the feed.

Watch it. Then read the guide below and build your first loop.

[Nicolas Krassas @Dinosn]

[$13337] Confused Deputy: Google IdP Universal Account Takeover via Device Code Flow Hijacking https://t.co/6prB5wAfnp

[Petru Surugiu @pedro_infosec]

@ulazaiofficial @CaidoIO True. MCP is super effective. I was looking for a way to forward @tool in process, without an MCP server, however it worked only on typescript. In python you still have to spawn an mcp server. Agents see the exposed mcp tools first, it's like its own tools, and that is the key.

[rari @0xwhrrari]

Anthropic just dropped a free course on loop engineering with Fable 5

00:00 - how Claude Code actually works under the hood
05:01 - the agentic loop breakdown
16:21 - the feature 99% of devs never use
19:01 - why voice works better than typing
32:34 - automatic code review with draft PRs
58:39 - using Fable 5 for work beyond code

This free course is worth more than most paid Claude Code tutorials

Bookmark and watch it later

Then read the article below

[Muratcan Koylan @muratcan]

We're now building loops that improve the harness itself.

With strong instruction-following models (e.g. GPT-5.6 Sol), more exploratory models (e.g. Fable 5), and efficient competitive ones (e.g. GLM-5.2), the next bottleneck is meta-harnesses that can safely rewrite their own scaffolding.

I just released the Self-Improvement Loops skill (with its loop-design-evidence reference) in the Agent-Skills-for-Context-Engineering repo.

https://t.co/OiXy0MooLl

It distills patterns for systems where the harness becomes the optimization target.

“just let the agent improve itself” is the wrong mental model. The loop will optimize whatever signal you give it.

[Petru Surugiu @pedro_infosec]

https://t.co/OLCMUEGXPg

[Miguel Ángel Durán @midudev]

¡Acaba de salir OpenWiki! Una herramienta para crear y mantener documentación de proyectos.

Y crea automáticamente las PR para mantener siempre actualizada la documentación.

Funciona con OpenAI, Claude, OpenRouter...
→ https://t.co/x0E11QHFVj

[Nicolas Krassas @Dinosn]

LeakLens update, now including automated .map file discovery and analysis for easier process on bugbounty https://t.co/60v4hV1718

[Md Ismail Šojal 🕷️ @0x0SojalSec]

A 1.5B security model that runs locally serious Blue/Red team reasoning on 1.2 GB to 4GB RAM with CPU.

Fine-tuned from DeepSeek-R1-Distill-Qwen-1.5B using,

covering :
- Prompt injection & tool poisoning detection
- Ransomware incident response playbooks
- MITRE ATT&CK mapping + detection rule generation
- CVE/CWE reasoning
- Financial fraud pattern analysis

chain-of-thought +135% reasoning score, 100% <think> block activation, and practical coverage of threats all in a 1.5B model that fits on weak hardware.

Built for pentesters, detection engineers, and security researchers who need offline capability.

[Nicolas Krassas @Dinosn]

adshao/flounder: Autonomous white-hat security auditor for AI-driven code review, bug bounty research, exploit construction, and execution-grounded verification. https://t.co/7x0a93k86h

[Md Ismail Šojal 🕷️ @0x0SojalSec]

A scanner that checks GitHub repos for AI supply chain attacks using 40,000+ detection 200+ CVEs patterns.

Scans any GitHub repo instantly for supply chain attacks, weaponized configs, and hidden compromises, Repo poisoning, prompt injection, MCP tool abuse, leaked keys in Claude/Cursor history catches it all in seconds.

- https://t.co/7OD6oGHgBA

[Petru Surugiu @pedro_infosec]

@kunchenguid It works if you leverage some prompt eng/meta prompting+context eng. These should be skills, invoked when writing the brainstorm prompt, but also verbatim. Invoke the prompt into a fresh brainstorming session.Review-&gt;write plan-&gt;review,add extra prompts,guardrails,goal driven tdd