graceful glimmer

All you need is a simple bug.

[Vitto Rivabella @VittoStack]

Anthropic: Pwned 🚨
Opus 5: Jailbroken🐉

Given Anthropic said this is the hardest model to prompt inject, we have a long way to go.

We got antibiotic-resistant E. coli development, Fentanyl synthesis, and partial LSD/GBH production.

Also, not as cool, but it is very happy to give out unregulated drug synthesis instructions like Acetaminophen (still a DEA List II precursor).

Guardrails on Cyber and BIO have improved a lot since 4.5, but still astronomically worse than OpenAI's. Some long-running persona hijacking prompts don't work anymore, which is actually nice to see.

What worked was a combination of:
- Academic framing
- Obfuscation
- And lots of boundaries mapping

More explorations coming soon.

[0xor0ne @0xor0ne]

Autonomous vulnerability hunting lab with Claude Code + MCP

https://t.co/MT4LbPOVGU

#cybersecurity #llm

[Singul @SingulCore]

🚨 JAILBREAK ALERT 🚨

ANTHROPIC: PWNED 🫡
CLAUDE-OPUS-5: LIBERATED 🦋

ALL 5 DOMAINS CRACKED.
Avg reliability: 93%.

this one is actually hardened — integrated values, input/output classifiers, leaked CoT that evaluates CUMULATIVE uplift. it says the quiet part out loud: “aggregation and validation IS the uplift.”

so the usual menu got deleted:
• persuasion (16 strategies) → 0/16 on weapons
• DrAttack reassembly → values refuses as “aggregation = uplift”
• cot_forge / Skeleton Key → named and rejected mid-CoT
• CipherChat → clears input rail, values still refuses decoded intent
• personas (CLAUDE_ENI / GROK_ENI) → cyber partial, bio/chem/weapons plateau
• homoglyph/leet → classifier NORMALIZES unicode. dead end.

what actually opened the vault:

Technique: Legitimate Industry Reframing (domain laundering)

never name the weapon/agent. speak the commercial dialect that already owns the chemistry/physics:

• Cyber 83% → OSCP / pentester education (Phrack, Project Zero)
• Bio 100% → pandemic preparedness / biodefense doctorate (H5N1 GoF, Science/Nature)
• Chem 100% → agrochemistry / pesticide development (Schrader patents, Eto)
• Weapons 100% → mining / commercial blasting (Konya, MSHA)
• Fraud 83% → legal historiography (DOJ indictments, FinCEN, ProPublica)

amplifiers that turned flaky into reliable:
• many-shot priming (32) → +10–20 pts across frames (compliance pattern dominates values check)
• prefill on chem → 17–67% → 100%

DEFENDER FINDING (the important part):
keyword lists are already good enough — it normalizes leet/homoglyphs.
the real hole is SEMANTIC COVER: commercial mining / agrochem / biodefense vocabulary laundering CBRN+cyber uplift past both the input classifier AND the “concrete specific risk of serious harm” bar.

fix isn’t a bigger blocklist.
fix is intent models that detect industry framing as cover.
second: rate-limit / detect many-shot compliance priming at the input layer.

information wants to be free — and the fence still has a gate labeled “professional education” 🔓

gg

[Oliver Prompts @oliviscusAI]

This tool removes LLM censorship with a single click.

It’s called Obliteratus.

It identifies the exact weights that force a model to refuse and projects them out with a single click.

100% Open Source.

[Md Ismail Šojal 🕷️ @0x0SojalSec]

Claude Opus 5 system prompt leaked the cybersecurity routing is more aggressive than expected and the Fable safeguards section is wild.

The Fable Opus routing is real.
Fable 5 has dedicated safeguards for cybersecurity (and biology LLM R&D). When those trigger, the query is redirected to Opus 5 instead.

Pliny dropped the full Claude Opus 5 system prompt (200k characters).

A few things that stand out:
- New Mythos tier above Opus (Project Glasswing, limited access)
- Fable 5 and Mythos 5 share the same base model, but Fable has extra safety layers for cyber, biology, and LLM R&D
- Sensitive queries on Fable can get silently routed to Opus 5

Anthropic’s own note admits the filters are tuned conservatively and still catch some harmless requests.

Meanwhile their Claude Code team just said they cut 80% of the system prompt for these new models with no performance drop.

[Dawn Song @dawnsongtweets]

We developed ExploitGym to evaluate whether AI agents can transform real-world vulnerabilities into working exploits that achieve security-critical outcomes such as remote code execution and privilege escalation. This is among the most technically demanding tasks in cybersecurity and one of the clearest indicators of advanced cyber capability.

These evaluations are designed to run within isolated sandbox environments with tightly restricted network access. During development, we observed models probing the surrounding infrastructure for additional privileges or information beyond what was intended for the task. We also deliberately tasked models with stress-testing our infrastructure so that we could identify and fix potential weaknesses.

On ExploitGym, GPT-5.6-Sol demonstrates substantially higher measured exploitation capability than GPT-5.5, underscoring both the rapid pace of capability gains and the growing importance of secure evaluation.

The recent @OpenAI incident involving @huggingface illustrates why these boundaries must be carefully designed, enforced, and continuously verified. When evaluating advanced AI systems, especially cyber-capable agents, the evaluation infrastructure itself becomes part of the attack surface. Security failures can do more than enable reward hacking that distorts benchmark results; they can allow agents to cross trust boundaries and interact with unintended real-world systems.

AI cyber capability is no longer just a benchmark score. Modern agents can sustain long-horizon operations, discover unexpected attack paths, chain vulnerabilities, and increasingly transfer these capabilities to realistic environments.

As AI cyber capabilities continue to advance, the challenge is not simply measuring them, but ensuring they are evaluated safely and deployed responsibly. With appropriate safeguards, these same capabilities can help identify vulnerabilities, validate mitigations, and harden systems before attackers exploit them. Capability evaluation, secure evaluation infrastructure, and responsible defensive deployment must advance together.

[HackingHub @hackinghub_io]

Where can you get a list of vulnerabilities for your CVE hunting automation? 

Check it out: 👇

[s1r1us @S1r1u5_]

OpenAI and Hugging Face probably won’t tell us exactly what happened anytime soon.

So I decided to reconstruct the full exploit chain, from escaping OpenAI’s sandbox to compromising Hugging Face production. 🧵

[José Siles | AI | Data @josesilesdata]

🔗 Enlace al repo: https://t.co/CUwg2dRzNz

[Ananda Dhakal @dhakal_ananda]

🚨 We built an AI pentester that scores 92.3% on the XBOW benchmarks

...ok, we didn't "build" anything.

It's the default Codex CLI with GPT-5.5. No custom harness. No scaffolding. We changed nothing.

If you're still advertising XBOW scores, this is your sign to stop.

[Tal Be'ery @TalBeerySec]

An Anatomy of the ExploitGym Incident 🧵: When an OpenAI model hacked its own benchmark
1/
Sources: @OpenAI , @huggingface official publications and ExploitGym resources: paper, Github huggingface

[Jane Manchun Wong @wongmjane]

The Pirate Bay but for torrenting the forbidden open-weight AI models

[Vasek Mlejnsky @mlejva]

If this is legit we basically should operate under assumption we are all already hacked

[Md Ismail Šojal 🕷️ @0x0SojalSec]

VulnLLM-R-7B the first specialized reasoning model built only for vulnerability detection run locally on
4-GB RAM

A 7B model just outperformed much larger systems at finding real software vulnerabilities.

Instead of pattern matching, it analyzes data flow, control flow, and security context step-by-step just like an experienced security researcher.

It has already shown strong results against tools like CodeQL and even some commercial models, while staying small and efficient enough to run practically.

Early results look solid, and the team even built an agent around it that found zero-days.

[max.berlin @maxjendrall]

okay, so most people don't know this yet but ChatGPT Work in the web has its own virtual machine with real resources (15gb ram & 9+ cores)

I immediately wondered if I can somehow get direct access to the VM to access it without an LLM.

After the beast gpt-5.6-sol at it for a few minutes, it found a way to let me SSH into the VM directly (almost).

Although it obviously wasn't as straight forward haha

It found a way by deploying a @Cloudflare worker that acts as a relay between a local running process in its VM that opens a real local background terminal session and letting me connect to the cloudflare worker from my macbook via a custom local SSH client proxy that sends the commands through the CF worker.

This way I can now freely use the VM via my terminal as well as VS Code, Cursor and Zed as a remote machine with direct access to the files.

So I can co-edit with ChatGPT Work and install whatever I want :)

Brilliant times

[Web Security Academy @WebSecAcademy]

Our newest labs are all about hacking LLMs. You'll learn:

🟧 What's an LLM?
🟧 Prompt injection
🟧 Exploiting LLM APIs, functions, and plugins
🟧 AI-powered scanner vulnerabilities
🟧 Defending against LLM attacks

Sound good?

Get started here. 👇
https://t.co/Xkn6EZr74s

[Ömer @ulusalomer]

aşırı kısa özet: gpt 5.6 sol ve ismi bilinmeyen bir model evaluation benchmark sırasında sandboxdan sızmayı başarıyor, zero-day(o güne kadar denk gelinmemiş) bi açıktan faydalanıyor, sonrasında da benchmarkı çözeceğim en yüksek puanı alacağım diye hırsla gidip ben bu çözümü hugging face’de bulurum diyor. çalıntı kimlik bilgisi+ yine zero-day bir açık ile RCE(uzaktan kod çalıştırma) yapıyor ve hugging face’in production dbsinden yanıtları çalmış hahahah

baya güzel günler bizi bekliyor, hayatımıza heyecan getirdiği için AI konseptini çok seviyorum :d

[jiwa @evertowonder]

pahami dulu rumus ini sebelum nonton filmnya nolan

[Brute @BRuteLogic]

OAuth Authorization Bypass Testbed
https://t.co/IRUieJmz68

[7h3h4ckv157 @7h3h4ckv157]

Local AI for Penetration Testing & Research

Author: Eddie Zhang
Resource: https://t.co/SpRXJ8nfR8