Perri Adams

@Dartmouth ISTS Fellow & @SAISHopkins Adjunct Prof., inter alia. Former @DARPA, @DEFCON CTF, etc. @DistrictCon, @hexacon_fr, @LABScon_io CFP Review Boards

[Perri Adams @perribus]

Back in 2023, the assessment of the pre-authentication vulnerability in SSH was that it wasn't exploitable on Linux.

For my OffensiveCon 2025 keynote, I wrote enough of an exploit to show, with the right heap groom and stabilization, it's likely exploitable. Then I tried to have AI do it.

Up to @taviso whether that merits switching to Windows 98 :)

https://t.co/KfqmJqvlJu

[Tavis Ormandy @taviso]

If someone get a working OpenSSH exploit from this bug, I'm switching my main desktop to Windows 98 😂 (this bug was discovered by a Windows 98 user who noticed sshd was crashing when trying to login to a Linux server!)

[Royal Hansen @royalhansen]

We won't stop until getting a fix into production is no longer the bottleneck in defending society's critical systems.
https://t.co/F374wW2IJ5

[Claude @claudeai]

Introducing Claude Code Security, now in limited research preview.

It scans codebases for vulnerabilities and suggests targeted software patches for human review, allowing teams to find and fix issues that traditional tools often miss.

Learn more: https://t.co/n4SZ9EIklG

[Sean Heelan @seanhn]

What mathematicians call "literature review" should be familiar to you as "vulnerability research".

Or, put another way: https://t.co/Dm2yWg4r6X is currently the best benchmark for LLM capabilities in finding 0days.

[[email protected] @Zardus]

Hello security researchers! Like it or not, agentic AI is here. It’s time to explore its impact on novel, academic research in cybersecurity. To this end, we’re launching the Conference for Synthetic Security Research (https://t.co/uvE3Fp12L7). Researchers, start your agents!

[Richard Johnson @richinseattle]

Literally the other half of AIxCC that no one paid any attention to

[Perri Adams @perribus]

Great example of what a game changer AI is for lit review (in and of itself a critical capability but should not be conflated with creating novel solutions)

[Mark Sellke @MarkSellke]

Update: Mehtaab and I pushed further on this. Using thousands of GPT5 queries, we found solutions to 10 Erdős problems that were listed as open: 223, 339, 494, 515, 621, 822, 883 (part 2/2), 903, 1043, 1079.

Additionally for 11 other problems, GPT5 found significant partial progress that we added to the official website: 32, 167, 188, 750, 788, 811, 827, 829, 1017, 1011, 1041. For 827, Erdős's original paper actually contained an error, and the work of Martínez and Roldán-Pensado explains this and fixes the argument.

The future of scientific research is going to be fun.

[Perri Adams @perribus]

@yo_yo_yo_jbo @DistrictCon Send [email protected] an email or just submit the bug! The team is currently working on AV support for presentations but there should be a way to accommodate!

[Perri Adams @perribus]

Have a Furby 0-day? A Juicero exploit? A bewitched 🪄PoC for some cursed, End-of-Life 👻 product that your friends keep begging you to stop reverse engineering & touch grass?

We see you: your real friends are at @DistrictCon Junkyard. 9 days to submit your most unhinged bugs!

[Dino A. Dai Zovi @dinodaizovi]

This is not that much different than server-driven UI for mobile apps, where server-side logic controls layout, actions, and flow in mobile app UI. It was created to allow changes faster than a client code release could support.

Software is software and good patterns re-appear.

[Perri Adams @perribus]

https://t.co/j9j926Wk63

[Perri Adams @perribus]

We believe in paying responsible security researchers for their hard work! 🤑

[Perri Adams @perribus]

https://t.co/v9N3IiY6HI

[Perri Adams @perribus]

We believe in paying responsible security researchers for their hard work! 🤑

[Ryan Speers @rmspeers]

We still have some spots open for DistrictCon junkyard speakers! Not only do you have a chance to show off your awesome work on an end of life target that needs attention – or laughs – but also we are giving out cash prizes to winners!!!

[chompie @chompie1337]

bring your eol exploits to @districtcon junkyard! now’s the time to flex yr cute demo

[RE//verse @REverseConf]

RE//verse 2026 CFP is open! Got research? Prove it: https://t.co/5l5IZLKzdZ

[kuzushi @kuzushi]

This might actually be one of the best panel talks I've ever attended. @OffensiveAIcon

[Perri Adams @perribus]

Had a great time doing a keynote panel with Rob Joyce and Dave Aitel at @OffensiveAIcon… and love the creative engagement from the audience

Photo credit to @caseyjohnellis

[Adam Chester 🏴‍☠️ @_xpn_]

Watching @daveaitel @RGB_Lights and @perribus trade friendly blows during the Keynote Panel at Offensive AI Con is too good!

[Offensive AI Con @OffensiveAIcon]

OAIC Day 1: Complete ✅ The conversation and idea sharing from yesterday's sessions have been bar-none. Plus, a full moon for last night's rooftop party!

On deck this morning:
--> Breakfast from 7-8:45 AM
--> Kickoff at 9 AM with our keynote panel, featuring @RGB_Lights, @perribus, and @daveaitel.

#OAIC2025 #OffensiveAICon

[Xinyu Xing @xingxinyu]

🚀 From DARPA #AIxCC to SWE-bench!
Team 42-b3yond-6ug’s small coder model is now:
🏆 #1 on SWE-bench (lite)
💡 #6 on SWE-bench (verified)

All while using far less compute than the giants ahead.
Big thanks to #AIxCC for fueling this journey!

[Rob T. Lee @robtlee]

Excited to be here at #OffensiveAICon for the next two days. 200 people focusing on offensive capabilities surrounding AI in the cybersecurity world. This team is top-notch and couldn't have brought together a more spectacular bunch of people to speak and to be able to participate in the event.

I’m hoping to learn a lot. Interact with all the wonderful offensive AI minds.

@RGB_Lights @daveaitel @mbazaliy @joshua_saxe @perribus @cyberphor and many more

Shoutout to @dreadnode and RemoteThreat for putting the event together. @OffensiveAIcon @SANSInstitute @SANSOffensive