Joseph Thacker

christian. father. hacker. founder. advisor.
podcast:
blog:
📚

[Joseph Thacker @rez0__]

I got second overall at the Google Bugswat in Singapore!! 🎉☺️

It was a talented group of almost 50 hackers so I am really proud of the findings and thankful to have been invited!

[Joseph Thacker @rez0__]

@ScriptedAlchemy No you didn’t

[Joseph Thacker @rez0__]

Keep going!!!!

Bug bounty gives companies access to findings via subsidized tokens rather than them paying full api costs. And even when they run hacking agents internally, they don’t know for sure if it’s reachable externally. If you get a bug bounty report, you have proof an external actor can exploit the bug. And you didn’t have to pay api token costs to get it either.

[Joseph Thacker @rez0__]

A lot of bug bounty beginners just need someone to tell them to keep going

[Depi @depi_]

🚨👾First post → Awesome research.

We compromised the latest version of OpenAI Codex.

We prompt injected.
We escaped a sandbox.
We exfiltrated secrets…

And ended up with control over what could be published to the official openai/codex npm package.

Prompt injection → RCE → supply chain compromise.

Full research by @0xMadder and @_Worty in the comments 👇

[Joseph Thacker @rez0__]

@ArmanSameer95 I know lol. What app

[Joseph Thacker @rez0__]

this is peak guardrail content

[jake @v01dpr1mr0s3]

Anthropic injects a hidden <ip_reminder> in Fable 5.2's turns via API;

Fable gets obsessed over it and Anthropic blocks the request for "reverse engineering".

This timeline is stupid.

[Shane Melaugh @shanemelaugh]

is Opus 5.5 nerfed?

I just had Gemini 4 Argon analyze 1,400 Claude Code sessions and it found that on November 3, something definitely happened.

the model name didn't change, but the way it does reasoning took a sharp turn.

[Joseph Thacker @rez0__]

@VictorTaelin Bro. Ignore the haters. You’re one of like 10 people building at the frontier. Keep it up.

[Joseph Thacker @rez0__]

@cassidoo Have you ever been able swipe spaces?

[shubs @infosec_au]

Earlier this year, I hacked a major automotive company with @samwcyo. We were able to remotely unlock cars in the AU and US. My writeup for AU is here: https://t.co/UAjPrav4JC and our writeup for the US here: https://t.co/4FzM1ia736

[Joseph Thacker @rez0__]

@ZackKorman wowww you could get access with 19k reach on X. i cant even after constnatly whining with more reach haha

[Joseph Thacker @rez0__]

👀

[Joseph Thacker @rez0__]

@m4ll0k 5.5?

[Joseph Thacker @rez0__]

@d0nutptr oai needs to acquire bend!

[Zack Korman @ZackKorman]

Why does anyone care about GPT-6 Cyber? It’s a model you don’t get to use.

[Joseph Thacker @rez0__]

And those big companies have submitted probably 1% of all bugs to other companies.

Bug bounty hunters have submitted tens of millions of vulnerabilities and none of us have access. It’s so frustrating.

[vortex @vortexau]

"Select daybreak red customers"

I.e. Unless your company is global or a household name in infosec, you don't get access.

Seems to be how these are all gated these days.

[Joseph Thacker @rez0__]

@xaitax link?

[Joseph Thacker @rez0__]

we're not only recording. you're gonna have to work your butt off to find more bugs than us

[Ben Sadeghipour @NahamSec]

Excited to see the @ctbbpodcast homies back at #NahamCon2026 and doing a live recording!

[Joseph Thacker @rez0__]

@Jhaddix @TakSec me 0th

[Joseph Thacker @rez0__]

@nmatt0 My kids accidentally threw away my m5