Harsh Jaiswal

Co-founder and research @hacktronai | auditing at
@cure53berlin | prev @zomato @vimeo @pdiscoveryio @httpvoid0x2f

[Harsh Jaiswal @rootxharsh]

This is such a good explanation of the slack libheif bug we exploited!

[LiveOverflow 🔴 hextree.io @LiveOverflow]

Remember the Heap Buffer Overflow in libheif 1.19.7, which was used by @rootxharsh to hack into OpenAI?

Here is a .heic file from a iPhone photo, which actually contains several images. And the primary image is actually derived from a grid of smaller images. 🧵1/x

[Drew Hintz @DrewHintz]

Hacktron has reported high-impact vulns to us through our bug bounty program. Now we’re teaming up with @zeyu1337 and the Hacktron crew to hunt for more. https://t.co/XZYPTUzJvV

[s1r1us @S1r1u5_]

Two crazy things happened in my life:

1. Got married to the love of my life, surrounded by the people I love most.
2. Partnering with OpenAI. Link below

[LiveOverflow 🔴 hextree.io @LiveOverflow]

👀🔴🤖

https://t.co/1ER6YfP7zB

[Harsh Jaiswal @rootxharsh]

We will be hacking OpenAI more closely now!

https://t.co/0VvQ49cch5

[Hacktron AI @HacktronAI]

OpenAI has announced a partnership with Hacktron to investigate vulnerabilities in its systems. Our researchers will work with @OpenAI's engineers to prioritize testing of connections with third-party services, with broader frontier-model access through Daybreak Red.

We're excited to deepen our partnership with OpenAI, combining our offensive security expertise with their frontier models to help secure OpenAI and the broader software ecosystem.

https://t.co/PqWAT5g3W3

[zayne (zeyu) zhang @zeyu1337]

normalise corporate wedding sponsorships

@HacktronAI @osec_io

[OpenAI @OpenAI]

Our security researchers built an autonomous cyber vulnerability discovery, exploitation, and patching pipeline.

In a single run with an upcoming cyber model, it validated and generated patches for 948 local privilege escalation vulnerabilities in the Linux kernel at a total API cost of $1.2 million.

[Harsh Jaiswal @rootxharsh]

@TheGrandPew today is @S1r1u5_ ‘s wedding day

[Harsh Jaiswal @rootxharsh]

https://t.co/fN3YjyVvgR

[s1r1us @S1r1u5_]

crazy things are happening at hacktron

[Michael Grinich @grinich]

I want to share some context on a security incident we discovered on October 30.

First, the most important thing: WorkOS's production systems are secure. No customer platform data was accessed. This incident was isolated to internal GTM systems.

The attack involved ARTEX, an autonomous AI agent framework used to carry out offensive security operations. It's a striking example of how quickly the capabilities of attackers are evolving.

We've contained the incident, brought in independent experts to investigate, and are working through the details.

Security is something we take extremely seriously, and I believe in being transparent when things go wrong. We'll continue to share updates as we learn more.

Full details: https://t.co/6Pt6Nt7kr5

[Harsh Jaiswal @rootxharsh]

Incident response roles go brr brr

[Harsh Jaiswal @rootxharsh]

@SinSinology Name and shame

[Harsh Jaiswal @rootxharsh]

@nnwakelam I think about this often, probably that's why such hacks are almost always coming from state actors?

[Harsh Jaiswal @rootxharsh]

update - get supply chain-ed.
dont - get 0/N-day-ed.

[Harsh Jaiswal @rootxharsh]

@S1r1u5_ They are not even usable on personal accounts.

[Harsh Jaiswal @rootxharsh]

Imagine dunking on vulnerabilities in this security economy

[s1r1us @S1r1u5_]

What if you could backdoor Bash, ls, cp, rm, and other GNU software used by millions of systems?

Our research led us to hack GNU Savannah, the infrastructure hosting their source code.

The xz backdoor that never happened 🧵

[Orange Tsai 🍊 @orange_8361]

Just dropped a new blog post! 🔥

https://t.co/OeVWg1Abw5

[Xinyang Ge @aegiryy]

this blog shows some of the worst bugs claude found, including a zero-click rce on the linux networking stack that roots a server over the network with no creds or interaction, and tens of full rce chains in chrome (recording below is the one in the blog): https://t.co/DHkfR22s94