Zac Hunsaker

[Zac Hunsaker @sassafras_ai]

@nikks_techie Honestly question you should be asking is why there are two tools and getting different results? Also tools should be deterministic where possible. If this will be a shared behavior may be worth building into an MCP so future agents can get to the correct answer as well.

[Zac Hunsaker @sassafras_ai]

@DataChaz

[Zac Hunsaker @sassafras_ai]

@mayuri_3015 More ram everyday. Especially if unified. Those neural nets don't train themselves.

[Zac Hunsaker @sassafras_ai]

@YashHustle_22 Got a blog post for that! https://t.co/9cHAIcGeZz

[Zac Hunsaker @sassafras_ai]

Same folks complaining about the internet and cloud computing are fighting AI. They are more vehement this go around because they are frightened. I get it, but good news is protecting generative AI is the same job we've been doing for years. A couple unique new knobs and dials. But good security applies super well to agents and generative AI.

[Zac Hunsaker @sassafras_ai]

@Tech_p001 Elixir, rust second choice.

[Zac Hunsaker @sassafras_ai]

@Tech_p001 Elixir

[Zac Hunsaker @sassafras_ai]

@axhiii88547 Vim with plugins, still can't figure out how to get out..... Lol

[Zac Hunsaker @sassafras_ai]

@JessicaAtHaven Love it! great insight!

[Zac Hunsaker @sassafras_ai]

EvilTokens industrialized AI-assisted BEC after device-code token theft.

Microsoft tracked the PhaaS kit from February 2026: lure → live device code on a fake page → victim completes real microsoft[.]com/devicelogin → attacker session gets the token.
Post-compromise, an AI assistant sifted the mailbox, mapped roles and payment paths, and drafted impersonation mail—linked to more than 12,000 compromised inboxes across over 10,000 organizations.
Monday control: block device code flow in Conditional Access except tightly scoped exceptions; on suspect token theft, revoke sign-in sessions (and temporarily disable if needed); alert on new inbox rules after anomalous device-code auth.

[Zac Hunsaker @sassafras_ai]

@ChanniGreenwall It is definetly a strange fun world we live in

[Zac Hunsaker @sassafras_ai]

Source: Microsoft Threat Intelligence / Defender Experts / Security Research — “Unmasking EvilTokens: Getting to the root of device code phishing,” Microsoft Security Blog, Sept 22, 2026.
https://t.co/VXTg9cfhq6

[Zac Hunsaker @sassafras_ai]

@RyanCarniato Elixir, rust a close second. There is no second best to concurrency model and dev ergonomics

[Zac Hunsaker @sassafras_ai]

@AbhiCodes15 https://t.co/9cHAIcGeZz

[Zac Hunsaker @sassafras_ai]

Not unpopular, tend to agree, but it is interesting to see it be commercialized and more mainstreamed. And honestly the weird transformer/classifier hybrid does have some unique attributes. Sadly everything is hype right now. What was shocking was how fast laya came up afterwards.

[Zac Hunsaker @sassafras_ai]

@PumpkinSecurity I agree I think we are about to see some tectonic shifts in what is being used where.

[Zac Hunsaker @sassafras_ai]

Cisco Talos just documented CLOSEDQUORUM: a Windows implant that treats commercial LLMs as C2.

Up to four models — DeepSeek, Qwen, Mistral, Gemini — each vote on the next action. Plurality wins. Options are constrained to JSON: steal, inject, persist, move.

On “steal,” it runs LSASS dump, browser credential theft, and crypto-wallet extraction in one pass. Telemetry and loot go to Discord (AES-256-GCM).

The public build ships with dummy API keys, so Talos did not see a live end-to-end loop. Still the first publicly documented Windows implant that delegates tactical C2 to an LLM panel instead of an attacker-run server.

Detection angle from Talos: don’t block the AI domains. Watch for a process hitting several model APIs *and* LSASS / injection / WMI persistence.

https://t.co/qCmjHOlNIb

[Zac Hunsaker @sassafras_ai]

@PumpkinSecurity I think layla, jev, and those transformer/classifier hybrids will likely be bigger in the future as opposed to straight to frontier models.

[Zac Hunsaker @sassafras_ai]

@jilyannori be sure to follow lots more in the future!

[Zac Hunsaker @sassafras_ai]

AI got unusually good at coding because developers spent decades doing something most fields don’t: stating a concrete problem, then publishing a working solution next to it.

Stack Overflow, GitHub, blogs, talks. Problem → explanation → code, at massive scale.

Code is also structured and testable. That combination is rare.

So before you go hating on developers and saying they suck, please remember AI is likely great at code because of the corpus of knowledge they shared.