Cool

Ph.D. student. Compiler security.

[Department of War 🇺🇸 @DeptofWar]

https://t.co/rzCVvUU3mu

[Cool @seekamoon]

🤔

[Lukasz Olejnik @lukOlejnik]

Amazon is holding a mandatory meeting about AI breaking its systems. The official framing is "part of normal business." The briefing note describes a trend of incidents with "high blast radius" caused by "Gen-AI assisted changes" for which "best practices and safeguards are not yet fully established." Translation to human language: we gave AI to engineers and things keep breaking?
The response for now? Junior and mid-level engineers can no longer push AI-assisted code without a senior signing off. AWS spent 13 hours recovering after its own AI coding tool, asked to make some changes, decided instead to delete and recreate the environment (the software equivalent of fixing a leaky tap by knocking down the wall). Amazon called that an "extremely limited event" (the affected tool served customers in mainland China).

[PhD_Genie @PhD_Genie]

Day after submission...

[faulty *ptrrr @0x_shaq]

The US government declassifying a PoC:
#include<▇▇▇▇.h>
int ▇▇▇_▇▇▇▇ {
▇▇▇▇▇▇▇
▇▇▇▇▇▇
▇▇▇▇▇ ▇▇▇
return ▇▇;
}
/*
* ▇▇▇▇▇ ▇▇▇
* ▇▇▇▇▇▇▇ ▇
*/

[Wil Gibbs @cl4sm]

While playing @defcon CTF Finals with @shellphish I managed to solve the ICO challenge using LLMs (GPT5 + Cursor) and almost no human intervention. You can read how I did it here! https://t.co/EcqYZdyIfV

[beist @beist]

These days, when I see the results of bug hunting using AI, I truly feel glad that I retired early.

Theori at aixcc: https://t.co/9wz5JwWJ8Y

Google big sleep: https://t.co/qH47j4bgsx

Xbow: https://t.co/1e2lMJBudF

[Tim Becker @tjbecker]

There were many moments over the past year where our LLM agents completely blew my mind! Plenty more to talk about soon, but for now, I highly recommend folks check out our public agent traces. You can watch our agents find, trigger, and patch a real exploitable 0day in sqlite!

[Cool @seekamoon]

Lmao. That's totally new to me.

[Cool @seekamoon]

@superclip01 @grok What episode is this from?

[Cool @seekamoon]

@tomvsjerrys @grok What episode is this from?

[Cool @seekamoon]

This is what early missiles looked like.

[Cool @seekamoon]

lmao

[Cool @seekamoon]

@Yuchi_qinglan

[Cool @seekamoon]

now i know the source of that famous meme

[yahoo！知恵袋名言集(NEW) @iyashimyhome]

向かい風が強すぎたワンコ🐶

[simabossneko 写真集「島にゃんこ」発売中 @simabossneko]

こんにちは✨
Hello💓

#なかよし #猫 #cat

[Why you should have a cat @ShouldHaveCat]

the little sounds he makes while stretching 🥹

[Ron Masas @RonMasas]

If you can’t code, you will never find vulnerabilities.

Or to be fair, you’ll never find the ones that matter. You’ll hit a ceiling in vulnerability research. Sure, you can rack up CTF points, follow step-by-step blog posts, land a bug bounty once in a while, or even go viral on YouTube.

But without knowing how software is actually built, you’ll always be stuck at the surface, repeating someone else’s work. You might know how to run tools, trace network flows, or grep for indicators but without programming skills, you’re missing the foundation.

Manual vulnerability research, real, consistent, high-impact work demands the ability to code.

Most developers aren’t writing code with security in mind. They care about performance, features, UI, deadlines. That’s where vulns creep in.

The best vulnerability researchers can write the systems they exploit.
They know what shortcuts look like.
They know what most devs will overlook.
And they can build custom tools or fuzzers to hit exactly the conditions no off-the-shelf scanner can reach.

The best way to understand how software breaks is to build it yourself. Code like a developer, so you can break things like a hacker.

[Cool @seekamoon]

kind Tom