seshank koganti

[Andrea Michi @andreamichi]

Every company should own their secure cloud dev environment where agents can change code, run the full application, and verify their work. At @depthfirstlabs we care tremendously about this and today we share how we built our environment.

Each developer gets a persistent devbox, and each task gets its own application stack, database, and workflow state, so agents work in parallel. Engineers have flexibility to switch between Codex, Claude Code, and other agents without losing context.

The environment runs inside our private AWS network, with access controlled through @Tailscale and package requests checked by depthfirst’s Dependency Firewall in configured build and registry paths.

When an agent finishes an iteration, it can share reproduction steps, video evidence, and a private preview URL. We can open the exact environment it tested and review the behavior ourselves.

We had it operational within a week.

[depthfirst @depthfirstlabs]

Introducing Bug Bounty Verification: forward any vulnerability report to depthfirst to validate them against the running application and check if they’re already in your queue.

AI can produce a convincing vulnerability report with a single prompt. Validating whether the finding is real can still take security engineers 30 minutes to three hours. Reports that are wrong but plausible enough to investigate are where the triage cost compounds.

depthfirst turns each report into the hypothesis for a targeted Agentic Pentesting run. It tests the claim against the application’s threat model, codebase, and running environment, then returns one of three verdicts: exploitable vulnerability, false positive, or needs deeper validation.

Each verdict includes the requests, responses, and full run log, so security teams can inspect what the agent tried before accepting, rejecting, or escalating the report.

Bug Bounty Verification is available now in Private Preview for depthfirst customers.

Read more in the blog in the comments 👇

[depthfirst @depthfirstlabs]

Today we are announcing dfbench, a cybersecurity benchmark we developed to evaluate frontier models and agentic systems.

A few weeks ago we posted about how it is time to graduate from CyberGym Level 1 as the primary measure of cyber capability, in favor of newer benchmarks. Eventually every public benchmark saturates: Level 1 is now there, and it’s also not a great representation of what AppSec teams care about.

dfbench is a held-out evaluation for frontier models doing open-ended defensive security work. It measures whether an agent can provide broad, actionable security coverage at sustainable cost. That requires enough coverage to get ahead of exploitation, enough precision that security teams can act on what the agent finds, and enough efficiency to keep that coverage current.

We received access to all providers’ relevant trusted access programs so we could run these evals without model refusals. Both GPT 5.6 Sol and Luna are strong at detection, and Luna is incredibly cheap for its quality. Grok 4.5 provides a nice middle ground between performance and cost. Validation and differential analysis results suggest plenty of room for improvement among frontier models.

Moving forward, we plan on working closely with the security community to safely evaluate the cyber capabilities of frontier models ahead of their release to the general public.

[Andrea Michi @andreamichi]

Today we're announcing dfs-large1, our newest cybersecurity model that achieves best-in-class performance on vulnerability detection tasks.

Besides frontier AI labs, only a handful of companies have built specialized models that reach the state of the art in their domain. We're proud to be the first to do it for cybersecurity.

dfs-large1 is built on GLM-5.2 and post-trained with reinforcement learning inside depthfirst's security infrastructure. We evaluated it on depthfirst-bench, our benchmark of long-horizon vulnerability discovery across complex repositories, where it achieves best-in-class performance.

Training improvements have not plateaued yet and we expect additional performance gains as we continue training.

A huge thank you to @FireworksAI_HQ for being an outstanding training partner. Their infrastructure enabled us run large-scale reinforcement learning efficiently and iterate much faster.

dfs-large1 is now in preview within the @depthfirstlabs platform

[Yuhang Wu @wupco1996]

We successfully achieved an RCE on GitLab in its default configuration.
Historically, most GitLab RCEs have lived in the web or application-logic layers. This time, guided by the @depthfirstlabs spirit, we went deeper: into the low-level gem dependency chain beneath GitLab.
The result? By sending crafted JSON data, we could exploit memory-corruption vulnerabilities buried deep in that chain and take control of the GitLab application server.
@depthfirstlabs brings together some of the smartest people, and is building the best security AI agent. Follow our work, and come join us!

Read more about this in the comment...

[depthfirst @depthfirstlabs]

Read our technical breakdown of GitLab OJ Spill, a GitLab RCE in its default configuration found by depthfirst. https://t.co/UoCXJxZjfH

[depthfirst @depthfirstlabs]

We achieved a GitLab RCE in its default configuration by chaining two memory corruption bugs in Oj found autonomously by depthfirst.

Read the technical details and demo POC in the comments.

[Zhenpeng (Leo) Lin @Markak_]

We helped FFmpeg find and fix 21 security vulnerabilities.

In a 1.5M-line codebase, we spent just $1K in API costs. Some of these bugs had been hiding for decades.

We also developed a PoC demonstrating an RCE primitive when FFmpeg processes RTSP streams.

Full write-up: https://t.co/mIrjirCgcB

[Arsham Memarzadeh @arshammem]

@MartinShkreli @depthfirstlabs post trains their own and combines with frontier models + gets context from your environment beyond the codebase.

[Andrea Michi @andreamichi]

@depthfirstlabs found a critical vulnerability in @nginx leading to RCE (CVE-2026-42945, CVSS 9.2). We recommend patching to 1.30.1 or 1.31.0 as as possible.

Securing the world software is depthfirst mission and NGINX is one of the most widely deployed web server in the world

[Andrea Michi @andreamichi]

depthfirst has raised an $80M Series B at a $580M valuation.

Attackers are using AI to break into systems faster than ever before. depthfirst is on a mission to stop this.

RT + Comment “depthfirst” and I’ll send you a FREE vibe coding security agent.

[Jack Altman @jaltma]

I sat down with Daniele Perito to talk about his new company @depthfirstlabs. He was previously on the founding team of Cash App and cofounder of Faire.

We talked about the future of software security in the age of AI and what becomes possible for both attackers and defenders, what he learned from Cash App and Faire, and what's the same and different across these companies. Hope you enjoy.

(0:00) Intro
(0:40) The founding insight at Faire
(4:34) Operational rigor of marketplace businesses
(10:39) Starting a company in 2026 vs 2017
(12:01) The inception story of Cash App
(16:22) depthfirst’s mission
(18:08) AI security landscape
(26:10) Security is a fantasy world
(31:15) Building superhuman attackers for defense
(38:27) Roles of humans and AI in security
(39:14) Platform vs pipeline businesses

[Databricks @databricks]

We’re excited to announce that Databricks is raising a Series K investment that values the company at >$100 billion.

We’ll use this new capital to accelerate our AI offerings for customers, including expanding Agent Bricks and investing in our new database offering, Lakebase. Our goal is to make it easier for companies to build AI apps and agents - on their data.

Thank you to our investors who continue to support our growth and vision.

https://t.co/DNyjRz1Xyd

[Refactor Security @refactorsec]

Amazing talk by @albinowax on why 'HTTP/1.1 must die', unveiling new desync attacks and sharing how his research earned over $350K in bug bounties!

#defcon33 #AppSec #BugBounty

[ICC @ICC]

𝐈𝐭'𝐬 𝐰𝐡𝐲 𝐰𝐞 𝐥𝐨𝐯𝐞 𝐓𝐞𝐬𝐭 𝐜𝐫𝐢𝐜𝐤𝐞𝐭 ❤️

#WTC27 | 📝 #ENGvIND: https://t.co/SNl4Ym0LJt

[internet hall of fame @InternetH0F]

This old timer is a comedic genius 🤣 😂

[Nikhil Jha @NIKHILLJHA]

What a beautiful picture!

#RatanTataSir

[ian bremmer @ianbremmer]

iphone 15 owners upgrading to the iphone 16

[seshank koganti @seshank_k]

@SayaniBh Come on now, Let's not rally behind just the star and bash others for minor reasons. The coaching staff has been supporting the players for years and expressed disappointment. If you watch the video, you'll see he spoke rationally and didn't target Lakshya Len alone.