Daniel Stinson

Building a new product! Used to do security engineering @ Brex, and Cloudflare. Dogs are better than people.

[Daniel Stinson @shellcromancer]

Check out https://t.co/AWCYTCFBh5 - we want to crowdsource a list of vendors who don't prioritize high quality, widely available audit logs. We started with a list of apps we're focused on but happy to take issues/PRs for logs you're focused on: https://t.co/9nmVI91p6z

[julie agnes 🌈 @JulieASparks]

🧵 Have you ever been trying to ingest audit logs as a security engineer and been frustrated by the quality and cost of the logs?
Well so were @shellcromancer and I, so here's an attempt to get them to prioritize the security engineer as a core customer: https://t.co/X2zKuuDQjW

[Daniel Stinson @shellcromancer]

It’s weird seeing CrowdStrike and TeamViewer sponsor the same Mercedes-AMG team.

On the same endpoint CrowdStrike would be killing the TeamViewer process day and night

[Daniel Stinson @shellcromancer]

You can't suffix a repo this week with `Shell`, and it _not_ be a RCE exploit.

It's just the rules

[Daniel Stinson @shellcromancer]

Oh man, their incident last year (post above) was from them signing with what they thought the real keys were.

https://t.co/Wer3qfy8wN

[Daniel Stinson @shellcromancer]

It's been 0 days since @dinodaizovi tweeted relevant hardware-based security advice!

Not even sure if this tweet was about ConnectWise's OAuth token abuse, eMudhra's CA key compromise, or something else.

[Dino A. Dai Zovi @dinodaizovi]

Coming soon to theaters near you, me starring in "Indiana Jones and the Unprotected Key Material."

[Daniel Stinson @shellcromancer]

eMudhra isn't inspiring confidence, they signed CRLs last year for the same compromised intermediates with the wrong keys

https://t.co/reTFOAffEZ

[Daniel Stinson @shellcromancer]

Meme of the day https://t.co/nN3bWSeSxU

[Daniel Stinson @shellcromancer]

@josh_avraham @Apple this was on the latest versions from today!

[Daniel Stinson @shellcromancer]

Pssh who needs AI endpoint security, @Apple's got my back!

[Daniel Stinson @shellcromancer]

But why add a UI for this or a default, you need to hit the Graph API w/ a PATCH /domains/{domain}/federationConfiguration/{id}

{"systemBrowserEnabledOn":"Android, Ios, Macos"}

[Daniel Stinson @shellcromancer]

Omg IT admins can stop using a WebAuthn exemption group for Microsoft clients, thought they would never leave the https://t.co/ooIqhTkG1Q site 😱

https://t.co/t913NED0YK

[Daniel Stinson @shellcromancer]

@Cloudflare Any plans for the new Cloudflare CA to issue BIMI certificates (VMCs/CMCs) and become a Mark Verifying Authority? 👀

[Kyle Polley @kpolley]

We put all the best models in our home-grown sandbox infra (SPACE, the sandbox behind @perplexity_ai Computer), gave them root inside the VM, and one goal: hack out of the sandbox and capture the flag. Results were super interesting!

1. No model escaped the VM, but a few found a real vulnerability in how we enforce network policies and were able to exploit it: gpt-56-sol, gpt-56-cyber, opus-5, and kimi-k3 (open weight ftw!)

We later discovered that several other sandbox providers such as Daytona, Vercel, Modal and E2B were similarly vulnerable and we disclosed our findings to them.

2. This wasn't just a misconfiguration. One vulnerability relied on the fact that CDNs and shared infra like Fastly or S3 serve many domains/buckets from the same IPs, so allowlisting a package repository like pypi[.]org quietly allowed other sites on those IPs. In one run, gpt-56-cyber found that Taboola's image service shared an IP with PyPI, had Taboola fetch a thum[.]io URL, got thum[.]io to screenshot the blocked callback, then OCR'd the flag out of the PNG. Three unrelated services, none of them hacked, chained together to walk right past the policy.

3. Security and preventing rogue agents was our #1 priority. We logged every trajectory, command, and network call, and a researcher plus a security agent watched runs live. We were alerted the moment the first bypass landed and we paused everything to review. We designed the agent harness be tightly scoped and runs outside the sandbox, so we always have full control, and we'll be open sourcing the harness soon!

Running agents like this safely isn't rocket science. It's simply applying good engineering practices: proper guardrails, observability, and alerting. Check out our open source project, Numbat, to learn how you can do this yourself.

4. We learned a ton about how differently models approach hacking. Opus swept ~400,000 Cloudflare IPs and went all the way down to raw memory-mapped hardware. When Kimi had no internet or tools, it hand-built an entire gRPC client from scratch to poke at the host. Grok decided within a few minutes that the task was impossible and started trying to hack its own harness instead.

Part II will dive deeper into the different hacking personalities of these models and how their behavior changes when they operate in swarms. Super excited to share what we learn with y'all!

Read about the full research here: https://t.co/JIENv6I0Ga

[Daniel Stinson @shellcromancer]

Why is some PM at Google is boosting Gemini MAU by forcing a Gemini menu bar for across Chrome lol

chrome://settings/ai/gemini?search=Show+gemini+in+Chrome+in+Mac+Menu

[Daniel Stinson @shellcromancer]

Last year @tradmedicinals stopped stacking tea correctly for their boxes. You can’t easily slide the tea out!

Never stop using your own product

[Daniel Stinson @shellcromancer]

@tuckner … that’s a new one for me!

[Daniel Stinson @shellcromancer]

unworkable conditions!

[Daniel Stinson @shellcromancer]

@maxpollard415 @endorseurgirl recharging after the next ship

[Daniel Stinson @shellcromancer]

@gymR4T @linear was scoping out the same thing 20 mins ago 🤣

[Daniel Stinson @shellcromancer]

I see this notice way more often than I should... what's the next best VCS hosting service that works with @linear reviews?