stuxf

co-founder and ceo @verialabs (yc f25) | hack things @smiley_ctf

[stuxf @stuxfdev]

We spun out of the #1 hacking team in the US and built AI that finds what even the best hackers miss.

During one engagement, it found 6 different ways to take over any user's account on a popular webapp. Completely autonomously. Then suggested fixes for every single one.

Today we're announcing @verialabs' $3.2M seed, backed by @ycombinator, @gokulr, @paulg, and @woloski (co-founder of Auth0), and many other great investors.

DM me if you want to know what we'd find in your app.

[Immunefi @immunefi]

Another 5-figure win for an Immunefi SR.

Congrats to @verialabs and @Cayden_Liao.

[SuperBeetleGamer @Cayden_Liao]

Anotha one

I just found a confirmed bug on @immunefi #immunefitribe https://t.co/A68lSr5nxH

[stuxf @stuxfdev]

@IntCyberDigest Of course it’s also probable that a lot of these are real, but I’ve seen some of these supposed disclosures that definitely are not.

[stuxf @stuxfdev]

@IntCyberDigest A lot of these “rejected zero-day RCE submissions” are just the result of AI Psychosis and aren’t real vulnerabilities.

Happy to DM for more details, don’t want to publicly put any of these groups on blast.

[stuxf @stuxfdev]

how is this happening again

[Cloudflare Developers @CloudflareDev]

Multiple security vulnerabilities affecting React Server Components and Next.js have been disclosed. We strongly recommend updating your applications immediately.

Cloudflare WAF managed rules already mitigate the disclosed denial-of-service vulnerabilities, and we are investigating additional coverage for several other CVEs.

https://t.co/mT9ujk1H7c

[LakeCTF @LakeCtf]

🏆#EPFL #LakeCTF 2026 — it's a wrap! 🚀
Another year, another amazing battle of brains of creativity!🧠💻
Congratulations to this year's winning team pls carry :3! And thank you to every participant for making this edition such a success.👏
🥇 pls carry :3
🥈 .;.;.
🥉 FluxFingers

[SuperBeetleGamer @Cayden_Liao]

I just found a confirmed bug on @immunefi #immunefitribe https://t.co/vFseAkxwFn

[SuperBeetleGamer @Cayden_Liao]

Part 2 of @verialabs Securing Open Source series:

We found 2 bugs that could be chained together in Kraken Wallet:

Chaining both, a malicious dApp could impersonate a trusted one and disguise transactions as messages, silently draining user funds.

Blog: https://t.co/G2523XqssB

[Charlie Marsh @charliermarsh]

We wrote up everything we do to secure our open source projects at Astral

[stuxf @stuxfdev]

@GrahamHelton3 I wonder what needs to happen in order to make a shorter disclosure policy the norm

[stuxf @stuxfdev]

@sohan_zhang @verialabs thanks for the kind words!

love what you’re doing @catchback_cards and super happy to work with you on keeping your users secure :)

[Joseph Zhang @sohan_zhang]

recently onboarded to @verialabs (F25) to help with our security

Highly recommend working with them! Super professional, clean UI, and well worth the investment

The product lives within our CI/CD, and it's a super easy github integration 🥂

[jayden @0jayden_]

Starting a series where we write up interesting vulns our agent at @verialabs finds:

First up, 1-click RCE in Goose, Block's coding agent with 33k+ stars: https://t.co/tyrrlDXj8U

Goose was vulnerable to CSWSH, allowing an attacker-controlled website to run arbitrary commands.

[stuxf @stuxfdev]

@santokri1 @aszx87410 @verialabs I you use https://t.co/zPt67kPVSK you can route things through your https://t.co/RDWrS3Sw62 subscription. The repo is open source, so yeah absolutely, it should work and you can test.

[stuxf @stuxfdev]

We at @verialabs built an autonomous CTF agent in a weekend and won 1st place at @BSidesSF 2026, solving all 52/52 challenges.

It races multiple AI models (Claude, GPT-5.4) in parallel, each in isolated Docker sandboxes with full CTF tooling. A coordinator LLM reads solver traces and sends targeted guidance to stuck agents.

As AI gets better at finding and exploiting vulnerabilities, we think it's important to understand exactly how good it is and where it fails.

https://t.co/MnbR9anYTS

[stuxf @stuxfdev]

@l33tdawg @verialabs @BSidesSF It’s open source!

You can run it yourself, curious to see the results, there’s definitely improvements to be made ;)

[stuxf @stuxfdev]

@EvanKlein338226 @verialabs @BSidesSF Mostly ended up using GPT because I didn’t want to use too much of my Claude usage 😅, so I had it disabled for most of the CTF.

Just first solve, IIRC each subagent can submit to a rate limited queue that just automatically tests submission against ctfd

[stuxf @stuxfdev]

@aszx87410 @verialabs you can (unofficially) run this for free, so long as you have an existing CC/Codex subscription.

I'm using the Claude Agent SDK, which allows you to route through your CC plan, though this is unsupported. I also route the OpenAI models through codex app server's JSON RPC.

[stuxf @stuxfdev]

@pflanigan @verialabs @BSidesSF Thank you!