Chris Nyhuis

God + Family.
Cyberwarfare Leader | Cyber CEO @Vigilantnow
25% of profits fund anti-human trafficking & orphan care.
Defending those who can’t defend themselves

[Chris Nyhuis @vigilance_one]

ALERT: If you thought the Trivy attack was bad, 20,265 repos on GitHub have similar vulnerabilities.

We scanned the top 50K most-starred repos. 192,776 CI/CD findings. 590M+ downstream forks exposed. The most popular repos are the most vulnerable, 68% vuln rate at 50K+ stars.

The oringinal tj-actions attack from early march was the attacker's proof of concept. Trivy was the escalation. The 20,000 other vulnerable repos? That's the target list.

We open-sourced the scanner that found this three weeks ago: Runner Guard will scan for both actions and glassworm vectors. Please scan and fix your repos. https://t.co/fIkYkXLGwS

To install: brew install Vigilant-LLC/tap/runner-guard

Full 50K scan results: https://t.co/xmT8zAL4GR

#CICDSecurity #SupplyChainSecurity #DevSecOps #GitHubActions #OpenSource

[Lenny Zeltser @lennyzeltser]

https://t.co/w7L8tlPlvo

[Wiz @wiz_io]

🚨 BREAKING: Wiz Research discovered Remote Code Execution on https://t.co/SvN2lGsnbO with a single git push

The flaw in @github allowed unauthorized access to millions of repositories belonging to other users and organizations 🤯

[Chris Nyhuis @vigilance_one]

It’s more that a North Korean hacker has been systematically taking over the core open-source software supply chain Since Mar 1st through insecure GitHub actions. Over 40% of the top 50K GitHub projects are vulnerable. I released this research on it https://t.co/xmT8zAL4GR and then I built a free tool called runner-guard that was accepted into GitHub’s agentic workflows. you can use it for free to check open source software you use for the vulnerability https://t.co/qAE1cV1ktB - without action it’s going to get worse.

[Chris Nyhuis @vigilance_one]

@HackingDave @bcherny We had similar issues with 4.6 and 4.7 at first. Two things fixed it for us:
1. Skills need to be updated like any other software. Most skills were written by people using a model to generate a skill that optimizes that same model. So when the underlying model changes, the skill is still tuned to the old one and won’t run well on the new version. Our process now is before moving to a new model, use the existing model you trust to update and tune the skills for the new model first either manually or using the trusted model. Most skills aren’t controlled like system processes or other code, so we ended up forking some public skills and updating them ourselves.
2. Another thing we did is we wrote our own internal context manager tuned to how we code at Vigilant. Anthropic’s built-in context management is okay, but they can’t know how every team works. You need to build on top of it with something specific to your workflow. Both got us back to where we were. DM me if you have questions.

[Chris Nyhuis @vigilance_one]

@maniaUFO Or they passed it off to someone on the ground on the other side of that car or in the car.

[Chris Nyhuis @vigilance_one]

@hkashfi Here are detailed instructions on how to fix it including a prompt. https://t.co/JSCiEvpO49

[Chris Nyhuis @vigilance_one]

Stuck in a Claude Code Policy Violation loop? This has been happening all of a sudden today.

Here's the fix:

1. Open a new Claude Code chat in the same project
2. Paste the prompt below and change the part "[TYPE THE NAME OF YOUR CHAT HERE]" to the name of your chat.
3. Hit enter, it will clean it up
4. In a new chat window in the same project type /resume conversation and then select the chat that was stuck.

Prompt:
"I have a Claude Code session stuck in an error loop. Every message returns this error:

API Error: Claude Code is unable to respond to this request, which appears to violate our Usage Policy. This request triggered restrictions on violative cyber content.

Find the .jsonl session file in ~/.claude/projects/ that matches my broken chat — the title starts with "[TYPE THE NAME OF YOUR CHAT HERE]". Search that file for the first user message that triggered the block, truncate the file to remove everything from that line forward, and confirm how many lines were removed."

[Chris Nyhuis @vigilance_one]

It is annoying, but you can fix this. If 1. you go into another Claude chat in the same project, 2. give it the name of the chat that was blocked. 3. Copy in all of the text of the last message that was blocked including the error. 4. Then tell it to delete the part of the chat that caused the issue - Claude will free up your chat.

[Chris Nyhuis @vigilance_one]

Stuck in a Claude Code Policy Violation loop? This has been happening all of a sudden today.

Here's the fix:

1. Open a new Claude Code chat in the same project
2. Paste the prompt below and change the part "[TYPE THE NAME OF YOUR CHAT HERE]" to the name of your chat.
3. Hit enter, it will clean it up
4. In a new chat window in the same project type /resume conversation and then select the chat that was stuck.

Prompt:
"I have a Claude Code session stuck in an error loop. Every message returns this error:

API Error: Claude Code is unable to respond to this request, which appears to violate our Usage Policy. This request triggered restrictions on violative cyber content.

Find the .jsonl session file in ~/.claude/projects/ that matches my broken chat — the title starts with "[TYPE THE NAME OF YOUR CHAT HERE]". Search that file for the first user message that triggered the block, truncate the file to remove everything from that line forward, and confirm how many lines were removed."

[Chris Nyhuis @vigilance_one]

@cremescene_ Heck yeah man, understanding full stack detection is a foundational key. Most detection hangs out in upper layers while the threats hang below. Great to hear you hit this, a lot of people don’t understand the OSI stack anymore. Good words.

[Chris Nyhuis @vigilance_one]

@vxunderground lol

[Chris Nyhuis @vigilance_one]

@gabsmashh @DarkReading Great wordz @gabsmashh “bad design is not a nation state problem”

[Chris Nyhuis @vigilance_one]

@NetworkChuck Great take Chuck. Fear has no place. AI is amazing it will change a lot however it can’t change that everyone is created with purpose, that purpose can’t be deleted by AI. To all the peeps, seek the truth and you will be free to be all that you are meant to be.

[Jamieson O'Reilly @theonejvo]

Trust me chat. Forget about Glasswing spamming 0days in your software, you're already cooked with current models.

I've hacked hundreds of global orgs, including governments (legally) over the last 10 years, and the amount of times I required a 0day to do so was exactly 0 times.

Being worried about Glasswing is like living in Europe and being worried about Northrup Grumman having lethal space lasers while you're more likely to get stabbed by a crazy person walking through the streets.

[Chris Nyhuis @vigilance_one]

@StoicSage @vxunderground lol

[Chris Nyhuis @vigilance_one]

@cremescene_ @medusa_0xf lol that’s why I whispered when I typed ;)

[Chris Nyhuis @vigilance_one]

@cremescene true that man. Thanks for sharing this. I’ve been to Nigeria many times over the last 15 years with orphancare work. Nigerians are resilient hardworking and just want opportunity. On my first trip we built out a WiFi network and some tech work. If companies were smart the would invest in Nigeria. Such an amazing country and way better jollof rice than Ghana ;). Sorry to my Ghana friends

[Chris Nyhuis @vigilance_one]

@vxunderground @vxunderground Agreed. Python banned me for submitting a PR to CPython to pin their actions. Thought I was a bot, blocked me without asking. Someone else opened the same PR 17 mins later, they accepted it. I emailed back and forth, provided more help. Still blocked. SMH.

[Chris Nyhuis @vigilance_one]

@EricLDaugh We value life and each other above all things

[Chris Nyhuis @vigilance_one]

@HackingDave Is that the new skill “speak like a $400 an hour consultant”. I like that it wants to constrict itself though lol

[Chris Nyhuis @vigilance_one]

@HackingDave Same here it’s really bad.