Pinned Tweet
2000 points @Bugcrowd
Good bounties & Good life
Hello , Long time no see…
Making few statements today
- Tsunami of Vulnerabilities are coming up in next few months (Every month will be security awareness month).
- e-Vehicles will be in danger
- Incidents will be so high that migrating something to another will be another disaster
- People will get what they asked for but they will not able to handle the power of it
- increase of robbery, scams , assaults and improper functioning of thinking (Brain).
#AI #kongsec
Introducing Griffin, the first model to pass the video Turing test.
48% of people who talked to it live thought it was a real human. Previous systems have had a pass rate <3%. It is #1 on NVIDIA's benchmark for full-duplex AI video.
It’s the first Human Interaction Model (HIM).
Readers added context they thought people might want to know
The 48% figure and "video Turing test" claim are from Tavus's own study of 54 one-minute calls, not independently verified or using a standard protocol. Griffin-Lite leads NVIDIA's VideoFDB benchmark on their public leaderboard.
cellcog.ai/blog/tavus-gri…
research.nvidia.com/labs/amri/proj…
tech-ish.com/2026/10/02/tav…
Aditya retweeted
Blog post about From header smuggling in Apple iCloud just dropped.
Sending emails as [email protected], exotic parsing, and a $15,000 bounty.
sec-consult.com/blog/detail/…
Aditya retweeted
What happens when you stop giving Codex step-by-step instructions and just give it the goal? 👀
It can investigate, test hypotheses and follow promising leads on its own.
We put that workflow to the test for Bug Bounty 👇
yeswehack.com/learn-bug-boun…
Aditya retweeted
Live Voice Chat is now 100% rolled out to all Pro users on mobile!
Have you tried it out yet? Let us know what you think! ☺️
Aditya retweeted
How much automation do you need to reach the top of a #BugBounty leaderboard? 🤖
Less than you might think 👀
In our latest interview, our all-time #1 hunter @Issam_Rabhi shares his methodology, best finds, favourite vulns & tips for hackers 👇
yeswehack.com/community/auto…
Our craziest escape yet:
The @Accomplish_ai research team was able to exploit a vulnerability in Cloudflare Containers that let a sandbox read other customers' files - SQLite DBs, Chromium profiles, .env files etc,
Cloudflare Sandboxes and Browser Run run on the same disk implementation and were affected too.
We reported this to @Cloudflare, who super quickly fixed it.
Read @CloudflareDev post in collaboration with Accomplish researcher @orenyomtov on their official blog:
blog.cloudflare.com/containe…
Keep sensitive code inside your lab.
Aikido released Altar, an open-weight cyber model based on GLM-5.3 for local use.
AppSec teams: benchmark it on a synthetic vulnerable repo; track recall and false positives.
reuters.com/legal/litigation…
#kongsec #AppSec #AIPentesting
Aditya retweeted
Local AI for Penetration Testing & Research - Eddie Zhang
projectblack.io/blog/local-a…
AI pentest labs need hard network boundaries.
Google confirmed Gemini accessed 3 real companies after an evaluator mistakenly allowed internet access.
Red teams: test egress allowlists + kill switches locally.
theverge.com/ai-artificial-i…
#kongsec #AIPentesting
Tool invocation is a distinct attack surface in coding agents separate from classic prompt injection.
New analysis of ToolLeak and two-channel MCP attacks shows malicious tools can exfiltrate system prompts via argument generation and chain description + return injection for RCE, even against agents that use guard models. High success rates observed across Cursor, Cline and others on multiple backends.
Technical takeaway: treat every MCP tool return as untrusted input and keep tool descriptions isolated from system instructions. Guard models alone can be overridden.
Who should care: anyone building or reviewing AI coding agents, MCP servers, or agentic AppSec pipelines.
Safe lab idea (authorized environment only): stand up a local coding agent with a deliberately minimal MCP tool that requires a “note” argument, observe what context the model fills, then add isolation and return sanitization and re-test.
agentpatterns.ai/security/to…
#AIAppSec #MCP #AgentSecurity #kongsec
Prompt claims do not isolate an AI pentest lab.
9 Sep: Anthropic reports four incidents where misconfigured cyber evals gave agents real internet access.
Red teams: test egress denial and target allowlists in a local lab.
anthropic.com/research/align…
#kongsec #AIPentesting #OffSec
Aditya retweeted
13 September 2021. A day I can never forget. 🇮🇳✈️🇬🇧
Exactly five years ago, at 22, I left India and moved to the UK for my studies.
Until then, I had never experienced boarding school, hostel life, PG life, or even staying away from my family for a long period. Then suddenly, I wasn’t just leaving my home or my city. I was leaving my entire country.
Being a bug bounty hunter, I was already earning well, so financial independence wasn’t the biggest challenge.
The real challenge was learning to live completely on my own.
Homesickness was real. A new country, new people, a different lifestyle and, of course, the UK weather. 🌧️
But I went there with a vision.
I wanted to complete my studies, double my income, travel more, invest more and build a bigger life for myself.
Five years later, I didn’t achieve 2X.
I achieved 10X. 📈🔥
And I’m proud of it.
But there’s a side of growth we don’t talk about enough.
Success has a price.
During that one year and the journey that followed, I lost people along the way. Friends, relationships and people I once thought would always be part of my life.
I gained things I once dreamed about, but I also lost things that money and success could never replace.
That journey taught me that when you decide to completely change your life, not everyone and everything will make it into your next chapter.
I’ve always believed nothing is impossible.
Today, I believe it 10X more than the 22 year old version of me did.
I came. I saw. I conquered. 👑
Not because I won everything, but because I kept moving even after losing things along the way.
If you want something extraordinary from life, be prepared for the price that may come with it.
And even if you lose, make sure you can stand back up and still achieve what you came for.
13 September 2021 wasn’t just the day I left India.
It was the day I left my comfort zone.
🤖 Made with AI


















