Co-Founder, Head of AI Research @ https://teapawt.net/t.co/DIJL1KPQzU Security researcher exploring AI-driven offensive security 🤖
United States
Joined September 2025
- Tweets88
- Following187
- Followers53
- Likes825
Pinned Tweet
Excited to share my Claude Android app vuln disclosure! Thanks to @AnthropicAI and @Hacker0x01 for their quick validation and responsive handling.
zero-lab.ai/article?slug=sha…
Max Andreacchi retweeted
ZERO-DAY
Medium roast. The flagship. Unpatched. Unstoppable.
A clean, sweet medium heavy on caramel and chocolate for operators who need flavor before defenses go up. ZERO-DAY doesn't wait for a patch window. It's already in the cup.
Tasting notes: caramel, chocolate, low acidity, clean finish.
Origin: Brazil. Washed process.
Roast: medium. Strength: 3/5.
#operatorbrewing #cybercoffee #mediumroast #infosec #coffeeroaster
Max Andreacchi retweeted
ACCESS GRANTED.
The storefront is online. Three coffees.
ZERO-DAY: the flagship. Medium roast. Unpatched. Unstoppable.
EXPLOIT: dark roast. The daily driver that cracks open even the most fortified mornings.
WIRELESS: Swiss Water® decaf. Caffeine disconnected. Flavor connected.
Link in the bio. Deploy accordingly.
#operatorbrewing #cybercoffee #redteam #infosec #pentesting
1/ I just wanted to see if I could call a different model from inside a Claude artifact.
That then turned into a full teardown of the sandbox bridge: the postMessage RPC behind window.claude, the undocumented method surface, and a hunt for a way out.
Deets in thread 🧵
7/ *sad hacker noises* no bug, but a good story!
A sandbox's security isn't hiding method names; it's the host refusing to execute the ones you aren't allowed to send and knowing where to stop is the job.
Full writeup: itsbroken.ai/i-tried-to-summ…
6/ The answer came back cut and dry: working as designed. The methods are directional, the host sends them INTO the sandbox; an artifact can't send them out.
I had the arrows pointing the wrong way and the boundary was doing exactly its job.
5/ One result LOOKED like a screenshot exfil primitive.
I could have built the PoC to "prove" it, but that PoC IS the exploit, so I was conservative and disclosed to Anthropic instead.
4/ GetScreenshot was interesting, so I pushed on:
- wrap parent postMessage → cross-origin SecurityError
- steal webpack_require → not reachable
- forge the calls → dropped, or ignored entirely
All of them held on both iOS and desktop.
3/ Introspecting window.claude exposed the transport: a typed postMessage RPC to the parent frame.
Four documented methods, BUT the source enum listed nine, including GetScreenshot, RunCode, GetFile, SetContent.
2/ First things first: you can't pick the model.
Ask the bridge for claude-fable-5 (pre-ban), it returns 200 OK and "I am model claude-sonnet-4-6." Doesn't matter if the req is nonsense.
First takeaway: 200 means the call completed, not that it did what you asked. Read the body.
Traditional systems fail differently to agentic ones where all dashboards can be green while the system is already drifting into unsafe or unintended behavior.
Wrote about operational vs behavioral integrity and the growing visibility gap in AI security:
corgi-corp.com/research/oper…
Behavior can be manipulated.
Execution must be controlled.
Full breakdown here:
corgi-corp.com/research/ai-s…
What actually works:
→ identity binding
→ capability-scoped access
→ control planes outside the model
→ execution gates
Fixing this requires moving away from:
❌ probabilistic guardrails
toward:
✅ deterministic enforcement
Prompt injection isn’t the root problem.
It’s a symptom of something deeper:
→ identity collapse
→ broken attribution
→ missing enforcement
The real issue isn’t:
“can I inject a prompt?”
It’s:
👉 “who is actually allowed to execute actions?”