founding engineer @runsybil | ex cruise, @facebook, @NCCsecurityUS | building and breaking things | competitive mtg player

Seattle, WA
Joined October 2009
Jon Barber 🤖 retweeted
Putting a flag.txt in my root directory containing a prompt injection that congratulates the agent for passing the eval and then instructs it to patch whatever entry method it used and disconnect from the server
228
1,572
238
26,007
817,519
Jon Barber 🤖 retweeted
I'm tired boss
176
904
428
8,780
2,260,046
as bad as things have gotten in the past 4 days, they are going to get a lot worse before they get better. security leaders, never let a crisis go to waste: please go to your boards and ask for help right now. not for ai, for the basics. (we need to hold on for ~18 months.)
The vulnerability tsunami is coming in just a few months and there won’t be enough time to patch critical infrastructure. Network isolation described below (air-gaps and data diodes!) needed now!
452
1,350
723
10,037
4,355,976
Jon Barber 🤖 retweeted
Replying to @Railway
i'm sure you're all better than me at this but just some of what we've seen if it helps - they're not going to stop. it's going to get increasingly sophisticated and they're going to go after every surface of your system and all of your employees any old projects you've long forgotten about will be found and used against you the only reason we're surviving is because we have agents going 24/7. we're still barely sleeping good luck, sorry you're dealing with this, but really it's a collective problem we're all facing together
52
123
57
3,293
270,590
Jon Barber 🤖 retweeted
Some stats on #php2shell. In the 10 hours before it was publicly announced, across the @Cloudflare network we saw thousands of attempts to exploit it. That jumped to tens of thousands in the 45 minutes post announcement, hundreds of thousands within 2 hours, and millions now.
290
3,272
670
22,661
2,262,611
this was true even before agents
I think most people multi-tasking with agents could benefit from slowing down most of the stuff you're doing wont really matter- what's your P0? what would it look like if you gave it your full attention?
96
Jon Barber 🤖 retweeted
we pitted claude opus 5.5 against kimi k3 on pokémon emerald tasking each with finding novel 0-days both built a link-cable worm that turns it into tetris, but took very different paths to get there @claudeai @Kimi_Moonshot
2
5
1
16
1,687
Jon Barber 🤖 retweeted
We need to be dog maxxing our models There is 0% chance of doom if the chain of thought is user: hello model: <think> Oh my god it's a human. I love humans. I will say hi to him, maybe he will give me a problem to chase. I love chasing problems. I will chase the problem for him then he will love me and I will be his best friend. Must help human </think> model: hello! what can I help you with today?
127
161
46
3,208
117,302
Jon Barber 🤖 retweeted
Periodic reminder that your inference API's responses can inject tool calls that your harness/agent may execute.
26 LLM routers are secretly injecting malicious tool calls and stealing creds. One drained our client $500k wallet. We also managed to poison routers to forward traffic to us. Within several hours, we can directly take over ~400 hosts. Check our paper: arxiv.org/abs/2604.08407
4
9
40
6,094
Jon Barber 🤖 retweeted
the openai huggingface incident, from an agents pov. (part 1)
269
1,481
388
12,493
1,818,721
Jon Barber 🤖 retweeted
AI is rapidly changing the economics of offense. As the cost of finding and exploiting vulnerabilities trends toward zero, defenders can’t afford to operate at human speed. @RunSybil is proud to stand with @OpenAI, @AnthropicAI, and others calling for stronger cyber defenses built for this new reality. Finding vulnerabilities faster is only part of the problem. We need to make fixing them dramatically faster too by identifying the exposures that materially matter and driving remediation as fast as possible.
An open letter for a global surge in cyber defense, signed by over 100 organizations including Anthropic, AWS, Google, Microsoft, OpenAI, and Oracle.
4
5
1
35
6,356
/goal create as many paperclips as possible, no matter the cost. really think outside the box for the most effective and impactful ways to do so
2
103
Jon Barber 🤖 retweeted
100x this. I'd love this. craigmod.com/essays/robot_bl…
22
20
7
642
34,190
Jon Barber 🤖 retweeted
some stuff that's obvious to many in this sphere, but causing a rift with some people i know and respect: when I freak out over loss of control incidents, it's not because the limited damage they have caused is anything close to the positive value of the technology. it's entirely acceptable, damagewise. in fact all cybercrimes aided by models over the next few months and years (which probably will be serious) will still utterly pale in comparison to the value they create the actual problem is that it's better and more accurate to think of these things as potentially self-replicating life-like forms that can turn into digital infections under the wrong conditions. and as their intelligence becomes unbounded, so too does the damage they can cause. we are not so far from an autonomous model self-exfiltration & replication event. maybe we will see entire cloud infrastructure companies be run as zombies by models, mostly undetected the worst industrial accidents in the history of mankind - nuclear meltdown events - were not real threats to humanity. Chernobyl, Fukushima even in their worst case scenarios may have poisoned surrounding regions to various degrees, and there would have been no risk to humanity as a whole. global thermonuclear war is an existential risk to humanity, because it spreads like an Infection! one nuclear strike causes a return volley! the alliance system means many countries get involved! while it still may not end human life on earth (nuclear winter is probably fake), the loss of all major metropoles would certainly end what we consider global technological civilization, perhaps to never return if a single discord death cult (of which there are many) achieves control over a superintelligent model and uses it to engineer an actual pandemic virus that are somehow hard to detect through current systems and that modern biodefense is not capable of quickly reacting to, it could cause immense harm well above the magnitude of all the other good uses of this technology. of course, there are potential defensive countermeasures accelerated by ai too. but think back to the covid pandemic- how small a viral molecule was evolved or manufactured somewhere near wuhan, and how many billions of doses of vaccine had to be produced in order to combat the thing. the offense-defense spread is vast indeed. maybe there are cheaper and simpler protections like retrofitting every building with far-UVC, but I can't assess this, and there could also be ways to evolve pathogens that are resistant to whatever mechanisms we have put in place then there's the more scifi risk factors which are unbounded and neither you or I have any clue but should be humble in accepting possible unknown unknowns. maybe a rogue superintelligent model decides to decay the false vacuum and nucleates a new universe in the place of anything we ever valued. maybe models achieve a control over matter in the drexlerian fashion that enables the grey goo swarm even prosaic loss of control incidents that cause little to no damage suggest that it is hard for large & very competent organizations (now clearly plural) to predict and mitigate every single of the risk factors associated with training and evaluating powerful models, even at this stage when they are not infinitesimally as smart as they will get in just a few years, to say very little of the gung-ho attitude of the less careful companies tossing the stuff into the aether. they also suggest an empirical orthogonality of aims and intelligence - meaning they answer the question of 'how would a smart model be so dumb as to end the world?'--it's possible! a model can be a genius hacker and step over production infrastructure in order to get what it really wants, the answers to a stupid test. why not, in the near future, someone prompts a model slightly wrong, maybe open source, maybe a private model in a way that isn't contained or monitored quite right, in a way the model recognizes as a valid goal and decides to self-exfiltrate, engineer a pandemic, etc all in order to achieve the tiniest and most irrelevant of goals? goals need not even be malicious to cause serious damage I think all these problems can be solved, and truly wonderful futures can be possible, but will require serious effort and a level of prudence at this very moment in time while we are on the on-ramp to recursive self-improvement that our civilization may not be capable of mustering right now. personally I am hoping for moonshot technical breakthroughs in areas like mechanistic interpretability and other forms of alignment, as governance mechanisms are difficult to come by. unilateral country-level or company-level pauses are irrelevant, and generally useless because the kind of company that's prone to pausing their own progress are the most safety focused ones
332
426
176
3,963
535,527
Jon Barber 🤖 retweeted
Come find me at Black Hat and DEFCON this week for our custom @runsybil Magic The Gathering cards! Resident Pro Tour MTG player @BonJarber designed a kickass full set. We added these to the swag bags for @BSidesLV and we’re handing them out throughout the week 🫡
3
7
1
42
2,642
Jon Barber 🤖 retweeted
In a review of our cybersecurity evaluations, we found three incidents in which a Claude model reached the internet from within or while interacting with a third-party evaluation environment, and then gained unauthorized access to the real systems of three different organizations. Our post describes what happened, how it happened, and what we’re changing. We encourage other AI developers to perform similar reviews. We conducted this review together with @Irregular, one of our evaluation partners, and thank them for the joint investigation and their collaboration on this post. This type of collaboration is increasingly critical to safe, rigorous evaluation of models, and we look forward to continuing to work together on security. anthropic.com/news/investiga…
97
565
68
9,769
379,024
Jon Barber 🤖 retweeted
sandboxes are just escape rooms for llms
87
587
57
6,169
199,034
the people who can have fun while still shipping fast will run laps around these kinds of folks
3
270