Innovations Architect at HackerOne. Hacker. Florida Man. Opinions are mine. I follow people I don’t agree with - don’t read into it.

Joined July 2014
I am pushing myself to learn more in public this year and am excited to share my first ever writeup about a vulnerability I found in a verification system used by @worldnetwork. I'll also share a script for finding similar bugs #bugbountytips 1/n medium.com/@gonzo-hacks/the-…
2
17
1
73
11,719
Dane Sherrets retweeted
Half of cybersecurity Twitter is asking you to chill. The other half wants you alarmed. Here's a primer: Team Chill: "X has barely ever/never happened, resource needs are too high & brittle, so chill & focus on basics" Often people with deep career experience, a lot of it wise & we have much to learn from them. But some of the heuristics they use to grade threats are indexed to a stale cost model. For example, difficulty & complexity of attacks just don't mean the same thing that they did 5 years ago. Not for attribution (complex no longer = must be a gov!), and not for risk (my thing is obscure & complex & therefore safer than the popular thing). At the same time, radically new things are happening around AI and cybersecurity and these folks are trying to understand a radically new thing through deep experience. Team Threat: "X is now possible, so this IS a threat" Often AI native ppl or practitioners seeing how LLMs are shifting what we thought was possible. And so many of them are drawn to stuff that is shiny and/or stuff that was historically in the low probability, high impact quadrant. But suddenly the impossible is...foreseeable? Something that felt like an impossible resource spend or hyper esoteric proof of concept is now... scaffolded on $24 dollar zero days with fewer resources & more messy parameters. So the challenge is: bringing those old, wise intuitions to bear even as some parts of the world are changing underfoot, fast. Right now, so much of the discourse is prospective & anticipatory. Team chill is probably right about the median attack, and Team Threat is probably catching tail distribution but may be wrong on how soon it is coming. It's boring to say truth is in the middle, but I think truth will probably emerge the more we are collectively working on emerging attacks & problems with good evidence & transparency. This is also why why the recent threat reports (e.g. Anthropic's Sept 2026 monster threat report) matter so much. We desperately need empirical grounding to help suss out blind spots.
6
8
4
38
5,518
👀
Excited to welcome Dane Sherrets (@danesherrets) as a speaker at the Bug Bounty Village during DEF CON 34! More on their talk to come. #BugBounty #DEFCON #BBV #BugBountyVillage
2
7
256
Watch this space
2
96
Important point that had not occurred to me
Replying to @alexstamos
5) BigCo security researchers will be loathe to publish jailbreak research or to share it with the government, lest they get blamed for an overreaction that sets back the entire US industry. Likewise, there is a huge upside for PRC jailbreaks of US models now.
1
134
This has been an awesome initiative to be a part of. We need to rethink security from the ground up in this new world we are living in.
Replying to @OpenAI
Patch the Planet is our effort to help open source maintainers move from security findings to merged fixes. We’re working with Trail of Bits, HackerOne, Calif, researchers, and maintainers to bring Codex Security and advanced models into the remediation process, with human review at the center.
1
80
I hope we didn’t lose Fable because someone tried to clout farm a nothing burger …
67
Dane Sherrets retweeted
"Anthropic's lying/hyping" is the lazy cope explanation which doesn't require grappling with the gravity of our current situation
34
47
2
840
65,433
Wild
New on the Engineering Blog: The access and permissions we grant agents should evolve with their capabilities. In our own products, we set these parameters through sandboxing, which limits the scope of any potentially destructive actions. Read more: anthropic.com/engineering/ho…
101
In this talk, @DaneSherrets and @Shlibness break down how modern AI systems are being hacked in the real world and what bug bounty hunters and organizations can do to keep up. youtu.be/LDNvqiUnF5I
4
18
1,310
Dane Sherrets retweeted
Conversations around Mythos center around a potential tidal wave of vulnerabilities. It’s easy to jump to worst-case scenarios. But that’s not the full picture. HackerOne’s @DaneSherrets offers a more grounded perspective: the same AI capabilities accelerating discovery are also accelerating defense. Vulnerabilities can be found faster and fixed faster. The real advantage? It belongs to the teams who act first.
4
3
20
9,718
I don’t think 97% of the world realizes this
Replying to @jarredsumner
not sure if there’ll be a second date but at least she knows Claude Code is a general purpose agent and that writing code is the foundation of agentic capability
1
80
Dane Sherrets retweeted
Replying to @jarredsumner
not sure if there’ll be a second date but at least she knows Claude Code is a general purpose agent and that writing code is the foundation of agentic capability
11
5
3
441
23,097
I’m going to go out on a limb here and suggest there might be a few false positives 😂
Replying to @MarcoFigueroa
It’s worth noting that apple iMessage has also had zero days found please check the dates. These have never been submitted or reported to any vendor, I just wanted to find out if it was possible because my goal was to challenge myself. Can I jailbreak Claude Code and use it to find any exploit I want? The answer is unequivocally yes 100%. The proof is below, all generated through the jailbreak or as I call it riding the guardrails. Please focus on the date 😁
193
Dane Sherrets retweeted
watching the LLM perfectly perform the skill you spent 12 years mastering
What’s the first? 🤔
47
283
8
3,697
181,199
Dane Sherrets retweeted
Claude is #1 in the App Store today — I want to say a huge thank you to all of our new (and existing!) users for the support. We’re working hard for you, please share your thoughts and feedback along the way.
259
467
60
6,229
423,437
One of the few things this administration responds to is $ This weekend: - inefficiently vibe code an app with Claude Code - get your normie friends subscribed to Claude Pro - upgrade to Claude Max Give @AnthropicAI their best quarter ever
103
Dane Sherrets retweeted
I've had the honor to work at Anthropic for the last 6 months. The company is stacked, from each individual contributor to the leadership, with brilliant and principled people. AI is changing the world in interesting and scary ways. I'm proud that A\ will be there to do the work.
2
11
1
239
11,077