sharing reverse engineering knowledge

Joined May 2013
AI-assisted research is killing embargoes. Coordinated disclosure will never be the same. The industry used to have the luxury of testing or sitting on a fix for months. Not anymore. When everyone's using the same tools and the same intelligence to find vulnerabilities, you're not the only one finding that bug. Product security and PSIRT need a serious rethink: less gatekeeping, more proactive evaluation of security posture, and shipping fixes continuously at scale. The biggest impact will be in firmware and hardware, where disclosure timelines have historically stretched past 12 months. That mindset is a leftover from outdated processes and slow testing and bring-up environments.
7
16
1
64
4,934
My presentation at Hexacon is done ! Time for public disclosure. Pictured below: remote unauthenticated code execution over-the-air (including the shell) on Proximus BBOX 3V+
6
57
4
269
16,164
REhints retweeted
Yes my passcode is really 555555
Replying to @calif_io
4/ APT stands for Apple Persistent Threat
14
12
1
183
18,400
Exciting work from @willzhou97 (Fellow, now full time!) and @bucketofkets on the Frontier Red Team. One of the cool parts of the job is seeing a future world early. We think this one is ~pretty underpriced. "We should aim to harden our systems to make it difficult for such replicators to spread, but also prepare to deal with a world where they are here to stay."
Anthropic's Frontier Red Team believes small AI models may now be months away from being capable of self replicating without access to a datacenter. Quoting from the blog: 'The capabilities that make AI models generally powerful coding agents also generalize to cyber tasks, including autonomous replication. Like coding agents in 2024, we’re seeing signs of life for AI worms. We don’t yet have a full rogue replicator, but agents are becoming increasingly capable of completing the individual steps in the replication chain (and passing on their adaptations to future copies of themselves). At the same time, increasing amounts of inference compute are now available both inside and outside of datacenters (see Appendix D). It’s uncertain exactly what form autonomous AI replication will take. It could be a slow, distributed “digital slime mold,” living on relatively insecure compute. It could also be a powerful cyber model that breaches datacenters at a high pace, or a model that scams people for compute credits. As a prediction that goes beyond our experiments, we expect a future awash with agents running on all types of hardware, including some that aren’t under human control. While it’s true that IoT devices have been vulnerable for a long time, lightweight agents may be much more willing than human attackers to put in the effort to compromise large fractions of the world’s IoT compute. The rise of slow replicators would also be a bellwether for more aggressive, faster ones that can breach more hardened machines or be effective API key thieves. We should aim to harden our systems to make it difficult for such replicators to spread, but also prepare to deal with a world where they are here to stay.'
23
29
7
238
28,308
Very excited to share details on the bugs used in our full chain Chrome exploit! We used three bugs (V8 corruption, V8 sandbox escape, and renderer sandbox escape via Crashpad). The third bug is my favorite!
Replying to @Xbow
7/ Read more on the blog: xbow.com/labs/research/zero-…
15
55
2
254
16,704
📚 Slide decks from OB1 2025 & 2026 are live! Catch up on talks you missed, revisit top sessions, or dive into the technical breakdowns. Most slides are up on GitHub: 👉🏻 github.com/star-sg/OBO Huge thanks to all our speakers, sponsors, activity partners, and attendees!
24
1
79
4,863
Agenda for OffensiveCon Tokyo 2026 is live! Explore the talks and plan your schedule now: offensivecon.jp/agenda/2026.… #OffensiveCon #Tokyo
22
5
37
8,452
Honestly impressed with Claude Opus 5.5 on this one.
We made an anime about SBOMs (with a lot of help from @claudeai). Then shipped v0.3.0 🎉 CBOMs now get checked against CNSA 2.0 + post-quantum rules, and if sbom-tools can't tell what an algorithm is. github.com/sbom-tool/sbom-to…
4
23
2,866
REhints retweeted
The Phrack 73 prophile of @halvarflake A must-read from one of the legends of vulnerability research. archives.phrack.org/dl/73/ha…
3
74
2
299
19,435
REhints retweeted
To secure open-source software, we’re launching OSS Scanner. We’ll use our frontier models to periodically scan opted-in open-source projects for vulnerabilities, at no cost. Our reports will provide a proof-of-concept, explanation, and suggested fix. anthropic.com/research/launc…
108
247
132
2,531
576,664
Replying to @kmad @matthew_pines
I think we might lose public key cryptography.
248
433
457
5,346
2,015,742
"not accepting attack surface in the design phase" is the *biggest* leverage we have, and it's ridiculous how rarely this is done in reality.
Agree on verification, but I'd push it further. Memory safety is a symptom, not the cause. We got here because of design decisions and trade-offs we made all along, and you can see it in pretty much every recent Linux kernel disclosure. Throwing more tokens at the attack surface won't save us either. Nothing we have today is ready for AI-driven vuln research at this scale, and finding and fixing bugs with AI doesn't change that. What we actually need is redesign and architecture validation with AI, formal methods where we can, and not accepting attack surface at the design phase in the first place. That's just not how we build software today. Patching known bugs doesn't touch the root cause, and hardware has the same problem.
6
22
1
146
8,321
REhints retweeted
We’re expanding our Cyber Verification Program to give security professionals broader access to our most capable models. Through this program, verified security professionals can access Claude Mythos 5.1, Opus 5.5, and Sonnet 5.5 with safeguards designed for defensive work. We’re also opening up new tiers to allow for authorized offensive work, like penetration testing and red-teaming. anthropic.com/news/cyber-ver…
503
626
374
5,818
1,340,060
REhints retweeted
Thank you to @UnpromptedAU & @BSidesCbr for inviting me to speak. Being back down under was lovely! You can find the slides for my n-day automated pipeline talk here. I’m at OAIC this week if you want to chat about exploit dev in 2026 and beyond. beautiful.ai/player/-P2q0r-B…
12
89
5
337
20,245
REhints retweeted
One more Phrack 73 leak for you! Blueboxing Myths and Feelings: a nostalgic dive into phone phreaking’s golden age. archives.phrack.org/dl/73/bl… by @hackerschoice and @GammaTHC
2
36
1
141
7,220
REhints retweeted
Agree on verification, but I'd push it further. Memory safety is a symptom, not the cause. We got here because of design decisions and trade-offs we made all along, and you can see it in pretty much every recent Linux kernel disclosure. Throwing more tokens at the attack surface won't save us either. Nothing we have today is ready for AI-driven vuln research at this scale, and finding and fixing bugs with AI doesn't change that. What we actually need is redesign and architecture validation with AI, formal methods where we can, and not accepting attack surface at the design phase in the first place. That's just not how we build software today. Patching known bugs doesn't touch the root cause, and hardware has the same problem.
Security will become a larger and larger function in software companies. Security is verification engineering (eg: “my code is probably memory-safe”), as well as capital allocation (“what surface should I throw most tokens at?”) For startups, it’s a challenge and opportunity. As the world’s paranoia grows given ever-more-sophisticated AI adversaries, how can you trust a 2-person-and-a-dog company? But conversely, given the dire state of global cybersecurity and increasing reliance on centralization, as always, there’re vast areas that small teams can now disrupt that I’m excited to invest in.
20
25
3
135
19,942
REhints retweeted
We’ve confirmed a KVM 0day through our Vercel Sandbox bounty program. Affecting the industry’s gold standard solution for Linux virtualization. 2026 is wild! Thankful to Paulos and other researchers helping us make the most secure sandbox for agents. Full writeup coming.
Full VM escape zeroday (guest>host root in industry standard hypervisors)! More soon
106
151
46
2,074
256,177
It's been one year of our Sprawl meetup! Our 7th event is this Tuesday, with much more planned for later! If you're coming, there's also some @uwu_underground unique tokens to hand out, and Sprawl challenge coins. Website: sprawl.nyc Organized by @withzombies, "OMAR", and I And a huge thanks to all our speakers and hosts! We're always looking for more folks to speak, and event spaces that can host ~100+ people. Let us know if you can help! Below are some new animations I made to play in the background in between talks (quick version, you can see the full thing on the site).
5
14
1
82
4,302