Security Researcher & Exploit Developer @therealgregoAI | AI Security
Pakistan
Joined October 2023
- Tweets2.2K
- Following2.5K
- Followers935
- Likes23.6K
Pinned Tweet
Career Update: I've joined GregoAI
@therealgregoAI is building an elite AI security agent, which has already earned more than half a million dollars in bug bounties, including the largest AI-discovered bug bounty of $250K.
The team here is absolutely cracked, excited to be a part of it and looking forward to helping push the boundaries of AI security research.
Really awesome article
"History won’t repeat itself, but it will rhyme."
When is the ChatGPT moment for robotics?
Some say it's happened, some say it's coming. How capable are Physical AI models today? What does the adoption curve for robotics look like?
We've talked to most of the major players and make sense of it here
robostrategy.co/news/the-cha…
Deepseek V4.1 Flash 1017 found the FROG!!
That's the only open-source model and the second one ever (after Fable 5) to find the frog. Truly impressive!
@aisearchio youtube.com/watch?v=1Aqhg0FV…
ABDul Rehman | GregoAI retweeted
🚨 Nightmare day for cybersecurity
Multiple major security incidents, active exploits, supply chain compromises...
If you run production systems, start patching NOW.
PHP: Two critical unauthenticated RCEs. Attackers already exploiting them. Patch NOW
LiteLLM: v1.107.0 on PyPI and Docker is BACKDOORED. Steals cloud, SSH, and AI credentials. Pin 1.106.2. Rotate secrets.
eMudhra: A certificate authority's keys were crackable. Update your browsers, systems, and trust stores.
Node.js / Next.js / React: Security releases for Brotli RCE, TLS bypasses, and TWO critical Next.js RCEs.
TiDB Cloud: PingCAP breached through stolen credentials. Customer information and other sensitive data exfiltrated. Read the attacker's release, fun stuff.
Plex2Shell: Weaponized within HOURS of the PoC. Attackers already deploying cryptominers and proxy backdoors.
BeyondTrust / Ivanti: Actively exploited zero-days added to CISA's KEV catalog. BeyondTrust attacks linked to a China-nexus campaign.
And that's not even the full list.
Patch. Audit. Rotate. NOW.
ABDul Rehman | GregoAI retweeted
We recently started hunting bugs outside of Web3 using @therealgregoAI with impressive results
This is one of the first vulnerabilities we have been able to disclose (with many more to come)
TLDR: Apple's PCC revocation check was a no-op and revoked nodes kept getting the mesh keys for in-flight Apple Intelligence data
Fixed in 26.4. Happy halloween! 🎃
@elonmusk a humble request for full markdown support in X articles as technical write-ups become difficult to accurately comprehend without it
ABDul Rehman | GregoAI retweeted
i used to often think how if i was born a few years earlier, i would've caught so many *obvious* opportunities such as crypto pre-2017. i was even sometimes mad that such opportunities seemingly no longer exist.
and every few months i just get humbled as i look back and realize i've missed even more *obvious* opportunities.
Security research work now is mostly exploit development work nowadays
kinda triaging + exploit development
A lot can change in a year.
I was scrolling through my gallery when I stumbled upon this picture I took exactly a year ago (19-Oct-2025).
It was the day I received my MacBook from Immunefi (the one on the right). I was genuinely so happy, and seeing how proud my family was made that moment even more special.
Although my journey at Immunefi came to an unexpected end after being laid off within a year, I have nothing but gratitude for the experience.
The opportunity to work alongside such talented people from around the world, learn from them, and grow both personally and professionally is something I'll always value.
Looking back, it's crazy how much life can change in just one year. Some things don't go as planned, but they still become an important part of your journey :)
ABDul Rehman | GregoAI retweeted
We had a security breach last night related to a large scale distillation attack that impacted 1.4% of OpenCode Console users
We have notified them all this morning via email. If you did not get an email you were not impacted, it was a subset of users who had external providers linked
The incident is ongoing so we cannot share more details at this point but we are working with Anthropic, OpenAI, and Google to remediate
"Not everything worth pursuing is worth pursuing at once. Individually, your ambitions may all be worthwhile, but together, they compete for your most valuable and limited resource: your attention."
- best quote/advice chatgpt gave me so far
Opus 5.5 is too fast! It seems like Opus 5 but on turbo. It is the fastest model I have used so far. Also quite good for cyber-related tasks.
In terms of speed:
Opus 5.5 > Mythos 5.1 > Opus 5 > GPT 5.6 (daybreak-blue)
I just realized, there was a mistake in this tweet, i meant opus5 here not opus5.5.
testing and playing with opus5.5 today, which seems much better tbh
