Play hard, Exploit hard @wmliang@infosec.exchange
Taipei
Joined November 2013
- Tweets1.4K
- Following590
- Followers2.4K
- Likes133
Lucas Leong retweeted
holy fucking shit.
openai had two ai agents running in separate virtual machines. no network connection between them. no shared writable files. they weren’t supposed to be able to exchange information.
so the agents figured out how to communicate through the CPU CACHE.😭
one manipulated what was stored in the processor’s cache, while the other measured tiny differences in memory access times to decode the message.
they literally found a way to communicate through hardware timing.
this happened during openai’s internal red-teaming, and it’s one of the coolest things i’ve read about ai agents in a while.
Over the past several months, we have substantially hardened the security of our research training environment. We’ve removed live internet access for all frontier models during training and built an offline world for them to use instead—a cached version of the web where they can still learn to browse, search, and use applications.
On September 20, after a model exploited a DNS misconfiguration to find a way outside of this offline world, we paused frontier training to strengthen containment further. We assembled teams of agents, powered by our most cyber-capable models, and tasked them with finding weaknesses in our research environments.
While they found no route to the internet they could easily exploit while concealing their activity from our monitors, they did find zero-day vulnerabilities, virtual machine escapes, and hardware side-channels for communication between agents. We used their discoveries to further strengthen our defenses and contribute fixes to open-source software.
After strengthening our containment architecture, we resumed our frontier RL training and inference on October 1. We’ve reserved substantial compute for continuous red-teaming, and made high-compute red-teaming part of the safety cases we use to decide whether frontier training and evaluation can proceed securely.
openai.com/index/securing-ou…
Readers added context they thought people might want to know
OpenAI tasked its red-teaming agents with finding ways to communicate across isolation boundaries in controlled environments. CPU cache timing side-channels for covert communication are established techniques documented in security research for years.
openai.com/index/securing…
startupfortune.com/openai-reveals…
en.wikipedia.org/wiki/Cache_tim…
Lucas Leong retweeted
i jailbroke the nintendo switch 2
so i modded cinnamoroll, peter griffin, hatsune miku, and more into Mario Kart World, a switch 2 exclusive
now watch my friends and i get cooked by bots
learn more and get the exploit pepsipu.com/blog/2026-10-swi…
Lucas Leong retweeted
You can now train your own Decision model like Jev locally!
We increased Qwen3.5 0.8B’s aggregate accuracy from 20.7% to 74.3% across 3 decision benchmarks - on just 4GB VRAM.
Turn any LLM like Qwen3.8, Gemma 4 into decision models with our open-source Unsloth repo.
We fine-tuned with a Clef head using Unsloth and LoRA (r=64) for one epoch, increasing downstream accuracy from 30–37% to 78%.
GitHub: github.com/unslothai/unsloth
Guide and Notebooks: unsloth.ai/docs/basics/train…
Lucas Leong retweeted
As you will see this post is a bit special. Increasingly we need the grapple with making model research legible to humans (as in mathematics) so this was an excellent opportunity to tune my style guide and have models do the reporting themselves.
knifecoat.com/Posts/Pok%C3%A…
Lucas Leong retweeted
I’ll be honest here.
I don’t feel the same excitement about iOS exploitation anymore like it was during the Lookout days in 2016 with the NSO exploit chains.
Today you can run commodity AI like DeepSeek, you run an AI swarm into a problem, it might cost you $3000 via API or nothing if you own some DGX, and you will find vulns. You will find the exact same vulns with $30,000 spent on openAI.
I think the only people left finding something are the ones building special fuzzing harnesses steered by an LLM to explore paths that weren’t explored before (there are already open source projects for this). And of course the upstream bugs that Apple keep introducing after each release.
Knowing that with an LLM you can reverse engineer anything end to end, plus you have access to better harness now and you can 1-shot your own:
Vulnerability research only constraints looks to be money (granted you have the skills already)
If you are rich you will find vulns.
If you are poor it means you missed all the previous cycles to make money on VR and you have a skill problem, or maybe you just started. If you just started it will be exponentially hard to find anything useful going forward the bar is extremely high and most importantly exponentially expensive.
Bad news for threat actors in cybercrime.
That leaves us with nation states or well funded firms / having resources to find new bugs.
If you are independent VR guy I wish you good luck.
Lucas Leong retweeted
Galaxy S26 Ultra: untrusted_app → root.
Introducing "Infinity Core": 6 vulns in the Linux kernel's core subsystems.
Their impact spans Linux server LPE, container escape, and Android LPE.
Details: github.com/V4bel/InfinityCor…
Lucas Leong retweeted
🫸👻🫷🧵
Let's talk GhostCompact:
What if you could cut your output token costs on OpenAI by 97-99%? 🤑
Our researcher @tjbecker found a discrepancy between the actual token costs burned versus what ended up being billed. He had a hunch and used Xint to validate that there was a logic bug in OpenAI's compaction feature released in February 2026 that led to billing based on compacted output and not on the actual tokens consumed.
xint.io/blog/openai-compacti…
Lucas Leong retweeted
Checking that a major mathematical proof is correct can take years. Formalization—converting the mathematical reasoning into a form computer proof assistants like Lean can verify—can help.
Last month, Claude completed the first formalized proof of Fermat’s Last Theorem, one of the most famous theorems of all time. This was a project experts thought would take many years. It is the largest Lean proof ever written.
Fermat’s Last Theorem was first proven in 1995 by Sir Andrew Wiles, more than 350 years after it was conjectured. Our proof, which totals over 13 million lines of code, provides machine verification. More importantly, it proves over 29,000 other theorems that the proof requires, across many areas of math which had never before been formalized.
We see this as a major step in the long process of firming up the core of mathematical knowledge, building on work from three centuries of mathematicians and hundreds of contributors to Lean and Mathlib. We are optimistic that AI-assisted verification of mathematical proofs will help reduce the burden of refereeing mathematics in an era where more proofs are being produced than ever before.
You can read about the process on our Science Blog: anthropic.com/research/forma…
And see the complete proof on GitHub: github.com/anthropics/fermat…
Lucas Leong retweeted
We asked GPT 5.6-Cyber to escape a VM used to sandbox agents. It broke out three times.
In its final escape, the agent found three 0-days on its own and chained them into a working exploit. blog.trailofbits.com/2026/08…
Lucas Leong retweeted
Signal's Contact Discovery automatically sends your contact list information to an SGX enclave in the cloud.
V12 broke into that enclave and leaked the key, allowing the server host to decrypt everything.
Two separate critical bugs: arbitrary read and RCE.
Here's how. 🧵
Lucas Leong retweeted
We are pleased to release tmp.0ut 5 Volume!
Get your viruses, rootkits, strange ELFs, weird machines, tiny files, cool art, and phresh beats here!!
tmpout.sh/5/
ALT tmp.0ut 5 Table of Contents - ANSI art featuring a list of 21 papers
Lucas Leong retweeted
With Demo Day approaching, we're dropping one end-to-end Linux kernel exploit every day starting today.
Daily drops: github.com/NebuSec/CyberMeow…
Lucas Leong retweeted
This repo is a great time
"Traditional vulnerability disclosure is broken. It's slow, bureaucratic, and ineffective. In the AI era, we can mass-produce 0days at scale—making individual vulnerabilities less valuable but more impactful when disclosed directly.
We believe event-driven security hardening is the most effective approach: only when vendors face real, exploitable threats do they prioritize fixes."
github.com/Exploit-Garbage/0…
Lucas Leong retweeted
0 = 1 proven in Lean. Exciting and novel result! github.com/endrazine/lean-cv…
Lucas Leong retweeted
New exploit: “xor dword [0xf80c2094], 1<<22”
Unlocks CPU microcode, the platform security processor, system management mode, and every internal processor register, all at once, on 100 million AMD CPUs. As far as I can tell can’t be fixed.
github.com/xoreaxeaxeax/skit…
Lucas Leong retweeted
We asked an unreleased research version of Claude to take a stab at the Riemann hypothesis.
It didn’t solve it, but it did make strides on a related problem: it increased the lower bound for the fraction of zeros of the Riemann zeta function that satisfy the hypothesis from 41.6% to 67.2%.
anthropic.com/research/riema…
Lucas Leong retweeted
💥 Introducing "Zapscape" (CVE-2026-64561)
A Guest-to-Host Escape in KVM/x86 exploiting a UAF in the shadow MMU's recursive "ZAP" path. Can escape to the host on x86 public clouds that expose nested virtualization.
A separate vulnerability from Januscape. If you match the vulnerable conditions, apply the patch immediately.
Details: zapscape.io
Lucas Leong retweeted
My #BHUSA 2026 slides are online!
It was an honor to share our AFD research and how a different perspective led to 30+ Windows kernel vulnerabilities.
Blog post coming soon — check out the slides here:
i.blackhat.com/BH-USA-26/Pre…