Building AI Bug Hunters @ Cantina Computational Physics/Machine Learning/Philosophy Carnegie Mellon University 25'
Joined November 2025
- Tweets89
- Following95
- Followers301
- Likes144
chrispyroberts retweeted
today we're releasing apex-flash-1, our first open-weights model for security research post-trained on real vulnerabilities we found and got paid for.
we are also releasing the abliterated variant for researchers who want fewer refusals in their own authorized workflows.
how we built it: cantina.security/apex-flash
chrispyroberts retweeted
A first glimpse of the wildest robotics project of my PhD.
🛹 The Blind Skateboarder 🛹
No vision. No markers.
Paper, code, weights — coming soon. And we have more. 😉
chrispyroberts retweeted
We spent years finding vulnerabilities before attackers did. That was the easy part.
Teams already know what's broken. Nobody has the bandwidth to close it.
Today we raised $16.5M to make Cantina the security workforce for your security workforce. cantina.review/next-chapter-…
chrispyroberts retweeted
Building this has been a blast. We've found a ton of high-impact bugs: webkit, nodejs, ruby, L1s, and many many more. Currently #1 on the hackerone business leaderboard!
AI offsec tooling stopped being speculative a while ago. Attackers are most certainly abusing it. You should be too.
cantina.security/
@cantinasecurity
We spent years finding vulnerabilities before attackers did. That was the easy part.
Teams already know what's broken. Nobody has the bandwidth to close it.
Today we raised $16.5M to make Cantina the security workforce for your security workforce. cantina.review/next-chapter-…
chrispyroberts retweeted
AI Audit, WTF am I buying?
Here's my RANT on why AI Audit benchmarks don't mean much beside being an indicator of a race to the bottom.
And an invitation to use Coverage Classes as a way to concretely show the work done by auditors, agents and tools as a means to make shipping code with 0 bugs a concrete reality.
chrispyroberts retweeted
The US government, citing national security authorities, has issued an export control directive to suspend all access to Fable 5 and Mythos 5 by any foreign national, whether inside or outside the United States, including foreign national Anthropic employees.
The net effect of this order is that we must abruptly disable Fable 5 and Mythos 5 for all our customers to ensure compliance.
Access to all other Claude models is not affected.
We apologize for this disruption to our customers. We believe this is a misunderstanding and are working to restore access as soon as possible.
Read our full statement: anthropic.com/news/fable-myt…
chrispyroberts retweeted
1. Labeling a product by its worst users is a dangerous slippery slope. Where does that line get drawn? Like for Ethereum, Tornado Cash and the internet itself.
2. Security professionals have something close to a Hippocratic Oath. In this case, anyone can now burn tokens to find out the remaining bugs given the information that an AI tool has found more bugs. This is now doing harm to any user of thorchain who now have money at risk.
3. Threatening to publicly disclose live bugs unless a bounty is paid is extortion. It's also a sensitive time with many crypto companies running out of money, laying off staff and shutting down their bounty programs.
chrispyroberts retweeted
Breaking Claude Code and getting a high severity bounty from @AnthropicAI!
Apex, our autonomous bug hunter, found a way to bypass a permissions check by Claude Code for untrusted codebases.
Want Apex to break your code next? Link below
