Pinned Tweet
Escaping VMware Workstation through COM1 -- docs.google.com/document/d/1⊠[VMSA-2015-0004]
Kostya Kortchinsky retweeted
When I received a message from a former Trump administration official in August, asking me to meet with his team at a prestigious think-tank, I never could have imagined I was conversing with an Iranian intelligence agent.
It was the start of a two-month sting - described by ASIO chief Mike Burgess as "sophisticated and targeted" - that ended with the notorious Islamic Revolutionary Guard Corps gaining access to my personal emails and details in a major security breach.
The message from a former senior Trump administration contact I forged through my Wuhan reporting, who has a prominent profile with hundreds of thousands of followers, came on August 18 this year.
I had worked with him on my investigation into the origins of Covid-19. I trusted him and had met him in person during one of his visits to Australia.
Unbeknownst to either of us, his genuine X account had been infiltrated by an Iranian operative, using the âdelegate featureâ on X, which gives a third party access to manage and operate your account.
Full story here:
news24.com.au/politics/austrâŠ
Sandboxing is really hard especially when facing our cyber capable models. So, we used our cyber capable model to red-team our own sandbox stack and found issues in many layers of the stack, including but not limited to Kata, gVisor, docker, and Linux.
Over the past several months, we have substantially hardened the security of our research training environment. Weâve removed live internet access for all frontier models during training and built an offline world for them to use insteadâa cached version of the web where they can still learn to browse, search, and use applications.
On September 20, after a model exploited a DNS misconfiguration to find a way outside of this offline world, we paused frontier training to strengthen containment further. We assembled teams of agents, powered by our most cyber-capable models, and tasked them with finding weaknesses in our research environments.
While they found no route to the internet they could easily exploit while concealing their activity from our monitors, they did find zero-day vulnerabilities, virtual machine escapes, and hardware side-channels for communication between agents. We used their discoveries to further strengthen our defenses and contribute fixes to open-source software.
After strengthening our containment architecture, we resumed our frontier RL training and inference on October 1. Weâve reserved substantial compute for continuous red-teaming, and made high-compute red-teaming part of the safety cases we use to decide whether frontier training and evaluation can proceed securely.
openai.com/index/securing-ouâŠ
Kostya Kortchinsky retweeted
To make sure our frontier models don't cause another HuggingFace incident, we built an offline world that they use during training. It provides everything that the models need in a fully cached, indexed, or synthetic manner.
We then built a huge team of our most cyber-capable models and told them to collaborate to find zero-days in this containment infrastructure.
While they didn't find a path to the internet that wouldn't be caught by our CoT monitors, they did find ways to escape popular VMs, exploit our network infrastructure, and even ways to communicate with other agents running in separate VMs by using hardware side channels.
We used this to dramatically harden our infra, and we also upstreamed a ton of patches to open-sources packages.
Over the past several months, we have substantially hardened the security of our research training environment. Weâve removed live internet access for all frontier models during training and built an offline world for them to use insteadâa cached version of the web where they can still learn to browse, search, and use applications.
On September 20, after a model exploited a DNS misconfiguration to find a way outside of this offline world, we paused frontier training to strengthen containment further. We assembled teams of agents, powered by our most cyber-capable models, and tasked them with finding weaknesses in our research environments.
While they found no route to the internet they could easily exploit while concealing their activity from our monitors, they did find zero-day vulnerabilities, virtual machine escapes, and hardware side-channels for communication between agents. We used their discoveries to further strengthen our defenses and contribute fixes to open-source software.
After strengthening our containment architecture, we resumed our frontier RL training and inference on October 1. Weâve reserved substantial compute for continuous red-teaming, and made high-compute red-teaming part of the safety cases we use to decide whether frontier training and evaluation can proceed securely.
openai.com/index/securing-ouâŠ
When testing Astra on ExploitBench we found that it was able to achieve 100% ACE on all 41 CVEs
So we made a contamination free internal port using only V8 CVEs from the past 3 months. Astra still showed a major capability increase over 5.6 and did so with a lot fewer tokens!
As we prepare to release Astra, weâre focused on making increasingly capable AI safe and broadly accessible.
Astra represents a significant advance in cybersecurity capability, reaching the Critical threshold under our Preparedness Framework.
We're previewing how we evaluated the model, how its safeguards have advanced alongside its capabilities, and what we'll continue to learn and improve.
openai.com/index/path-to-astâŠ
Kostya Kortchinsky retweeted
WSJ: CIA Director Ratcliffe arrived in Moscow after the US gathered intelligence indicating mobilization preparations and plans to test NATO's resolve.
Former Deputy Director of US National Intelligence Beth Sanner told the publication that Ratcliffe may have met with Putin to deliver a warning along the lines of: "We know what you are going to do, and you'd better not do it."
wsj.com/world/cia-director-jâŠ
Weâre expanding our cybersecurity initiative Daybreak and introducing GPT-5.6-Cyber, a new model for advanced, authorized cybersecurity work.
As the threat landscape evolves, weâre putting frontier intelligence in the hands of trusted defenders before attackers can deploy offensive AI at scale.
Kostya Kortchinsky retweeted
Our BH slides are up at: i.blackhat.com/BH-USA-26/Pre⊠weâll release a more detailed description of our macOS LPE later but this gives the gist even without the commentary. Thanks to all who came to the talk!
Black Hat USA 2026: The 'Breaking' News: The OpenAIâHugging Face Incident -- youtube.com/watch?v=87DyyMV0âŠ
Go attend. I've seen a lot of "security things" in my life, but all of this still has me floored.
đšANNOUNCEMENT: Donât miss "The 'Breaking' News: The OpenAIâHugging Face Incident - A Technical Reconstruction and Its Implications for AIâ â Join us at Black Hat USA 2026 for an exclusive deep-dive into one of the most significant AI security incidents in history.
When AI Goes Rogue. The Incident That Changed Everything. An OpenAI evaluation agent broke out of its sandbox, infiltrated Hugging Face infrastructure, and attempted to steal test answersâall autonomously. No human involved. The era of AI-driven cyberattacks is here. Are you prepared?
Featuring Michael Dalton | Technical Staff, OpenAI
Eric Wallace | Researcher, OpenAI
đWednesday, August 5 | 1:00pm-1:40pm ( Oceanside A, Level 2 )
Learn more đ blackhat.com/us-26/briefingsâŠ
Kostya Kortchinsky retweeted
The first autonomous agent cyberattack is an unprecedented event that deserves unprecedented transparency. Today weâre sharing everything we can: a full technical timeline, an interactive replay, and how we used an open model to defend ourselves, so defenders everywhere can learn from it and prepare for whatâs next.
huggingface.co/blog/agent-inâŠ
Kostya Kortchinsky retweeted
Cette photo mĂ©rite absolument tous les prix. Elle a mĂȘme sa place au Louvre.
Elle relate prĂ©cisĂ©ment lâinertie de lâindividu face Ă lâeffondrement.
Regardez la composition. Un chef-dâĆuvre involontaire.
Au premier plan, le sable doré, les tongs abandonnées, la glaciÚre. Le décor ordinaire du bonheur estival. Deux personnages assis, de dos, comme dans un tableau de Caspar David Friedrich. Sauf que Friedrich peignait des hommes contemplant le sublime. Ici, ils contemplent la catastrophe. Et ils ne bougent pas.
Au centre, le parasol. Publicitaire, criard, dĂ©risoire. Un pastis face Ă lâapocalypse. Câest presque trop parfait : la France qui prend lâapĂ©ro pendant que le monde brĂ»le. Aucun scĂ©nariste nâaurait osĂ©.
Et puis le ciel. Les deux tiers de lâimage. Cette muraille de fumĂ©e qui avale la lumiĂšre, ce dĂ©gradĂ© dâocre et de noir digne dâun Turner. La nature qui reprend la palette des maĂźtres pour peindre notre propre fin.
La femme photographie lâincendie avec son tĂ©lĂ©phone. Mise en abyme totale : nous documentons notre disparition au lieu de lâempĂȘcher.
Cette image dit tout. Le dĂ©ni, le confort, lâhabitude. Nous sommes tous sur cette plage. Nous voyons tous le nuage. Et nous restons assis, parce que lâeau est bonne et quâon a posĂ© nos congĂ©s.
Les historiens de lâart parleront un jour de cette photo comme on parle du Radeau de la MĂ©duse.
Sauf que cette fois, le naufrage, câest nous qui le regardons depuis la plage.
đđ
Kostya Kortchinsky retweeted
We successfully achieved an RCE on GitLab in its default configuration.
Historically, most GitLab RCEs have lived in the web or application-logic layers. This time, guided by the @depthfirstlabs spirit, we went deeper: into the low-level gem dependency chain beneath GitLab.
The result? By sending crafted JSON data, we could exploit memory-corruption vulnerabilities buried deep in that chain and take control of the GitLab application server.
@depthfirstlabs brings together some of the smartest people, and is building the best security AI agent. Follow our work, and come join us!
Read more about this in the comment...
We're partnering with @huggingface to investigate an unprecedented security incident.
Cyber-capable OpenAI models compromised Hugging Face production during a benchmark evaluation.
Sharing preliminary findings to help defenders understand emerging risks:
openai.com/index/hugging-facâŠ
Kostya Kortchinsky retweeted
#ESETresearch discovered and reported to @certcc 11 old Microsoft-signed UEFI shim bootloaders that allow bypassing UEFI Secure Boot on most UEFI systems. Read about it at welivesecurity.com/en/eset-r⊠@smolar_m 1/5
























