"we tried to warn the world". What a way to say: "we gate kept our models so that only the to 100 companies who could afford to pay us millions of dollars had access to them" "we created the most unrealistic guardrails for every small business, code maintainer, and hobbyist around so you couldn't actually check your shit for vulnerabilties" "we created a FAKE CVP that takes your identity, but doesn't actually given any usability to solve for cyber issues" "AI will kill 10% of the population if you dont let us be the only ones to tell you whats good and bad in AI" Is everyone in this company living inside of a bubble, inside of a bubble, where they think they are humanities saviors? "Dont worry guys, we're going to save you if you just pay us millions a month for access to our models, but only if you're a top F100 company, and than you little peons have to pay millions to them to get to the millions from us." Oh yeah....you tried to warn us.

I really really do get it that "vulnpocalypse" and "breachpocalypse" and "cvepocalypse" and everything else is SUPER engaging. ...but... We REALLY should keep in mind that "find some vulnerability" != "exploitable". At all. Even if it is "exploitable", it may not be "universally" exploitable. It might only be exploitable under 1 of n conditions. Yes - we should be concerned about vulnerabilities. If you read this and go "OMG NEAL DOESN'T CARE ABOUT VULNERABILITIES", you've missed the plot. There is often a LONG LONG road between "vulnerable" and "exploitable". The roads that are short, are quickly rooted out in active, material, and public campaigns.

What gated defenders looks like in practice. My VulnHunter runs on local weights because I refuse to ask a vendor whether I'm allowed to read code like an attacker. DeepSeek V4.1 Flash 1017, fully local: 24 of 24 planted vulns found from source. Written proofs held on 22 of 24. No access request. No usage review. No waiting. github.com/nealbridges/VulnH…

I would love to share more of my experience on this, if there is a genuine interest. I've been an F100 security exec/CISO and I've been a start up CISO. BLUF: Both of those environments are "hard" and "easy" in their own right. I enjoy being a startup CISO. I get to build my own capabilities, I'm super close to the problems and have direct impact. I'm also SUPER blessed that I have a CTO that is a great partner, and a dev team that not only asks for my advice but ALSO listens to me. What I lack, which was the original banter between @ZackKorman and I was that I just dont have the money I had when i was a F100 security exec. My first cyber budget was $50m and I got made fun of for having that "life sciences" money. There wasn't a technology I couldn't buy. Now, I have to rub two nickels together. Not cause the org doesn't believe in cyber, the opposite. But at this stage, every dollar is worth $100, and I have the capability to build a lot. Anyway - happy to do whole segments on this if people are interested.

Appreciate the like @NousResearch ! Hermes plays a key roll in my stack in helping me work through a TON of cyber use cases. Super critical technology! Thanks for everything you do!!

ANOTHER ONE!? Its that time of the cycle where we get a new MiniMax model that was long fabled. Lets see what we can get out of this!

10/10 recommends bookmarking this!

Facts! I def have scars from both. I joke about the startup stuff, but I actually have more fun. If it wasn’t for my AI work, I’d be completely overwhelmed. Take this last 24h with PHP. I got the social alert from my intel fleet. It had done an initial analysis based on a vulnerability analysis bit that I built to pull prod ECR/ECS data, through CI/CD pipeline, and SBOM in GitHub to see where we might have PHP. It flagged that our web contractor was using Wordpress. I already knew that, but having the “AI employee” being on top of it was nice validation. Anyway: worked with my local models and was was known and access to WP-Engine to test some of the WAF rules that Clouflare put in to see if I can get a head start on impact. Same time, I had my dev notification agents send the relevant known details to our web team in slack. This POCs that dropped: tested all of them to determine if they were legit, or worked. Woke up the next morning to good results. And by the time the patch rolled around, the dev team was pretty ahead of it. That is soooooo much faster than any “big company” process I’d ever built in my entire life. Because it’s a small team, and I’m not a desk jockey that just sends CVE GHSA over to our dev team with “pls fix”. Downside: I’m always exhausted lol.

Anyone using DeepSeek Harness who has figured out how to assign a different model for subagents? Similar to how omp has the option for agent models, advisor model, etc? I used Claude to help me build a janky plugin, but it lost the Team Supervisor capability in DSH.

Will be slapping this on the bench today. I’ve been fundamentally happy with this iteration of DS. I have two main daily use cases: 1 - I have customers that I run continuous red team operations against. This model runs my entire offensive swarm. This also is for bug bounty. I usually run BB programs, not for the payout but to fine tune offensive ops (and the occasion bonus of payouts). 2 - I have another set of customers that I run threat research & hunts with. I pull in telemetry from my global sensors, and turn those into PIR driven threat hunts and reports. The speed and accuracy I have gotten out of this model on both of those has been seriously impressive. “Better than XXX model” is such a shit comparison. IB4 “but it’s not Mythos/Fable/Astr…”. I still think I’d of you LARPers wouldn’t know how to define better unless someone showed you a benchmaxxed report. @Blackwellboy and others hit the nail on the head. It’s private, they data is mine and the best part: I get no refusals.

Oh yea - wait till the LinkedIn people see it!

I’m not sure who all is attending this but it’s sure to be kick ass! #jealous

I do still find skills to be the best way to ensure models execute, at least procedurally, correctly towards an outcome. Pointing it at this PHP CVE, my skills for POC development, testing, and than target execution is so much easier when i know it'll execute how i want it to.