Security Engineer @trailofbits | @soliditors 🇫🇷
Joined August 2021
- Tweets5.8K
- Following2.7K
- Followers4.8K
- Likes27.4K
Pinned Tweet
Been listening to @siliconcarnesf, the #1 tech podcast in France, for years, so being invited twice by @CarlosDiaz as their cybersecurity expert along @GregoireGambatt was a real honor
The Binance hack, Lazarus group, Ledger spy chips, the Drift hack
youtube.com/watch?v=7dDUnLZB…
PHP2Shell, Patch the Planet, AI bug bounty floods, open-weight models
youtube.com/watch?v=S5fSZ1lK…
If you speak french go subscribe, and if you don't it's honestly worth learning french for 🫣
At @summit_defi in Mumbai I gave a talk on what we learned from running hundreds of AI agents on dozens of widely used OSS for Patch the Planet at @trailofbits 🎤
Here's the written version with 3 lessons you can apply to your next DeFi audit 👇
LFG @EFDevcon!
See you in Lisbon next year then 🇵🇹
And Patch the Planet engagements are the ones I've had the most fun working on lately
There's no feeling quite like finding criticals in widely used OSS and helping passionate maintainers improve their projects for the long run
FV is all the rage right now but this is proof that there are still plenty of critical bugs waiting to be found with good old fuzzing
*sshole is out
if you run sshd on alpine, openwrt or any musl box with password auth on: update now
official writeup: sshhole.com
Very interesting work by the OpenAI Cyber team
Stronger models needing less orchestration is also something we quickly realized while building our main auditing harness at Trail of Bits (Auditron)
Instead of strong constraints from the harness, that were needed with previous models, we now focus on four things: using different model families, coordinating their work, enforcing persistence, and providing the right tools/skills at the right time rather than fixed recipes
Our security researchers built an autonomous cyber vulnerability discovery, exploitation, and patching pipeline.
In a single run with an upcoming cyber model, it validated and generated patches for 948 local privilege escalation vulnerabilities in the Linux kernel at a total API cost of $1.2 million.
Most of my work now happens in the ChatGPT/Codex desktop app but I still use the Codex CLI from time to time
And the big weakness there is phone notifications
You run a /goal for hours, come back, and realize it's been stuck on a question since 10 mins after you left 🫠
So I set up push notifications for every Codex CLI event with Codex's native hooks and ntfy
Following everything from my phone is great and since it's integrated with the native hooks it works really well
Here's a simple prompt to set it up:
```
Set up ntfy push notifications for every Codex CLI event using Codex's native hooks, then give me the topic to subscribe to
```
TLDR of @gregory_raymond's investigation on the Crédit Mutuel Arkéa fraud
- the target was allegedly Fortuneo (the group's online bank)
- attackers sent wire transfers from Fortuneo and could set the beneficiary name themselves
- the money went to crypto exchange accounts (Kraken first) opened with fake IDs that passed KYC, with names matching each transfer
- the fiat was converted to stablecoins, withdrawn, swapped to ETH, then partly to Monero
- $133M+ is only what's visible onchain, the real loss could be much higher
- a source thinks it's a human failure, a CEO fraud variant, more than a technical hack
- ZachXBT rules out North Korea
the big question is how transfers this large went out for days without triggering any alert
Crédit Mutuel Arkéa is allegedly the EU bank that lost $133M+ according to @zachxbt
With LLMs making attacks cheaper and more powerful every month expect a lot more of these
- never run interview code on your work machine
- install tools only from official sites not search results
- no long-lived tokens on laptops
- limit what your internal AI tools can access
- know how to revoke on-chain permissions before you need to
nisedo retweeted
Been listening to @siliconcarnesf, the #1 tech podcast in France, for years, so being invited twice by @CarlosDiaz as their cybersecurity expert along @GregoireGambatt was a real honor
The Binance hack, Lazarus group, Ledger spy chips, the Drift hack
youtube.com/watch?v=7dDUnLZB…
PHP2Shell, Patch the Planet, AI bug bounty floods, open-weight models
youtube.com/watch?v=S5fSZ1lK…
If you speak french go subscribe, and if you don't it's honestly worth learning french for 🫣
soon we’ll be auditing weights instead of code
We asked GPT-6 Astra to edit Qwen3.5-0.8B weights to improve math.
It directly changed only 0.016% of weights, fixing 0.8B's reasoning loops & improving math up to 6x and even instruction following 3x, without gradients or training.
We call this Weight-Space Programming: frontier LLMs can now natively read/write neural network weights! 🧵
Blog: rikiyat.github.io/blog/weigh…
Readers added context they thought people might want to know
LLM was given weights explicitly as text in prompt and used code/forward passes (per authors' logs) to ablate Qwen looping direction, a known thinking-mode issue per model card. Primarily fixed repetition in that mode, not general 'natively' improving weights/math.
rikiyat.github.io/blog/weight-sp…
github.com/RikiyaT/lm_und…
huggingface.co/Qwen/Qwen3.5-0…
huggingface.co/RikiyaT/Qwen3.…
Since everyone asked* here are the slides from my talk today at @summit_defi → nisedo.github.io/#/talks
AI-Native Auditing in Five Minutes
- start every agent from a threat model
- give each agent a narrower scope
- run several models on the same scope
- escalate your validated lows
- check what your agents actually read
*nobody asked but Grok said it would make me sound important
Crypto hacks in 2026 are already 71% above the 2022–25 annual average, per DefiLlama.
AI helps attackers find bugs faster, and defenders need the same edge to fix them. At @summit_defi in Mumbai, @nisedo is sharing lessons from our AI auditing work, including Patch the Planet.
