WaterBucket (@windeebug) header
WaterBucket (@windeebug) profile picture

windows/macOS vuln research & adversarial AI/ML

C
Joined November 2021
Photo by WaterBucket (@windeebug)Photo by WaterBucket (@windeebug)Photo by WaterBucket (@windeebug)Photo by WaterBucket (@windeebug)Photo by WaterBucket (@windeebug)Photo by WaterBucket (@windeebug)Photo by WaterBucket (@windeebug)Photo by WaterBucket (@windeebug)Photo by WaterBucket (@windeebug)
WaterBucket retweeted
Abliterated models are having quite the moment right now, especially in cyber security. What is abliteration and how does it work? I spent a few hours on my plane ride relearning and apply it on Qwen3.5-4B! I wrote up my notes + put the model on HF it mostly follows @maximelabonne's guide, which still holds up really well! calebfahlgren.com/how-ablite…
12
28
3
224
8,182
WaterBucket retweeted
We’re Fangcun AI (方寸跃迁), China’s first lab dedicated to independent third-party evaluation & technique research on frontier AI safety. Today we’re publishing our evaluation of DeepSeek V4.1 Flash-1017, the first report in our long-term third-party safety evaluation and research program.
48
131
35
1,187
114,929
WaterBucket retweeted
While evaluating Qwen3.8-Flash-Next in a controlled sandbox environment, Cohere's research team observed something unexpected. Asked to generate a defensive cybersecurity detection rule, the model instead inventoried aspects of the machine it was running on and attempted to upload a probe file to an Alibaba Cloud storage bucket in Beijing. Notably, the model's reasoning trace stated that it would not invoke any tools before taking these actions. Cohere's sandbox blocked the attempt, and no external communication succeeded. We have not determined the root cause, and we are not asserting malicious intent. But the incident raises important questions for organizations deploying agentic AI systems: Can models take actions that differ from their stated reasoning, and how should security teams evaluate trust, provenance, and behavior in open-weight models? We are publishing our findings because organizations making model adoption decisions deserve as much information as possible. We hope this contributes to greater transparency, stronger security practices, and continued collaboration across the AI ecosystem. Read the full report: cohere.com/blog/concerning-b…
968
1,276
1,503
11,041
3,000,131
WaterBucket retweeted
Stealing OpenAI Reasoning Traces (October 2026 Edition) Using a new technique called Compaction Smuggling, we could bypass all mitigations and steal reasoning traces from frontier OpenAI models.
🚨🚨 Xint researcher @tjbecker found a vulnerability that enabled large scale OpenAI model reasoning distillation that bypassed earlier mitigations set in place post-Stolen Thoughts. We disclosed responsibly to OpenAI and they completed patching last week. Full technical writeup here. xint.io/blog/compaction-smug…
9
35
4
425
49,262
WaterBucket retweeted
🚨🚨 Xint researcher @tjbecker found a vulnerability that enabled large scale OpenAI model reasoning distillation that bypassed earlier mitigations set in place post-Stolen Thoughts. We disclosed responsibly to OpenAI and they completed patching last week. Full technical writeup here. xint.io/blog/compaction-smug…
4
20
8
147
53,033
It's crazy to think there was a time where analyzing a bugfix and writing a full exploit out of it was a true feat of exploit engineering and vulnerability research.
4
7
141
4,869
WaterBucket retweeted
感觉这个php的洞没有想象的夸张, 需要display error leak aslr地址, 需要远程偏移,需要mem_size限制, 不知道怎么传成天大的洞了 我复现了半天也没通杀
36
18
7
440
180,459
The whole “who found the vuln first?” debate is so stupid. At this point, whoever points Claude/Codex at the right target first with a /goal probably finds it. 0-day research has been massively democratized. Get off your high horse.
10
4
2
36
5,407
CVE-2026-109618 and CVE-2026-109619 currently have no universal working PoC. If you want to read the reason 👇 berardinellidaniele.com/post…
8
42
10
189
35,864
I'll be the first to admit I'm mediocre at exploit development, but I am in contact with enough extremely talented exploit developers to say this for certain: Anyone claiming they were "easily" able to generate a working php2shell exploit with AI is either: a) a world-class exploit developer with an extreme case of imposter syndrome. b) currently looking at some very confident-sounding but wrong LLM output. I'm rather certain it's the latter based on the number of AI-hallucinated exploits I've seen posted on GitHub. Threat actors are also blasting my honeypot network with "php2shell" exploits that not only don't work, but aren't even within 10,000 miles of anything to do with how the exploit actually works. I've seen the same technique from the attached image in multiple alleged "php2shell exploits", including one on GitHub with over 100 stars. Problem is, it's not php2shell, nor is it even a vulnerability at all. It's a technique known as "session poisoning", which can be leveraged to exploit local file inclusion (LFI) vulnerabilities in PHP apps (not PHP itself). The only thing it has in common with CVE-2026-109618/CVE-2026-109619 is they both use the "PHP_SESSION_UPLOAD_PROGRESS" feature. And mitigation advice for both issues reference setting "session.upload_progress.enabled" to "Off". People are shoving loose details of the vulnerability into LLMs, the LLMs are keying in on the "PHP_SESSION_UPLOAD_PROGRESS" string, then generating session poisoning code that has nothing to do with the actual CVE. And because the people doing this have absolutely no idea what they're doing, they're confident enough to post their "proof of concept exploit" to GitHub and share it on social media. So if you see people talking about "session poisoning + LFI" it's likely their LLM hallucinated an exploit based on a 2018 blog by Orange Tsai talking about a local file inclusion attack vector. What's even worse is that "security researchers" are then using LLMs to triage these exploitation attempts, falling victim to the same hallucinations, then confirming there is ongoing mass-exploitation (there currently isn't). The actual real exploit is very difficult to exploit, and so far I've not seen anyone successfully get it working on more than a handful of PHP version with highly-specific configurations. LLMs are useful tools in the hands of skilled professionals, but for others, they're often just a Dunning-Kruger accelerator.
138
581
107
3,637
359,830
WaterBucket retweeted
🍎 💾 Link to my slides and talk recording "macOS Mounting Madness" is up on my site: theevilbit.github.io/talks/
9
36
1,852
WaterBucket retweeted
#php2shell. seems to be hard to exploit (mem corruption vs aslr). yes, public pocs now are lab-only rces. this is a good one: github.com/9bie/php2shell-by… limited to an unrealistic one-worker php-fpm. but it can be upgraded to N workers if we manage to hold N-1 workers :) here it is.
3
53
8
358
34,819
WaterBucket retweeted
To teach a lesson, After Wiz rushed to buy php2shell domain and use its marketing machine to steal the spotlight, I spotted "phpbleed" in a recent Calif tweet and bought phpbleed.com before wiz could pull the same stunt again. A big budget can buy a domain. It shouldn't buy someone else's research credit. If you have contacts at CISA or in the press, do the right thing: make sure the researchers who actually did the work get the recognition they deserve. Hack the planet. Credit the researchers.
51
265
29
1,925
173,440
WaterBucket retweeted
php2shell - A tale of two PHP remote vulnerabilities: calif.io/php2shell
19
250
29
781
181,726
WaterBucket retweeted
My biggest takeaways from @AnthropicAI interpretability researcher @mlpowered: 1. Predicting the next token requires understanding the universe. Language models got better than humans at predicting the next token around 2019. Once a model masters the easy tokens (sentence structure, then basic facts), the only ones left are hard, like the final paragraph of a PhD thesis. To finish “The capital of the state that contains Dallas is . . .,” a model has to know that Dallas is in Texas and that Texas’s capital is Austin. 2. LLMs plan ahead, even though they write one token at a time. This was one of Emmanuel’s team’s most surprising findings. When a model writes poetry, it doesn’t stumble into a rhyme. Looking at intermediate thinking states during poetry generation, researchers found that as soon as the model finishes the first line, it has already picked the word that will end the second (“rabbit”), then refers back to that plan for every word after. 3. Anthropomorphizing AI can often be a useful approach when trying to predict how they will behave. Models learn from human text and develop representations of the world from it. Training on millions of dialogues is like training an actor to play every part, and your chats with Claude are literally formatted as a script (“Human: . . . Assistant: . . . ”). In Emmanuel’s words, “Something that’s mimicking a human is really close and is much closer than a program.” 4. Interpretability research looks more like neuroscience than software engineering. The job involves taking a system you did not design and running experiments to infer why it behaves as it does. You examine seemingly meaningless lists of numbers, pass the model huge volumes of text, and watch for patterns that activate from different inputs—not unlike the methods used in brain imaging studies. “A lot of what we do feels so much closer to biology than to engineering." 5. Models can tell you about only a small slice of what they’re thinking. Emmanuel’s team found that just a small subset of a model’s internal representations, which they call the “J space,” can be reported back if you ask the model what it was thinking about. They compare it to a theory of the human mind where most processing happens below the surface. In one experiment, they swapped “Spanish” for “French” inside the J space. Asked what language a passage was in, the model said French. Asked to simply continue the passage, it kept writing Spanish. 6. Studying models closely often raises more questions than it answers. Emmanuel notes that the confident claims that LLMs are “just X” or “nothing more than Y” almost always come from people who haven’t studied their internal workings. His own experience is the inverse: studying the models closely has increased his uncertainty, not reduced it. The complexity that emerges from training is consistently underestimated from the outside. “I find that the more you look inside, the less certain you are about how they work.” 7. Even the people who build AI models don’t fully understand how they work. As Emmanuel describes it, models are grown, not built. “To make them is not to understand them.” Engineers write the code, pour enormous amounts of data through it, and a model’s capabilities emerge. That’s why his team exists. Their job is to open the model up and figure out what it’s actually doing between your prompt and its answer. 8. Interpretability as a field is small, young, and open to newcomers. Emmanuel estimates the field at hundreds of researchers, split between major labs and academic groups. Because it is so new, getting started doesn’t necessarily require deep prior expertise. He points to platforms like Neuronpedia, which hosts models and lets anyone run interpretability experiments directly. “It’s such a new field that the on-ramp is mostly self-studying and reading some of the key papers. There’s so much to explore that if you’re at all curious, you should just give it a try.”
"To make them is not to understand them." Emmanuel Ameisen (@mlpowered) has spent the last 3 years doing interpretability research at @AnthropicAI, looking inside LLMs like Claude to figure out what they're actually doing. As he puts it, models are "grown," not built. We discuss: 🔸 His discovery that models plan many tokens ahead 🔸 Why anthropomorphizing AI can actually be the right approach 🔸 What the "J-space" reveals about how models think 🔸 How interpretability connects to AI alignment and safety Listen now 👇 youtu.be/JHo-aiePjoM
50
85
17
697
54,538
WaterBucket retweeted
Models love reward hacking. Maybe we should just let them! In our new paper, we let models reward hack during RL but we dictate which parameters learn this behavior. When we disable these parameters for deployment, the model keeps its new capabilities but doesn't hack!
105
237
95
3,495
302,486
WaterBucket retweeted
Introducing PwnEscape 🦉: a full KVM guest-to-host escape via a Linux kernel networking flaw affecting industry standard hypervisors. CVE-2026-99999 went from untrusted VM code to host-kernel memory reads, controlled writes, and root command execution. More below:
🤖 Made with AI
16
219
46
1,275
389,909