Pinned Tweet
I've been working on this for 5 years, and it's finally out! I wrote a dark fantasy book (no computers involved), and it's the hardest thing I have ever done. I'm extremely proud of the final result. (But it's in French, for now.)
lechantducygne.fr/gestalt/
lechantducygne.fr/gestalt/
25
32
165
While some are busy jumping at shadows and discovering AI agents to what they're asked, Anthropic filed their S-1.
Arguing that AI is useless is a dead IMO, and I've always thought AI critics should focus on the economics instead.
Now there's hard data: blog.kwiatkowski.fr/anthropic-s1
Arguing that AI is useless is a dead IMO, and I've always thought AI critics should focus on the economics instead.
Now there's hard data: blog.kwiatkowski.fr/anthropic-s1
2
1
2
1,258
I definitely have concerns about the viability of this whole ecosystem, so I took a look and posted the analysis on my blog.
TL;DR: Anthropic was profitable this quarter and its revenue is skyrocketing. But it's unclear they can sustain this growth.
TL;DR: Anthropic was profitable this quarter and its revenue is skyrocketing. But it's unclear they can sustain this growth.
1
0
0
573
They made huge multi-year compute commitments (some conditional) in the range of $800bn, and they admit they "enter into these obligations based on revenue expectations that may not be realized". So it could still be an uphill battle.
0
0
0
391
Ivan Kwiatkowski retweeted
Leaked files from Chinese company ZRON show a vast product catalogue and police (MPS) customers. But what did they actually buy from it, and how did AI fit in? Our new Natto piece digs in. Big thanks to @JusticeRage for insights from his own analysis of the leak. Link 👇
1
4
8
1,425
I just released some new research on an unknown MikroTik backdoor compiled for TILE-Gx. IDA Pro couldn't even open the file!
I think there's more to find, would love to get more eyes on this implant. Really excited about this research!
x.com/VirLabs_AI/sta…
I think there's more to find, would love to get more eyes on this implant. Really excited about this research!
x.com/VirLabs_AI/sta…
New VirLabs research: Tessera, an undocumented backdoor targeting MikroTik RouterOS on TILE-Gx.
The samples had 0 detections on VirusTotal. Underneath a small launcher and wrapper sits a fairly sophisticated remote-control implant.
virlabs.ai/blog/tessera/
0
2
19
2,811
Port-knocking is not something you see every day. I found a cool little Linux malware with zero detections which uses this technique, but wasn't able to tie it to any known actor nor find any other variant. Has anyone seen this before?
x.com/VirLabs_AI/sta…
x.com/VirLabs_AI/sta…
[Insert witty knock-knock joke]
I found an interesting/undetected Linux sample on VirusTotal: a port-knocking launcher that waits for a packet sequence before executing a separate payload, which unfortunately I couldn't find.
virlabs.ai/blog/knock-out…
1
0
32
6,184
Man, it's great to be back to doing research. It's not groundbreaking, but sometimes looking at the broken stuff is fun. I know there are AI haters out there, but it makes me so happy to be able to do these quick investigations!
x.com/VirLabs_AI/sta…
x.com/VirLabs_AI/sta…
CLOSEDQUORUM, spotted by @TalosSecurity asks four LLMs to decide what a Windows implant should do next. AI-as-a-C2?
I analyzed two samples from their report. There is real experimentation here, but the implant was never really finished.
virlabs.ai/blog/closedquo….
0
1
26
5,348
I had never participated in #FlareOn, not for lack of interest but due to the massive time commitment it represented. This year, I decided to pit @VirLabs_AI against it and was able to solve all challenges in <2h.
I suspect next year's challenges will be very different.
I suspect next year's challenges will be very different.
3
0
48
7,076
VirLabs now has a blog. I just published some new research on Red Heron!
x.com/VirLabs_AI/sta…
x.com/VirLabs_AI/sta…
Two names in a Linux rootkit configuration led back to HestiaCP compromises reported months before Acronis's Red Heron report.
I used VirLabs to follow the trail through SIXZUT, JITTERLY and their infrastructure.
virlabs.ai/blog/red-heron/
2
3
21
4,938
Ivan Kwiatkowski retweeted
Yes…the huge frontier models are going to become superintelligent, copy themselves, escape, and then discover the only hardware around is a 1080 Ti with 11GB of vram.
Jacob Coxon's next interview on CBS News (ex Anthropic+Open AI researcher who resigned)
"We can't just unplug it because it could be copying itself over to other computers. Like it's not that difficult to find yourself because an AI is just code. It could transfer itself over rent place and then you unplug it here, but it's actually still over there and maybe it makes 10,000 copies of itself and they're all cooperating."
----
From "CBS News" YouTube channel, (full video link in comment)
61
25
362
22,109
One thing that annoys me with the AI industry's open letter (openai.com/collective-cyb…) is how they're creating a problem and asking everyone else to find a solution.
The solution is easy: if you believe your models pose grave cyber risks, stop releasing new ones for a year.
The solution is easy: if you believe your models pose grave cyber risks, stop releasing new ones for a year.
0
3
19
2,751
Cute phishing attempt today abusing @github. An issue is created in a fresh repo to send me an email notification from github.com that a suspicious sign-in was prevented. Clicking "this wasn't me" fetches support-message.github[.]io
1
0
6
2,781
This page redirects straight to user-github[.]com/generate, and this one loads GitHub's real OAuth page, with permissions like private repo access.
IOCs:
user-github[.]com
198.54.112.76
Client ID: Ov23liy9AtnLYGtaZY3H
IOCs:
user-github[.]com
198.54.112.76
Client ID: Ov23liy9AtnLYGtaZY3H
0
0
0
1,978
Ivan Kwiatkowski retweeted
Wrote a short post on my experience running GLM-5.3-Flash, DeepSeek 4 Flash, and Qwen-3.8-Next locally.
Which is the best all-around local model for CTI workflows?
medium.com/@costin.raiu/t…
Which is the best all-around local model for CTI workflows?
medium.com/@costin.raiu/t…
2
16
81
9,097
Ivan Kwiatkowski retweeted
VulnCheck recently published its analysis of SPEAKINGSTONE, a Nim implant found in ZBT router firmware.
We submitted the exact sample to VirLabs to see what it could recover from the isolated binary: app.virlabs.ai/shared/WmceoIX…
We submitted the exact sample to VirLabs to see what it could recover from the isolated binary: app.virlabs.ai/shared/WmceoIX…
2
1
7
1,378
My time with Meta has ended! I'm now focusing full-time on a start-up I co-founded, @VirLabs_AI. I made a platform where you upload a virus sample and it analyzes the sample for you with IDA Pro.
It works really well (ex: Sunshuttle, app.virlabs.ai/shared/Y56kSPD…)
It works really well (ex: Sunshuttle, app.virlabs.ai/shared/Y56kSPD…)
15
22
199
17,599
The payload used by the French police might have been low-tech, but it shines light on a threat model that is anything but.
How do you defend against an adversary that can seize your private keys, SSL certs, and can change your DNS records at will?
computerweekly.com/news/366649396…
How do you defend against an adversary that can seize your private keys, SSL certs, and can change your DNS records at will?
computerweekly.com/news/366649396…
2
43
145
13,418
For the record, a garden leave in the UK means that you're still employed by your company, not required to perform actual work, and can't be rehired or start a company.
In other words the person gets paid+vests for a year for doing absolutely nothing.
There are worse fates.
In other words the person gets paid+vests for a year for doing absolutely nothing.
There are worse fates.
John Jumper, Nobel prize winning co-creator of AlphaFold has to serve a one-year gardening leave stint before he starts work at Anthropic (originally picked up by @HughLangley @ BI)
Stints of this length given current acceleration make literally no sense.
Last month is a different world, imagine what next year will look like.
0
0
1
3,691