Pinned Tweet
The WhatsApp complaint vs NSO contains some fun technical exhibits. The user manual and Ghana contract reveal quite a bit on NSOs system design and thinking.
3
73
200
So Artex is the vibe coded agent of the month, right as we move from the vulnapocalypse to the breachapocalypse. I ran it through our internal evals to see how it compares with other public harnesses. See thread
3
3
90
15,671
I wouldn't run Artex in a sensitive environment. The agent has access to the LLM key and admin panel, without any sandboxing. Any indirect prompt injection leads to system takeover and data exfiltration.
3
0
6
1,746
It's a good tool. I get why it's used by criminals and low end espionage. But it's nothing special. You can vibe code this yourself
1
0
7
1,572
Ace Pace retweeted
Tommorow @BsidesTLV I'll talk about the journey of BragJack, where I was able to hack 5 of the most popular browsers in the world with the same technique - should be fun!
0
1
24
1,342
I think small conferences are the way to go if you actually want to hear something novel and actually talk with speakers showing cool stuff
Doing this specifically for AI Offsec is new!
Doing this specifically for AI Offsec is new!
In London for Black Hat EU? Request a seat to hear the top builders, practitioners, and researchers in the offensive AI community trade hard-won lessons.
Tuesday, December 8, in the underground Churchill War Rooms.
Invite-only. Request yours at misalignedcon.org
1
0
9
294
Ace Pace retweeted
I know this makes me a sicko but I love C. I love reading C. I love writing C. I love everything about C. I should not be ALLOWED to write C, I get it, but still.
23
19
308
16,208
I go back and forth on this because I think we've done a lot over the last 20 years to significantly improve defenses. But it's hard to argue that, at the bottom line, the average user is not materially safer today than in 2006
Not sure "The compromise didn't require AI" is the dunk on "AI driven offense" that you think it is. Its more of an indictment of the security industry's lack of real progress over the last 2 decades.
0
0
3
243
Ace Pace retweeted
זיני בודק חשד לקשר בין הרשימה המשותפת לדמוקרטים בארה”ב.
לפי החשד, בשני המקרים הופעלה אותה שיטה מתוחכמת: אנשים הגיעו בהמוניהם לקלפי, שמו פתק והלכו הביתה.
לפי החשד, בשני המקרים הופעלה אותה שיטה מתוחכמת: אנשים הגיעו בהמוניהם לקלפי, שמו פתק והלכו הביתה.
255
781
9,178
134,317
I understand the reasoning but this makes using Daybreak very risky for independent researchers
haha, so apparently OpenAI are about to start training on your Daybreak Blue sessions, with no way to opt out.
Literally stealing people's private work, as they do it, is cartoonishly evil.
It also will presumably kill Daybreak usage by security researchers. Or at least, it should. The thing OAI have had to swear they are not doing to math researchers, they are now explicitly about to start doing to security researchers.
Yet another reminder of the importance of open models.
2
0
10
850
Ace Pace retweeted
ניסינו לא להצביע. לא טוב.
ניסינו להצביע. גם לא טוב.
אמרנו נשחק את המשחק וננסה להשפיע אמרו בכלל הגזמתם
מישהו יכול פשוט להגיד לי מה עוד צריך שיקרה לעזאזל?
ניסינו להצביע. גם לא טוב.
אמרנו נשחק את המשחק וננסה להשפיע אמרו בכלל הגזמתם
מישהו יכול פשוט להגיד לי מה עוד צריך שיקרה לעזאזל?
543
137
3,059
91,595
Ace Pace retweeted
I don’t think people realize how selfless and wonderful the StackOverflow’s founders were.
Unlike reddit, x etc they insisted ALL of their content will be 100% open, nothing will ever be locked up in walled garden.
They made it a point by even offering structured data downloads!
They didn’t cared people cloning the website. They didn’t worry about putting the whole monetization thing at risk.
It was a true hacker spirit in it’s purest form.
Most folks won’t be able to grasp how hard this is. You are on top of the world. Millions of people depend on you daily. You have the rarest opportunity to rack in billions. And you still stay true to your principles.
This exactly in turn later enabled AI revolution. I still remember downloading entire SO archives and preparing it for pre-training while Reddit and others went onto lawfare and firewalling the content. Note that this was the content their users - not reddit employees - had created for free and voluntarily to help others and the world. But they locked it all up for profiting from it personally.
SO did none of that. I think they knew they will be sacrificed at the altar. Yet it will exactly serve the intent of their founding principles to help others and the world, now through AI, even at bigger scale.
All of today’s models are built upon efforts of such true pure hackers who spent their days and years to create training data for AIs. I was a proud SO contributer for many years and there are couple of times while testing models I did felt that models might have used my answers 😇.
Hats off to @codinghorror and @spolsky and so many builders and hackers at SO for moving the world forward, one revolution at a time 🫡.
Unlike reddit, x etc they insisted ALL of their content will be 100% open, nothing will ever be locked up in walled garden.
They made it a point by even offering structured data downloads!
They didn’t cared people cloning the website. They didn’t worry about putting the whole monetization thing at risk.
It was a true hacker spirit in it’s purest form.
Most folks won’t be able to grasp how hard this is. You are on top of the world. Millions of people depend on you daily. You have the rarest opportunity to rack in billions. And you still stay true to your principles.
This exactly in turn later enabled AI revolution. I still remember downloading entire SO archives and preparing it for pre-training while Reddit and others went onto lawfare and firewalling the content. Note that this was the content their users - not reddit employees - had created for free and voluntarily to help others and the world. But they locked it all up for profiting from it personally.
SO did none of that. I think they knew they will be sacrificed at the altar. Yet it will exactly serve the intent of their founding principles to help others and the world, now through AI, even at bigger scale.
All of today’s models are built upon efforts of such true pure hackers who spent their days and years to create training data for AIs. I was a proud SO contributer for many years and there are couple of times while testing models I did felt that models might have used my answers 😇.
Hats off to @codinghorror and @spolsky and so many builders and hackers at SO for moving the world forward, one revolution at a time 🫡.
New record for Stack Overflow:
<1000 questions posted last month
101
404
4,864
186,298
Even if we kill all cpu advancements we have thousands of these multipliers spread all over our codebases
Interesting to see the contrast between the obsession over single cycles many years ago, to patches like this today where with 4 lines of changes they increased throughput by 36gb/s: git.kernel.org/pub/scm/linux/…
0
0
2
319
Ace Pace retweeted
בהנתן ואלו התוצאות- נתניהו הפסיד.
תרימו טלפון ליואב ולמנסור.
תנו ליואב את השר לבטחון פנים ויש פה שקט אחרי ששר המרמלדה הרס את המשטרה.
אל תתרגשו מאף אחד.
ביבי בשביל הכסא היה יושב גם עם נסראללה.
על הדרך נרוויח גם עתיד טוב יותר לערביי ישראל.
תושיטו יד.
תרימו טלפון ליואב ולמנסור.
תנו ליואב את השר לבטחון פנים ויש פה שקט אחרי ששר המרמלדה הרס את המשטרה.
אל תתרגשו מאף אחד.
ביבי בשביל הכסא היה יושב גם עם נסראללה.
על הדרך נרוויח גם עתיד טוב יותר לערביי ישראל.
תושיטו יד.
322
471
5,173
101,411
Ace Pace retweeted
Business logic failures are very common to see in @Tenzai_Labs assessments. The impact on the business is very high and they are all “0-days” and many of them do not require the complexity of recent PHP exploits. Pentest your apps!
People are going to lose their mind when they realize its actually easier to hack things using FEATURES not CVEs.
0
2
5
182
When talking about the exploit, @tom41sh @sagitz_ from @wiz_io deserve full credit for showing this is exploitable in a generic fashion without giving away how
Last week, Tenzai’s AI hacker successfully exploited PHP2Shell across multiple PHP applications in our labs. Within days of disclosure, we had a working exploit integrated into our agent and demonstrated remote code execution against a variety of test targets.
Credit to Calif T-5.6 Sol helped uncover the vulnerability, and the PHP maintainers for their work investigating and addressing these flaws.
PHP2Shell illustrates how quickly exploitability can change. What matters is knowing which vulnerabilities can be exploited in your environment today and continuously validating that assessment as AI capabilities advance. “
We’ll fix it later” depends on assumptions about how much time, skill, and money an attacker needs. AI is making those assumptions obsolete, fast. That applies to the open-source components we all depend on. It also applies to proprietary applications and code nobody has reviewed in years. Security debt that once seemed manageable can become exploitable much sooner than expected.
Looking at a vulnerability that could haunt the internet for a decade, despair is understandable. But, it isn’t useful. AI gives defenders ways to move faster, too: investigate unfamiliar code, discover vulnerabilities, develop patches, and test whether fixes actually work. Putting that capability to work takes people, funding, and a commitment to act on the results.
At Tenzai, we’re helping security teams find exploitable weaknesses in their applications and validate remediation continuously. Our PHP2Shell results show how quickly a newly disclosed vulnerability can become a working test of real exposure.
Expect more vulnerabilities like this. Use AI to find them earlier, prioritize based on demonstrated impact, and verify the fixes.
Don’t despair. Take the initiative.
1
0
17
1,273