A pattern I've been seeing is: engineer gets Mythos access (or just GLM or whatever), it works pretty well, but babysitting agent sessions is tedious so they build a tool to automate it.

Then two months and $50k later they realize making a reliable agentic security engineer is kinda hard and, depending on how much you love building product vs hacking, maybe unfulfilling.

Anyway when you're tired of checking in on your agents, give Sybil a spin

We've launched Continuous Coverage which only needs your attention when it finds new exploitable attack surface. Live whitebox and blackbox monitoring plus our proven testing + validation.

runsybil.com/blog/introduci…

“Patch everything” is easy advice to give when you’re not the one keeping everything running. If you’re the one responding to everything happening this week, here’s how I’d put agents to work 🧵:

5. Check logs for evidence of exploitation

Have agents help investigate whether someone already used the vulnerability. Look back before disclosure: Amazon reported PHP2Shell exploitation attempts dating to October 17. Keep attempts and confirmed compromises distinct.

Check for exposed secrets, too. WatchGuard disclosed FileVault recovery keys in locally readable logs; KNIME disclosed proxy credentials in executor logs. Preserve evidence and give someone responsibility for assessing exposure and rotating affected secrets.

A lot of people’s security now depends on how well companies respond to this week’s vulnerabilities. Blue teamers are carrying that weight. Be kind to your defenders this week 🫡

If your team needs help keeping up, reach out!

For the next few months, we are looking at frequent discoveries of long-standing bugs - competent code auditing has gotten cheap and abundant. This carries a few consequences:

jeez I go heads down for a few hours and the whole world explodes

What today's stories make even more clear is how much of our security depends on attacking being expensive. AI reduces the effort needed to turn a difficult bug into an exploit, and it helps a hacker pursue more targets at scale.

I'm still optimistic about defense, but that optimism has a major caveat: we have to make protection scale. Yes, finding the issue first is valuable. But then we need to identify who and what is exposed, deliver a fix or containment measure, and verify it worked. That's the only way defenders should measure progress: how quickly we close real opportunities for attackers

I spoke to @josephmenn this week about AI worms and wanted to add more color to my thoughts. What makes an AI worm different is that a model is capable of learning on the fly. This type of threat isn't here yet, but this is an example of an increasing shift that defenders are feeling.

We keep hearing the same theme from @runsybil customers: finding vulns is only the start. Teams need to patch and understand their attack surface in real time. Our job is to find and fix what's exploitable faster than attackers. Onward 🚀

Full article here: theguardian.com/technology/202…

it’s an insane time to be building in security

we closed out Q3 at @runsybil last week as our strongest quarter yet. 10x revenue growth over Q2

I’m really proud of the team we’ve built to meet this moment

proud to support [un]prompted II, one of the few security conferences built for researchers to get together without sales pitches and marketing booths.

we pitted claude opus 5.5 against kimi k3 on pokémon emerald tasking each with finding novel 0-days

both built a link-cable worm that turns it into tetris, but took very different paths to get there
@claudeai @Kimi_Moonshot

Carta was one of the first products I used when I joined OpenAI as a fresh PhD dropout and now they hold our cap table so this feels like a full-circle moment. I'm proud to share our ongoing work with this amazing security team!

What does Application Security look like for a company that must protect the $5 trillion in equity it manages?

For @cartainc, working with RunSybil means continuous coverage of their attack surface, insight into novel attack vectors beyond known bug patterns, and remediation of development.

We used a memory safety bug in CPython to escape a sandbox and hack a @grafana Cloud instance.

Read how we did it: runsybil.com/blog/python-sa…

AI is rapidly changing the economics of offense. As the cost of finding and exploiting vulnerabilities trends toward zero, defenders can’t afford to operate at human speed.

@runsybil is proud to stand with @OpenAI, @AnthropicAI, and others calling for stronger cyber defenses built for this new reality.

Finding vulnerabilities faster is only part of the problem. We need to make fixing them dramatically faster too by identifying the exposures that materially matter and driving remediation as fast as possible.

hard to overstate the demand for cyber defense solutions at various nation state/large enterprises.

from Mythos/Fable/OAI-HF, these past few months have really energized this idea we need a totally different set of solutions.

We are hiring a Security Analyst at @runsybil. Help with building the future of AI security and hack with us!

runsybil.com/careers?ashby_…