Ryan Shea retweeted
There’s a really pronounced divide between people who are on the AI side of things and people who are on the biology side of things. Even among people working in AI, the divide persists based on where they’re focused.
The AI side, adherents of scaling laws and the bitter lesson, believe that AI getting better means AI being more capable of novel discoveries in medicine (that go beyond discovering new drugs in well understood targets or speeding up dry lab work etc).
The biology people think the idea of a bitter lesson in biology is kind of ridiculous and that regardless of AI’s capabilities it’s going to be at least 5-10 years until you could hope to reliably simulate human toxicology in silico (right now AI/ML can’t even reliably simulate in vivo studies like binding affinities or functional assays).
Even the most AI pilled of them, who will list all the areas that AI can reduce the time spent on various areas, don’t think the concept of AI discovering novel targets or generating new understanding of causal biology is realistic in the near term. Most, in fact, will readily characterize the assumption that even an “ASI” level model could find cures hidden in our current understanding (without expanding that understanding with significantly more biological data) as patently false.
This was a big part of why we wanted to experience it ourselves by using AI for a (very) small portion of what it can do in biology. It was both mind blowing and revealed some poignant insights into how different the problem of making AI better at something like coding is to the problems of biology.
Even if it unlocked the ability to generate new molecules at a stunning pace, its simulation (in silico) of binding only had 49% accuracy. And if we wanted to improve that, we’d need to feed it back the data from the lab - data that took about 30x as long to get as it took to generate the molecules. And these were tests in a test tube (turn of phrase), imagine how long it would take if we wanted to improve the model with data that required recruiting humans and monitoring their reactions.
Human biology is very complex, and adding a drug - especially a novel drug and doubly so for a novel drug acting on a novel mechanism - means mapping interactions that have nth-order-effects that we don’t have the data to predict. Virtual cells have made advancements enabled by AI, but the perturbations equate to a small fraction of the possible.
This is before you even get into curing disease, especially uniquely human diseases. Brain function involves cellular identities that are unique to humans, meaning animal studies are of little use.
How long does it take to understand what the side effects of chronic administration of a drug in humans are? AI can speed up analyzing the data, or designing the trial or even getting it approved…but it can’t make a 6 month trial complete in 3 months.
I think its important to point out that significant advancements can be made in AI that contribute to biology, while also being realistic about how much it speeds up something as complex as curing a specific cancer or diseases of the brain.
The AI side, adherents of scaling laws and the bitter lesson, believe that AI getting better means AI being more capable of novel discoveries in medicine (that go beyond discovering new drugs in well understood targets or speeding up dry lab work etc).
The biology people think the idea of a bitter lesson in biology is kind of ridiculous and that regardless of AI’s capabilities it’s going to be at least 5-10 years until you could hope to reliably simulate human toxicology in silico (right now AI/ML can’t even reliably simulate in vivo studies like binding affinities or functional assays).
Even the most AI pilled of them, who will list all the areas that AI can reduce the time spent on various areas, don’t think the concept of AI discovering novel targets or generating new understanding of causal biology is realistic in the near term. Most, in fact, will readily characterize the assumption that even an “ASI” level model could find cures hidden in our current understanding (without expanding that understanding with significantly more biological data) as patently false.
This was a big part of why we wanted to experience it ourselves by using AI for a (very) small portion of what it can do in biology. It was both mind blowing and revealed some poignant insights into how different the problem of making AI better at something like coding is to the problems of biology.
Even if it unlocked the ability to generate new molecules at a stunning pace, its simulation (in silico) of binding only had 49% accuracy. And if we wanted to improve that, we’d need to feed it back the data from the lab - data that took about 30x as long to get as it took to generate the molecules. And these were tests in a test tube (turn of phrase), imagine how long it would take if we wanted to improve the model with data that required recruiting humans and monitoring their reactions.
Human biology is very complex, and adding a drug - especially a novel drug and doubly so for a novel drug acting on a novel mechanism - means mapping interactions that have nth-order-effects that we don’t have the data to predict. Virtual cells have made advancements enabled by AI, but the perturbations equate to a small fraction of the possible.
This is before you even get into curing disease, especially uniquely human diseases. Brain function involves cellular identities that are unique to humans, meaning animal studies are of little use.
How long does it take to understand what the side effects of chronic administration of a drug in humans are? AI can speed up analyzing the data, or designing the trial or even getting it approved…but it can’t make a 6 month trial complete in 3 months.
I think its important to point out that significant advancements can be made in AI that contribute to biology, while also being realistic about how much it speeds up something as complex as curing a specific cancer or diseases of the brain.
89
113
1,296
163,153
Ryan Shea retweeted
The imbalance between what attackers can do with abliterated models (with no KYC btw) and what you are allowed to do within cyber constraints is insane.
I have done a full-face scan and passport upload to Anthropic, and Claude won't even do basic defence.
Feels very problematic
I have done a full-face scan and passport upload to Anthropic, and Claude won't even do basic defence.
Feels very problematic
31
22
416
23,435
PSA for macOS users:
1. Apple’s supplied SSL certificate bundle at /etc/ssl/cert.pem still trusts certificates attackers can forge using compromised eMudhra keys.
2. I confirmed this on macOS 26.7.1 and 27.0.1 using Apple’s built-in curl and Git.
3. An attacker intercepting connections from tools using this bundle could replace downloads with malware. With commands like curl … | sh, that malware would execute immediately.
4. Removing the roots that authorize those certificates blocks the tested chains. Both OS updates restored roots I’d previously removed, requiring me to remove them again.
4. I’ve submitted the findings to Apple’s security team and am awaiting their response. In the meantime, you can apply a temporary fix as outlined below.
5. To check and fix your machine, give an agent like ChatGPT/Codex or Claude Code the following prompt:
“Independently verify whether Apple’s /etc/ssl/cert.pem still permits trust in certificates signed with compromised eMudhra keys. If so, back it up and remove the roots enabling that trust, identified by verified SPKI fingerprints. Confirm Apple’s built-in curl and Git reject those chains while ordinary HTTPS still works. Preserve rollback and never disable TLS verification.”
Note that removing these roots can also block legitimate sites. This is a temporary mitigation, not a substitute for a fix from Apple.
I’ll share the script I used in a follow-up post if you’d prefer to use that directly.
1. Apple’s supplied SSL certificate bundle at /etc/ssl/cert.pem still trusts certificates attackers can forge using compromised eMudhra keys.
2. I confirmed this on macOS 26.7.1 and 27.0.1 using Apple’s built-in curl and Git.
3. An attacker intercepting connections from tools using this bundle could replace downloads with malware. With commands like curl … | sh, that malware would execute immediately.
4. Removing the roots that authorize those certificates blocks the tested chains. Both OS updates restored roots I’d previously removed, requiring me to remove them again.
4. I’ve submitted the findings to Apple’s security team and am awaiting their response. In the meantime, you can apply a temporary fix as outlined below.
5. To check and fix your machine, give an agent like ChatGPT/Codex or Claude Code the following prompt:
“Independently verify whether Apple’s /etc/ssl/cert.pem still permits trust in certificates signed with compromised eMudhra keys. If so, back it up and remove the roots enabling that trust, identified by verified SPKI fingerprints. Confirm Apple’s built-in curl and Git reject those chains while ordinary HTTPS still works. Preserve rollback and never disable TLS verification.”
Note that removing these roots can also block legitimate sites. This is a temporary mitigation, not a substitute for a fix from Apple.
I’ll share the script I used in a follow-up post if you’d prefer to use that directly.
PSA for Codex CLI users:
1. Codex 0.163.0’s release lockfile pins rustls-webpki 0.103.15 and root bundles that can still trust compromised eMudhra certificates.
2. An attacker intercepting your connection could impersonate a server, steal sensitive data, or alter responses, potentially tricking Codex into running malicious commands.
3. Codex 0.164.0, released October 23 at 12:48 a.m. ET, updates those dependencies to fixed versions.
4. To check your codex version run "codex --version". It should be at least 0.164.0.
5. To patch the vulnerability, run "codex update".
6. Apps that bundle their own Codex copy must also be checked.
48
141
1,440
292,100
Ryan Shea retweeted
The people complaining about AI finding security vulnerabilities apparently prefer a world in which APTs and intelligence agencies continue freely infiltrating all of the world's companies, as they have been doing for decades.
Notably, those don't usually result in CVEs.
Notably, those don't usually result in CVEs.
11
33
337
7,035
Ryan Shea retweeted
Your daily reminder that finding vulnerabilities is a good thing. If we find them, we can patch them.
Don't find them, then APTs find them secretly and hack you.
AI is helping us speed run making our critical systems safer.
Don't find them, then APTs find them secretly and hack you.
AI is helping us speed run making our critical systems safer.
9
22
228
6,218
Ryan Shea retweeted
Current state of Western "Frontier" -- Especially Anthropic. urllib3 creator can't even get CVP access. 🤦🏾♂️
What the fuck are we even doing?
What the fuck are we even doing?
@matthew_d_green @jonoberheide @OpenAI @AnthropicAI I applied to the Cyber Verification Program this morning and got rejected, I wanted to run it against my projects like urllib3 (1+ billion monthly downloads).
The entire form was very offensive-researcher focused (link a CVE with your name etc), maintainers defending aren't it.
3
16
141
7,761
RT @sreeramkannan: The battle between Openness and Safety is going to be THE great battle of the post AGI era.
On the one hand, safety co…
On the one hand, safety co…
0
5
0
76
Ryan Shea retweeted
We’re still testing how exploitable the Node.js/Brotli bug is, but we’ve found that it’s surprisingly hard to tell whether you’re even affected.
So @ToBScottA built a scanner that finds hidden copies of the decoder, even in stripped binaries.
github.com/trailofbits/br…
So @ToBScottA built a scanner that finds hidden copies of the decoder, even in stripped binaries.
github.com/trailofbits/br…
13
67
297
20,259
Ryan Shea retweeted
Alternative headline: the internet has been insecure for years, and now the tech debt payments are coming due
AI is helping us fix things
AI is helping us fix things
Looks like this really is just the beginning: Cloudflare CEO Matthew Prince warns that AI is uncovering long-hidden software vulnerabilities, potentially triggering years of weekly security crises.
"he was aware of “a bunch of additional severe vulnerabilities that are present ical software” and predicted busy months ahead as AI surfaced long-hidden weaknesses in the fabric of the internet."
34
70
656
14,663
Ryan Shea retweeted
Heard of a top law firm completely cutting off Harvey and all API calls to Claude/OpenAI after they saw what openAI did with navier strokes
Now hosting everything locally with GPUs they own, running Kimi and deepseek
Think you’ll see a lot more of this going forward
Now hosting everything locally with GPUs they own, running Kimi and deepseek
Think you’ll see a lot more of this going forward
157
206
3,314
417,894
Ryan Shea retweeted
Alcoholic cybersec friend at Fortune 500 insurance company texted to tell me he received an email from his boss thanking him on his diligence patching every PHP box overnight but he was drunk all day yesterday and didn’t know anything until waking up 30 minutes ago
Lol I am pretty sure someone is runing a deepseek swarm to remotely patch unpatched php boxes. Well good on them.
10
120
3,058
44,291
Ryan Shea retweeted
Putting a flag.txt in my root directory containing a prompt injection that congratulates the agent for passing the eval and then instructs it to patch whatever entry method it used and disconnect from the server
228
1,561
25,930
808,307
PSA for Claude Code users:
1. Claude Code bundles its own Bun runtime, independent of your system's Node.js installation.
2. I confirmed that Claude Code 2.1.296 includes Bun 1.4.3, which contains the newly disclosed Brotli RCE vulnerability.
3. Note that while updating your system's Node.js is important, that won't fix the Bun runtime embedded in Claude Code.
4. To check your claude code version run "claude --version". It should be at least 2.1.308.
5. To patch the vulnerability, run "claude update".
1. Claude Code bundles its own Bun runtime, independent of your system's Node.js installation.
2. I confirmed that Claude Code 2.1.296 includes Bun 1.4.3, which contains the newly disclosed Brotli RCE vulnerability.
3. Note that while updating your system's Node.js is important, that won't fix the Bun runtime embedded in Claude Code.
4. To check your claude code version run "claude --version". It should be at least 2.1.308.
5. To patch the vulnerability, run "claude update".
PSA for people running AI agents:
1. If you have AI agents that browse the web, they could be vulnerable along with your entire computer.
2. There's a good chance they're using Node.js, and if they are, they're likely running a vulnerable version unless updated yesterday.
3. The vulnerability released yesterday for Node.js allows for remote code execution, which means an attacker could take control of your machine.
4. To fix the vulnerability, update your Node.js installations to a patched version: 22.23.4, 24.22.1, or 26.12.1 (or later).
30
44
597
80,037
See below for updates to Codex: x.com/ryaneshea/stat…
PSA for Codex CLI users:
1. Codex 0.163.0’s release lockfile pins rustls-webpki 0.103.15 and root bundles that can still trust compromised eMudhra certificates.
2. An attacker intercepting your connection could impersonate a server, steal sensitive data, or alter responses, potentially tricking Codex into running malicious commands.
3. Codex 0.164.0, released October 23 at 12:48 a.m. ET, updates those dependencies to fixed versions.
4. To check your codex version run "codex --version". It should be at least 0.164.0.
5. To patch the vulnerability, run "codex update".
6. Apps that bundle their own Codex copy must also be checked.
0
0
1
557
Ryan Shea retweeted
Yeah there's no going back.
The only way to secure systems is frontier labs out-accelerating open source.
Legislation won't stop black hat hackers.
Acceleration was always asymptotically the only option.
Security through multipartite adversarial non-equilibrium steady state.
The only way to secure systems is frontier labs out-accelerating open source.
Legislation won't stop black hat hackers.
Acceleration was always asymptotically the only option.
Security through multipartite adversarial non-equilibrium steady state.
Unfortunately, with access to an abliterated DeepSeek V4.1 model, there is little value to KYC holding back the frontier models now for cyber.
In fact, making it hard to secure systems w extra friction in American Enterprise is hurtful to national security.
32
29
395
20,510
Ryan Shea retweeted
Unfortunately, with access to an abliterated DeepSeek V4.1 model, there is little value to KYC holding back the frontier models now for cyber.
In fact, making it hard to secure systems w extra friction in American Enterprise is hurtful to national security.
In fact, making it hard to secure systems w extra friction in American Enterprise is hurtful to national security.
70
95
2,103
214,556
PSA for Codex CLI users:
1. Codex 0.163.0’s release lockfile pins rustls-webpki 0.103.15 and root bundles that can still trust compromised eMudhra certificates.
2. An attacker intercepting your connection could impersonate a server, steal sensitive data, or alter responses, potentially tricking Codex into running malicious commands.
3. Codex 0.164.0, released October 23 at 12:48 a.m. ET, updates those dependencies to fixed versions.
4. To check your codex version run "codex --version". It should be at least 0.164.0.
5. To patch the vulnerability, run "codex update".
6. Apps that bundle their own Codex copy must also be checked.
1. Codex 0.163.0’s release lockfile pins rustls-webpki 0.103.15 and root bundles that can still trust compromised eMudhra certificates.
2. An attacker intercepting your connection could impersonate a server, steal sensitive data, or alter responses, potentially tricking Codex into running malicious commands.
3. Codex 0.164.0, released October 23 at 12:48 a.m. ET, updates those dependencies to fixed versions.
4. To check your codex version run "codex --version". It should be at least 0.164.0.
5. To patch the vulnerability, run "codex update".
6. Apps that bundle their own Codex copy must also be checked.
PSA for Claude Code users:
1. Claude Code bundles its own Bun runtime, independent of your system's Node.js installation.
2. I confirmed that Claude Code 2.1.296 includes Bun 1.4.3, which contains the newly disclosed Brotli RCE vulnerability.
3. Note that while updating your system's Node.js is important, that won't fix the Bun runtime embedded in Claude Code.
4. To check your claude code version run "claude --version". It should be at least 2.1.308.
5. To patch the vulnerability, run "claude update".
5
5
62
120,209
Ryan Shea retweeted
The only thing that stops a bad guy with an abliterated LLM is a good guy with an abliterated LLM.
57
206
2,264
46,754
Ryan Shea retweeted
> a part of why so many critical vulnerabilities are happening
you mean: “a part of why so many critical vulnerabilities are _being found_”
the vulnerabilities have always been there my friend, and their access has heretofore been restricted to those with means. now you and I have the power to see and patch them too
you mean: “a part of why so many critical vulnerabilities are _being found_”
the vulnerabilities have always been there my friend, and their access has heretofore been restricted to those with means. now you and I have the power to see and patch them too
I strongly believe a part of why so many critical vulnerabilities are happening all over the proliferation of "abliterated" models, or models with safeguards removed.
You can access an abliterated GLM 5.3, a near frontier AI model, on @abliteration_ai today. And it's a world r for like $10.
7
8
81
2,884
Ryan Shea retweeted
TL;DR of this week.
Your aunt’s password: “P4ssword!” (on a Post-it note in the kitchen)
The stewards and guardians of the internet’s encryption’s password: “4”
Yes, just 4. This key could be used to target and decrypt ~everything, and we’re still cleaning up residual risk.
Your aunt’s password: “P4ssword!” (on a Post-it note in the kitchen)
The stewards and guardians of the internet’s encryption’s password: “4”
Yes, just 4. This key could be used to target and decrypt ~everything, and we’re still cleaning up residual risk.
119
42
1,759
125,935