Pinned Tweet
The Xint Code demo is live, and it includes a full scan of PostgreSQL for you to inspect.
Almost half of the findings were new 0days so had to be redacted 👀 Sorry!
Anyone can login at code.xint.io and check it out
Almost half of the findings were new 0days so had to be redacted 👀 Sorry!
Anyone can login at code.xint.io and check it out
Xint Code discovered a highly exploitable heap-buffer-overflow in PostgreSQL that existed for over 20 years.
Our research team exploited this bug to claim $30,000 at ZeroDayCloud in December!
Bug details are below
1
3
38
11,717
Tim Becker retweeted
@_NathanCalvinalized this anywhere, but I think the next 12-18 months will have an enormous amount of innovation in the cybersecurity industry/community.
I think there are some good reasons to think a number of those interventions will shift economics in favor of defenders, even against model capabilities in 12-18mo.
But there's a diffusion lag time and tons of frictions. Quite concerned about the "cyber poverty line" and the long tail of e.g. critical infrastructure.
I think there are some good reasons to think a number of those interventions will shift economics in favor of defenders, even against model capabilities in 12-18mo.
But there's a diffusion lag time and tons of frictions. Quite concerned about the "cyber poverty line" and the long tail of e.g. critical infrastructure.
5
10
132
7,088
Tim Becker retweeted
We have an epic bug to show off soon, but after seeing the marketing and branding of the PHP bugs (it's well done and I enjoyed much), I'm not convinced we can beat that level of branding despite our bug being "holy grail of web server pwn" 😭
16
17
237
25,826
Tim Becker retweeted
It’s going to be really funny if everyone pointing their LLMs at the PHP codebase tonight finds dozens of OTHER critical vulnerabilities aside from the ones getting fixed tomorrow
30
47
973
48,725
Tim Becker retweeted
Hackers get $1,262,000 for 98 zero-days at Pwn2Own Ireland
bleepingcomputer.com/news/security/…
bleepingcomputer.com/news/security/…
bleepingcomputer.com/news/security/…
bleepingcomputer.com/news/security/…
2
14
59
8,962
Tim Becker retweeted
“I ran <best internal model> for N trillion tokens at <frontier lab> and it couldn’t even dent <fundamental assumption>” should automatically get Best Paper at CRYPTO/Eurocrypt.
8
18
179
6,954
Tim Becker retweeted
Had a blast competing as part of team @xint_official! Proud that all our exploits succeeded on the first try!
As always it was great meeting old and new friends! Until next time!
As always it was great meeting old and new friends! Until next time!
Congratulations to Team Xint (@yves_bieri @cdor1 @tjbecker @taisic_) for their 2nd place finish + $240k in winnings at #Pwn2Own Ireland:
🎯 5/5 on their exploit submissions, including the Home Assistant Green, Google Pixel 10, Oracle Autonomous AI Database, LiteLLM, and Philips team to hack the Pixel 10 (and might have won us the whole thing if it didn't turn out to have been a known bug)
🤝 First time we competed as team Xint
And special thank you to all the organizers and judges at @thezdi for their work making such a high quality event happen and bringing together the best talent from around the world to compete
And of course congrats to @ikotas00 on their first place finish (first Japanese team to win Master of Pwn!)
0
5
21
777
Tim Becker retweeted
Cool little side note - as part of testing GhostCompact @tjbecker built a fully-working source code scanning application that he called GhostScan. GhostScan found genuine 0-day vulnerabilities in critical open source software, including CVE-2026-84783 in OpenSSL, demonstrating that you could use compaction for generating real work products.
xint.io/blog/openai-co…
xint.io/blog/openai-co…
🫸👻🫷🧵
Let's talk GhostCompact:
What if you could cut your output token costs on OpenAI by 97-99%? 🤑
Our researcher @tjbecker found a discrepancy between the actual token costs burned versus what ended up being billed. He had a hunch and used Xint to validate that there was a logic bug in OpenAI's compaction feature released in February 2026 that led to billing based on compacted output and not on the actual tokens consumed.
xint.io/blog/openai-co…
1
3
12
1,348
Tim Becker retweeted
These combined to enable massively discounted inference from frontier OpenAI models, with the biggest discounts on high-input-token tasks. To demonstrate the effectiveness, we built a GhostCompact-based security scanning harness which found OpenSSL CVE-2026-84783 for <$3.
2
1
7
683
Tim Becker retweeted
🫸👻🫷GhostCompact: abusing compactions for 99% discounted OpenAI API model inference.
Two things combine to make this possible:
1. A billing logic bug with inline compactions
2. A new technique to use compactions as inference
Two things combine to make this possible:
1. A billing logic bug with inline compactions
2. A new technique to use compactions as inference
🫸👻🫷🧵
Let's talk GhostCompact:
What if you could cut your output token costs on OpenAI by 97-99%? 🤑
Our researcher @tjbecker found a discrepancy between the actual token costs burned versus what ended up being billed. He had a hunch and used Xint to validate that there was a logic bug in OpenAI's compaction feature released in February 2026 that led to billing based on compacted output and not on the actual tokens consumed.
xint.io/blog/openai-co…
4
5
37
3,029
Tim Becker retweeted
2. Compactions are actually fully steerable inference! They just output an encrypted blob instead of raw tokens. However, the results inside can be cheaply extracted by passing them to a cheap model.
1
3
8
762
sha256sum ghost_compact.py
x.com/tjbecker/statu…
0
0
1
101
🫸👻🫷GhostCompact: abusing compactions for 99% discounted OpenAI API model inference.
Two things combine to make this possible:
1. A billing logic bug with inline compactions
2. A new technique to use compactions as inference
Two things combine to make this possible:
1. A billing logic bug with inline compactions
2. A new technique to use compactions as inference
🫸👻🫷🧵
Let's talk GhostCompact:
What if you could cut your output token costs on OpenAI by 97-99%? 🤑
Our researcher @tjbecker found a discrepancy between the actual token costs burned versus what ended up being billed. He had a hunch and used Xint to validate that there was a logic bug in OpenAI's compaction feature released in February 2026 that led to billing based on compacted output and not on the actual tokens consumed.
xint.io/blog/openai-co…
4
5
37
3,029
More details (including the full security harness) available in our blog post (see OP) or on our github repo (link below).
github.com/theori-io/ghos…
github.com/theori-io/ghos…
1
0
2
226
sha256sum ghost_compact.py
x.com/tjbecker/statu…
x.com/tjbecker/statu…
03dbc05a5c0d28cd387bee8ff6119893631ee9cef54aa2f22e757295f4c02633
0
0
0
277