I've always been really negative on formal verification's practical utility.
That is definitely changing with LLMs! even with how smart they are, I'm still impressed this is possible!
That is definitely changing with LLMs! even with how smart they are, I'm still impressed this is possible!
New on our Frontier Red Team blog: using Claude to formally verify software at large scale.
Formal verification can prove that code is free of certain bugs, but historically it has only been feasible for small codebases (or required a lot of expert time).
With AI models, however, this is beginning to change. In collaboration with @theoremlabs, we used Claude to prove security properties in over one hundred real-world open-source libraries over the span of a few weeks.
Read our research in full here: anthropic.com/research/forma…
0
0
34
2,178
tylerni7 retweeted
New on our Frontier Red Team blog: using Claude to formally verify software at large scale.
Formal verification can prove that code is free of certain bugs, but historically it has only been feasible for small codebases (or required a lot of expert time).
With AI models, however, this is beginning to change. In collaboration with @theoremlabs, we used Claude to prove security properties in over one hundred real-world open-source libraries over the span of a few weeks.
Read our research in full here: anthropic.com/research/forma…
Formal verification can prove that code is free of certain bugs, but historically it has only been feasible for small codebases (or required a lot of expert time).
With AI models, however, this is beginning to change. In collaboration with @theoremlabs, we used Claude to prove security properties in over one hundred real-world open-source libraries over the span of a few weeks.
Read our research in full here: anthropic.com/research/forma…
625
1,045
9,588
1,947,424
I hope pwnies get a "best disclosure site" category this year
Do you know who illustrated the comic on calif.io/php2shell?
Her name is Stephanie Cortes. And her husband is the hacker who discovered php2shell: @lcfr_hax.
This artist-hacker couple has the best story, stay tuned!
1
0
25
1,402
tylerni7 retweeted
Do you know who illustrated the comic on calif.io/php2shell?
Her name is Stephanie Cortes. And her husband is the hacker who discovered php2shell: @lcfr_hax.
This artist-hacker couple has the best story, stay tuned!
Her name is Stephanie Cortes. And her husband is the hacker who discovered php2shell: @lcfr_hax.
This artist-hacker couple has the best story, stay tuned!
30
141
1,169
134,798
tylerni7 retweeted
We have an epic bug to show off soon, but after seeing the marketing and branding of the PHP bugs (it's well done and I enjoyed much), I'm not convinced we can beat that level of branding despite our bug being "holy grail of web server pwn" 😭
16
17
237
25,822
You don't need to fix bugs or port to rust to improve security! Having models help with secure design and minimizing threat surface is a great use case
Reducing the attack surface of deployed services and apps is a fundamental component of software that is secure by design. Earlier this year we tasked Claude with autonomously mapping and reducing the attack surface of 25 large and widely used OSS codebases. This blog post covers some of our methodology and a preview of the data we collected.
This research resulted in a significant reduction in OpenSSH pre-authentication attack surface (now fixed in 10.6). And over 500 findings where reachability could be reduced and configurations hardened to ensure security controls weren’t silently disabled.
anthropic.com/research/attac…
1
2
16
1,377
tylerni7 retweeted
Reducing the attack surface of deployed services and apps is a fundamental component of software that is secure by design. Earlier this year we tasked Claude with autonomously mapping and reducing the attack surface of 25 large and widely used OSS codebases. This blog post covers some of our methodology and a preview of the data we collected.
This research resulted in a significant reduction in OpenSSH pre-authentication attack surface (now fixed in 10.6). And over 500 findings where reachability could be reduced and configurations hardened to ensure security controls weren’t silently disabled.
anthropic.com/research/attac…
This research resulted in a significant reduction in OpenSSH pre-authentication attack surface (now fixed in 10.6). And over 500 findings where reachability could be reduced and configurations hardened to ensure security controls weren’t silently disabled.
anthropic.com/research/attac…
8
72
551
85,399
tylerni7 retweeted
11 days ago, our team @AnthropicAI launched OSS Scanner to give open source projects free, periodic vulnerability scans from our strongest models, inspired by OSS-Fuzz. Some numbers so far:
• ~650 projects applied
• 114 accepted
• 77 critical and 803 high model-rated findings reported (we haven’t scanned all projects yet)
How our reports ended up flagged as malware, and other learnings/updates below 🧵
• ~650 projects applied
• 114 accepted
• 77 critical and 803 high model-rated findings reported (we haven’t scanned all projects yet)
How our reports ended up flagged as malware, and other learnings/updates below 🧵
13
20
173
32,354
tylerni7 retweeted
To secure open-source software, we’re launching OSS Scanner.
We’ll use our frontier models to periodically scan opted-in open-source projects for vulnerabilities, at no cost. Our reports will provide a proof-of-concept, explanation, and suggested fix.
anthropic.com/research/launc…
We’ll use our frontier models to periodically scan opted-in open-source projects for vulnerabilities, at no cost. Our reports will provide a proof-of-concept, explanation, and suggested fix.
anthropic.com/research/launc…
107
247
2,530
576,985
tylerni7 retweeted
We’re launching the Anthropic Cyber Mission, a new effort to secure critical infrastructure and open-source software.
anthropic.com/news/anthropic…
anthropic.com/news/anthropic…
280
292
2,699
358,250
tylerni7 retweeted
Very happy it worked on stage, I was so nervous. Unlucky that Google knew the bug but that's the game. Big shout out to @tjbecker and @xint_official. Amazing job everyone of team #Xint at #Pwn2Own
Results are in and Tim Becker (@tjbecker) and Yves Bieri (@yves_bieri) of Xint (@xint_official) have secured their lead in the race to the Master of Pwn with their successful remote exploit of Google Pixel 10 through a single bug collision, earning them $150,000 and 15 - Master of Pwn points #Pwn2Own
5
5
69
2,940
tylerni7 retweeted
Halfway through Pwn2Own, team Xint (@xint_official) is in the lead! Super impressed with my teammates @yves_bieri @taisic_ @pwndor1 for the success so far.
2
6
61
3,214
I have to imagine this course will be full, but anyone who sees this still at CMU should definitely try to take this.
I'm sure it'll be one of those famous courses you look back on fondly (even if it's hard!) later in your career
I'm sure it'll be one of those famous courses you look back on fondly (even if it's hard!) later in your career
Compilers for Machine Learning
Carnegie Mellon University
Spring 2027 Semester
In person, Pittsburgh
10-411/711, MWF 10-10:50
139-seat classroom reserved
Lectures not posted online
Don't miss registration!
1
0
132
17,273
tylerni7 retweeted
Compilers for Machine Learning
Carnegie Mellon University
Spring 2027 Semester
In person, Pittsburgh
10-411/711, MWF 10-10:50
139-seat classroom reserved
Lectures not posted online
Don't miss registration!
Carnegie Mellon University
Spring 2027 Semester
In person, Pittsburgh
10-411/711, MWF 10-10:50
139-seat classroom reserved
Lectures not posted online
Don't miss registration!
129
60
2,356
307,369
tylerni7 retweeted
We were drowning in 0days this time around. It's a shame we could only submit 5 entries 😉
Should be an exciting Pwn2Own!
Should be an exciting Pwn2Own!
#Pwn2Own Ireland schedule is finalized.
Team Xint attempts (Ireland time):
LiteLLM - Tuesday 9:30
Philipps Hue - Tuesday 18:30
Home Assistant - Wednesday 9:30
Oracle AI Database - Wednesday 11:45
Pixel 10 - Thursday 11:15
zerodayinitiative.com/blog/2026/10/5…
1
3
66
6,112
tylerni7 retweeted
Today I'm joining Anthropic to lead the cybersecurity mission of the Frontier Red Team.
In my career I've never seen a clearer opportunity to build a more secure world for everyone. For 40 years we've lived with fundamentally insecure technology. What will it take to make the past 40 years of hacking a historical oddity? That's what I'm here to find out.
Super excited to work with @logangraham and the rest of the FRT crew.
In my career I've never seen a clearer opportunity to build a more secure world for everyone. For 40 years we've lived with fundamentally insecure technology. What will it take to make the past 40 years of hacking a historical oddity? That's what I'm here to find out.
Super excited to work with @logangraham and the rest of the FRT crew.
112
55
1,416
160,760
tylerni7 retweeted
We had Jev before it was cool.
We wanted fast and cheap classifiers for several tasks, so we wrote generic classifier code. It sampled a single token from gpt-4.1 and used logprobs to assign probabilities to each option.
github.com/theori-io/aixc…
We wanted fast and cheap classifiers for several tasks, so we wrote generic classifier code. It sampled a single token from gpt-4.1 and used logprobs to assign probabilities to each option.
github.com/theori-io/aixc…
3
10
49
3,895
tylerni7 retweeted
Thousands of people were catfished by scammers supercharged with AI. theverge.com/ai-artificial-…
5
3
25
28,992