Offensive cyber is our thing.
McLean, VA
Joined January 2025
- Tweets2K
- Following313
- Followers5.5K
- Likes5.9K
Pinned Tweet
Our business model is this:
- Attract the very best vulnerability researchers and exploit developers in the world to join our company. This mostly revolves around junior engineers with raw talent/extremely high IQ. We don’t care if they have a college degree/industry experience or if they are total recluse-types who never want to attend some stupid “team building event” or whatever.
This is largely an individual sport. And we want the Roger Federer(s) and Novak Djokavic(s) to work for us. We will hone their skills beyond what would be otherwise possible and polish them into absolutely deadly weapons.
- Pay them so well (including serious equity), and task them with working on things so cool, that they would never even want to take an interview for a job at another firm (think Renaissance Technologies in the hedge fund world, but for computer network exploitation). We want to make these people very rich—which almost never happens to people with these skills in this industry. The only tradeoff is that they will have zero fame or public recognition, and they have to be okay with that (fame is overrated anyway)
- Build the resulting primitives into the most sophisticated and powerful offensive cyber capabilities and platforms imaginable, in order to monitor, degrade and defeat the enemies of Western Civilization
—
If this sounds like what you’re after, reach out. Careers@IRISC2[.]com
IRIS C2 retweeted
Catch 22: If Anthropic cures Autism, what happens to Anthropic?
Anthropic CEO:
“If today we look at things like cancer, Alzheimer’s, heart disease, mental illness. These will be relics of the past in. I think, less than a decade.
I believe that the company which gets the risks right will also be the company that has the license to operate that society trusts and society believes can build the benefits in the right way.
I think if we do this right, we can create an age of miracles where humanity is able to solve problems that have eluded us for millennia.
We have to make sure that all the risks, all the ways that things can go wrong with this technology, we very carefully address those risks as we bring the benefits, and as we have a viable business at the same time”.
If you look up “Gamma PowerPoint” on X, you’ll see hundreds of posts from Turkish bot accounts claiming that it’s the most amazing application of all time
In reality, once you pay $216, it spits out the most horrendous looking presentations that look like they were made by GPT-3
Your standard Claude/GPT subscription does 1000x better
They’re worth $2.1B btw
We live in strange times
1
5
629
If you are the kind of person with the fortitude and creativity to grind on these kinds of bugs for dozens of hours in order to take them from DOS to deterministic RCE, you will fit right in at our company.
careers@IRISC2[.]com
CVE-2026-112611 drops a public PoC: OOB write in CoreGraphics (PDF ShadingType 5).
Array mismatch between /n and /c0 triggers a clean heap overflow inside Apple's native rendering engine.
The timing couldn't be worse for Cupertino:
1. Weaponized entry: an unauthenticated CoreGraphics memory corruption bug, ideal for 0-click chains (iMessage/Safari/Mail).
2. Containment breach: chain it with the newly disclosed "worse_query" sandbox escape to break out and read/modify system and third-party app data.
Twenty years later, parsing complex media and legacy PDF formats in C/C++ remains a gift to exploit brokers.
The walled garden isn't just leaking; the bricks are turning to dust.
github.com/Rust505/CVE-2026-…
Not able to attempt any math with Fable 5.2 without running into this guardrail which alleges reasoning extraction
2
19
1,154
Opus 4.6 seems to have been heavily quantized at some point, but the early versions were insanely powerful.
I remember specifically seeing it just about one-shot an SPTM bypass. I looked at it and thought "there is no way that this is going to work"... And then it did
Opus 4.6 is completely wild. There are scenarios where it just is better than Codex Sol 6.0 just because of both how it does tool use + no rejections.
Sometimes it can solve what Codex can't in 5 minutes because of that. Sometimes it just finds another real bug just passively
4
84
6,565
At OffensiveCon Tokyo, Nils Ole Timm (@Firzen14) gave an excellent talk about how he and other professionals assess whether bugs are suitable for production-grade exploits. Rather than the sort of POC-grade exploits that you see in public research, conference talks, etc.
It was a look behind the curtain that is quite rarely available to young up and coming hackers
Perhaps they will publicize at some point
2
24
2,325
If Meta were to open source Muse Wonder, they would absolutely put themselves back on the map of mainstream AI power-users
The ecosystem would improve on their model, and give them ideas for how to do so themselves
Even though my first impressions were not so great, the model is currently working spectacularly for certain use-cases
2
7
851
In my own head, I have a sort of visual-spacial representation how how the various system internals of iOS work
Many other vulnerability researchers have said that their minds work similarly to reason about systems
So what I did was try to create 3D representations to map functions across all the different software/firmware/hardware layers of abstraction that these subsystems work (in this case, iOS 27's SPTM). One of the 3D representations even presents an immersive 'video game' of sorts, which lets the agents "walk through" the system
I have found this to be a helpful resource for agents, keeping them more tightly grounded to the functionality of these complex systems, though I don't have formal benchmarks (which are overrated anyway)
Another version of distillation by China
Breaking news from @ianmking: Nvidia CEO Jensen Huang admits to extramarital affair and the company board is now investigating him being targeted by a Chinese espionage plot. He remains CEO for now. bloomberg.com/news/articles/…
1
9
871
Many people don’t realize that these scam compounds account for at least 40-50% of the GDPs of Cambodia, Laos and Myanmar
US Sanctions 23 Cambodian Companies Linked to Prince Group, Details Tokyo Mansion Transfer
Prince International Airlines, CB General Insurance and Asian Welfare Lotteries are among 23 Cambodian companies sanctioned by the US Treasury in its latest action against Prince Group. Treasury also says executive Chen Bo transferred ownership of his Tokyo mansion to his wife, Cambodian national He Yujing, after the first US sanctions in October 2025.
He Yujing is now sanctioned, along with Cambodian Prince Group associate Visal Pang. Treasury says Pang controls 11 Cambodian companies, including Marco Polo Hotel, Cambo Duty Free Merchandise and U-Life Kh Super App, several of which he co-directs with Chen Bo. Chen Bo, who was sanctioned in June, remains in control of another 11 Cambodian companies. He Yujing owns the remaining Cambodian company, Super Light Speed Kh Technology.
The November 5 action sanctions four individuals and 41 companies linked to Prince Group under Executive Order 13581, as amended. Treasury says the network helped senior executives conceal assets, evade earlier sanctions and maintain access to international financial services.
Among those newly sanctioned is Qiu Yong, a Prince Group associate who holds passports from Cambodia, St. Lucia and Türkiye. Treasury says he controls companies in Hong Kong and the British Virgin Islands involved in money lending, wine distribution and other businesses.
7
815
Unreal
We built a vulnerability research pipeline, using an upcoming cyber model, to analyze the security of the Linux kernel. Besides finding and exploiting the found vulnerabilities, the agents discovered at least 10 new exploitation techniques that were new to us and some external kernel exploit experts we checked with.
More on the design and what we learned: openai.com/index/a-thousand-…
We still have a couple guys that find more bugs without using AI than they can find when they do use AI
And the bugs they find by hand also seem to be, in most cases, quite illusive when one tries to replicate the search with AI; even when one really leads the agent to water
4
22
1,854
