wannabe hacker... he/him 🌱 grow your hacking skills @hextreeio
Internet
Joined March 2015
- Tweets10.6K
- Following1.3K
- Followers166K
- Likes6.8K
LiveOverflow 🔴 hextree.io retweeted
curious, how many 0days discovered by security researchers and later patched end up being exploited in the wild? for instance, how many chrome and firefox bugs demonstrated at pwn2own were later observed being exploited in the wild? i would assume very few.
the whole point of proactive vulnerability research is to find and eliminate latent bugs before threat actors discover and exploit them. so im not sure why anthropic or openai vr impact is being measured by how many of its findings were exploited in the wild. isnt that the point of finding and patching them early?
Project Glasswing:
* 37,966 findings.
* 2 exploited in the wild.
vulncheck.com/blog/anthropic…
LiveOverflow 🔴 hextree.io retweeted
I'm seeing articles about this every day (and including them in tl;dr sec for broader visibility).
This is currently ongoing, not hype 👇
Industry, please hear us. Autonomous attacks are here, at scale, breaching many organizations right this moment. Usually, with ARTEX and Cairn, usually through vulnerabilities.
A thread
Heather Adkins (@argvee) and I asked the industry to believe us…
LiveOverflow 🔴 hextree.io retweeted
🚨👾First post → Awesome research.
We compromised the latest version of OpenAI Codex.
We prompt injected.
We escaped a sandbox.
We exfiltrated secrets…
And ended up with control over what could be published to the official openai/codex npm package.
Prompt injection → RCE → supply chain compromise.
Full research by @0xMadder and @_Worty in the comments 👇
LiveOverflow 🔴 hextree.io retweeted
26 new Firefox vulns from @itszn13 and I are public. I'd like to thank Mozilla again for the speed and transparency.
mozilla.org/en-US/security/a…
LiveOverflow 🔴 hextree.io retweeted
Hacktron has reported high-impact vulns to us through our bug bounty program. Now we’re teaming up with @zeyu1337 and the Hacktron crew to hunt for more. openai.com/index/partnering-…
LiveOverflow 🔴 hextree.io retweeted
sept 17th: @HacktronAI pwns @OpenAI
nov 6th: OpenAI partners with Hacktron
crazy how much can change in a month!
openai.com/index/partnering-…
LiveOverflow 🔴 hextree.io retweeted
Fun coincidence: the blog post was published exactly ten years after phrack.org/issues/70/attacki… (first appeared on Oct 27, 2016 in the Phrack paper feed). Still doing JS engines a decade later it seems 😅
Slides from the talk @mlippautz and I gave at the recent @offensive_con in Tokyo: saelo.github.io/presentation…
Blog post for the Fuzzing vs. AI part: projectzero.google/2026/10/f…
LiveOverflow 🔴 hextree.io retweeted
The restaurant was offering $1.5M for anyone who could eat the 20 patty burger. We spent $32,936 in API credits to see if our AI could win the challenge. First we removed 15 patties from the burger (incompatible with our methodology). If the restaurant accepted this, crazy ROI!
LiveOverflow 🔴 hextree.io retweeted
*sshole is out
if you run sshd on alpine, openwrt or any musl box with password auth on: update now
official writeup: sshhole.com
LiveOverflow 🔴 hextree.io retweeted
Y’all should check this out :)
Our security researchers built an autonomous cyber vulnerability discovery, exploitation, and patching pipeline.
In a single run with an upcoming cyber model, it validated and generated patches for 948 local privilege escalation vulnerabilities in the Linux kernel at a total API cost of $1.2 million.
LiveOverflow 🔴 hextree.io retweeted
Fundamentally, I think security research is about curiosity: a desire to understand how things work and apply that understanding in weird and unintended ways. On top of this, we build up our domain expertise for given targets (such as the Linux kernel 🐧) (2/7)
LiveOverflow 🔴 hextree.io retweeted
Firefox 159.0 just fixed 41 sechigh vulnerabilities found by me and @ky1ebot
Most of these leads to code exec in the renderer!
Along side a heroic effort from the Mozilla security team to secure Firefox with agents!
One of many projects we are working to harden, more to come
LiveOverflow 🔴 hextree.io retweeted
The reaction to recent bugs (like php2shell or mptcp Linux rce) are weird. Announcing loudly and patching quickly is correct!
Waiting until an exploit is in metasploit or whatever is way too late, and big companies throwing weight around to improve security is a win
LiveOverflow 🔴 hextree.io retweeted
that's why we launched the $100k Save CTFs fund. CTFs need to quickly adapt to AI, or else they'll disappear. I heard ECSC did a good job this year.
@_mixy1 wrote a great blog osec.io/blog/save-ctfs-fund/
LiveOverflow 🔴 hextree.io retweeted
VM is so boring it’s a fucking excel does this person get off to spreadsheets?
LiveOverflow 🔴 hextree.io retweeted
To expand on this a bit: Yes, the LLM found more bugs than the fuzzer. But the fuzzer finding bugs the LLM didn't shouldn't come as a surprise to anyone who has ever performed a thorough manual review, only to run a fuzzer afterward and discover issues they missed.
People often ask me how I think about fuzzers and other tooling in the age of AI. Instead of my opinion, here is some hard data by @5aelo.
