Professional Shitposter
malwaretech@infosec.exchange
Joined June 2013
- Tweets515
- Following33
- Followers278K
- Likes10.9K
Since my posts have been shared here ~30 times in the past few weeks, it seems like I'm going to be contributing to Space Karen's Ketamine Extravaganza whether I like it or not.
I don't really intend to be active here, but I'll post some of the more important cybersecurity-focused stuff, since it gets screenshotted anyway. That way, people don't have to read post a week late and out of context.
Remember those posts years back claiming “We face 100,000 hacking attempts a day”? Then you’d look closer and it was mostly port scans and routine internet noise being counted as individual attacks.
Bet they miss that...
They're still doing that, but now they just claim that the port scans are somehow the result of AI.
wsj.com/articles/the-ai-effe…
4
536
Maybe the US version is different, but in the UK, secret clearance is so useless it was less paperwork than the background check for my corporate job.
Top Secret they made me list out the full legal name of every single person I've ever fucked and then went and interviewed them.
Honeypotting someone and finding out they only have secret clearance gotta be embarrassing af. Just going back to their handler like "I figured out what vehicles they use, it's something called a Humvee".
At what point does an IPO just become a cap raise that bypasses Rule 506? Nothing about what Anthropic is doing is an IPO. They just can't raise any more money from private institutions so they're going public to try and raise from retail investors.
u should read the S1, they changed to be able to sell 10% first day, then more every 15 days from then on
How far out where you thought it was going to pop? Feels like it’s just gonna stay here forever now
1
1
173
I own around $20,000 in NVIDIA Put options, so either I'm going to wake up tomorrow and have the best day ever, or the market is going to do something extremely irrational and I'm getting another lube-free fisting.
curious, how many 0days discovered by security researchers and later patched end up being exploited in the wild? for instance, how many chrome and firefox bugs demonstrated at pwn2own were later observed being exploited in the wild? i would assume very few.
the whole point of proactive vulnerability research is to find and eliminate latent bugs before threat actors discover and exploit them. so im not sure why anthropic or openai vr impact is being measured by how many of its findings were exploited in the wild. isnt that the point of finding and patching them early?
Project Glasswing:
* 37,966 findings.
* 2 exploited in the wild.
vulncheck.com/blog/anthropic…
yeah, agree on ndays being accessible to bigger set of actors. seems thousands of glasswing findings are just noise, but there are also plenty of high quality bugs. for instance with automatic updates in browsers, many of these i assume get largely patched before they can be exploited.
in general, despite all the noise, it seems like the glasswing and openai efforts are net positive in terms of reducing the potential list of latent vulnerabilities that threat actors could discover and exploit in the future.
100+ chrome cves by a single researcher would've been unimaginable in the pre-llm era. what a year for ai-driven vulnerability research (and we still have two months left in 2026)!
1
6
669
Me explaining to AI dudes that cybersecurity ≠ vulnerability management and that the majority of cyberattacks involve exactly zero vulnerabilities
Project Glasswing:
* 37,966 findings.
* 2 exploited in the wild.
vulncheck.com/blog/anthropic…
But it’s a hell of a lot easier to spearfish when you have an LLM doing research and making your email look official.
1
2
678
Currently trading at about $160 in after hours markets. Did you put at $210 or was that just the price at the time?
I'm guessing you're in the money at this point and If you've still got four months on the options that should provide a decent wedge more.
1
35
In Aus they ask you what type of pr0n you watch and what the weirdest you have watched. They ask about potential children and a bunch of psychological questions that have no "real" answer. That's at least what I had in like 2009, its probably changed a bit since then.
2
11
2,138
Most people in OffSec know clients who are still shook up from an incident 10 years ago when pentesters knocked over some servers or prod, and they’re still scoping and putting restrictions around testing because of it. Don’t be the people who start this cycle over because your agent framework is untested and does stupid things.
It is not a loophole; it is the entire point of an IPO: the company no longer has to restrict stock sales to accredited investors.
1
3
265
This is probably a lost cause, but I wish we would stop referring to pen-testing firms and red-teaming as offensive firms and offensive teams. It muddies the water with the *real* offensive actors -- those that make the hacking tools and spyware and engage in cyber ops.
Every time someone tells me they work in "offense" I have to ask -- do you mean defense-offense (offense done only for defensive purposes) or do you mean actual offensive operations?
my take is they're rushing the IPO so employees and shareholders can cash out befor the industry sinks
1
71
5,945