Android Vulnerability Researcher, Pwn2Own 202{3,5,6}
planet earth
Joined April 2016
- Tweets219
- Following634
- Followers1.1K
- Likes1.6K
Ben retweeted
As promised, here is the blogpost for code execution on the meta rayban 😎 p0pcycle.com/2026/11/06/hack…
My key takeaway from this is that OpenAI is confident that Pwn2Own will still be a thing in 948 years
The full run cost $1,213,430 in API credits—about $1,279 per distinct local privilege escalation vulnerability.
For context, applying historical Pwn2Own and TyphoonPWN bounty rates gives a hypothetical value of $18.9M–$66.3M.
This demonstrates the relative efficacy of using AI models for securing software—defenders should proactively analyze software to make cyber attacks cost-prohibitive.
Ben retweeted
haha, so apparently OpenAI are about to start training on your Daybreak Blue sessions, with no way to opt out.
Literally stealing people's private work, as they do it, is cartoonishly evil.
It also will presumably kill Daybreak usage by security researchers. Or at least, it should. The thing OAI have had to swear they are not doing to math researchers, they are now explicitly about to start doing to security researchers.
Yet another reminder of the importance of open models.
Man, I'm genuinely starting to wonder whether Kim Jong Il was Satoshi Nakamoto.
Last known Satoshi contact, April 2011, Kim Jong Il dies later that year and North Korea spends the next 15 years using Bitcoin as a replacement for taxes.
Binance's initial investigation suggests that the security incident may involve a compromised DevOps engineer’s laptop, which allowed an attacker to gain access to a service container and submit unauthorized withdrawal transactions. We have found no evidence of any wallet private key leak. We will share a detailed technical post-mortem once the investigation is complete and the facts are fully verified.
The estimated total impact sits at around $6.3B. We have worked with blockchain partners to freeze affected assets, with ~$3 billion frozen on-chain so far.
Binance will cover all losses from the SAFU fund and the company’s funds. User funds are safe. We will also publish an updated Proof of Reserves once the remediation is complete.
As an immediate precaution, Binance has:
- temporarily suspended deposits and withdrawals while security checks are completed;
- revoked the affected address authorisation;
- engaged law enforcement and blockchain intelligence partners to trace and recover funds.
Our teams are working around the clock to resolve this issue safely and thoroughly. We are working closely with our law enforcement partners to confirm the identity of these criminals and bring them to justice.
Please rely only on official Binance channels for updates. Please feel free to contact Binance Customer Support if you have any further questions.
binance.com/en/support/annou…
Ben retweeted
Verified! The 1st full win the the Wellness category has Interrupt Labs (@InterruptLabs) using an OOB Read and an OOB Write to exploit the Garmin Index BPM. They win $20,000 and 2 Master of Pwn points. #Pwn2Own
Ben retweeted
Managed to get @opa334dev to talk about the TSS bug on chITchat 👀 You can listen on most platforms but here is the link to Spotify. Will upload to youtube as well. open.spotify.com/episode/5fI…
Ben retweeted
It was DOOMsday for the Lexmark CX532adwe printer as Interrupt Labs (@InterruptLabs) claimed victory and earned $5k & 2 Master of Pwn points! #Pwn2Own #DoomHack
Ben retweeted
Wow - the setup took a while (and included Starlink!), but Interrupt Labs (@InterruptLabs) successfully exploited the #Samsung Galaxy S26. They're off to the disclosure room to provide the details. #Pwn2Own
Ben retweeted
Anthropic valuation - $2 trillion
Samsung valuation - $1.35 trillion
Anthropic 2025 revenue - $4.6 billion
Samsung 2025 revenue - $236 billion
Ben retweeted
a lot of people dont appreciate the difference in required effort for a 1% reliable mem corruption exploit vs 10% vs 99% . this post projectzero.google/2026/01/p… by @natashenka expresses this well. the truth is that often a 10% reliability exploit is *no progress to full reliability*
$6,500... I guess next time you can just sell the access to the Chinese
We reported the bug to Discourse and OpenAI. OpenAI fixed the SSO issue roughly 14 hours after our initial submission.
Discourse received our separate report Saturday, replied Sunday, and had a fix Monday.
OpenAI awarded us $6,500.
19
1,305
Ben retweeted
We’re back with @yarden_shafir to talk about going from baker to hacker, windows internals, exploit techniques and more! open.spotify.com/episode/5pu…
This one’s for you benoit
Anthropic marketing: *checks notes* don't forget about us! We also let our models commit crimes
Let me get this straight
Anthropic made a LLM so intelligent that cybersec is doomed, but have a flagship product riddled with bugs
Now OpenAI made an LLM so intelligent that cybersec is doomed, but can't design a suitable environment to test it in
🤔
7
543
Can't win them all I guess :(
Unfortunately, Interrupt Labs could not get their exploit of NV Container Toolkit working within the time allotted. #Pwn2Own #P2OBerlin
2
26
2,985
Ben retweeted
Security researchers become trapped into an identity that they can’t escape, life seems purposeless, reality shifts and they realize they can’t bend like a tree in the wind. It turns out that intelligence isn’t the key to happiness.
For those that know. Chop wood, carry water.
Ben retweeted
📣New Android Vulnerability Researcher vacancy. Open to mid-level, senior and principal researchers.
interruptlabs.teamtailor.com…