Aaron Grattafiori (@dyn___) header
Aaron Grattafiori (@dyn___) profile picture

Offensive Security / AI @Umbriel_AI. Ex-AI RT and OffSec at NVIDIA, RT lead @ Meta. Ex-Principal Consultant and Researcher @ NCC Group/iSEC Partners. Neg9//CTF.

Colorado
Joined March 2014
Photo by Aaron Grattafiori (@dyn___)Photo by Aaron Grattafiori (@dyn___)Photo by Aaron Grattafiori (@dyn___)Photo by Aaron Grattafiori (@dyn___)Photo by Aaron Grattafiori (@dyn___)Photo by Aaron Grattafiori (@dyn___)Photo by Aaron Grattafiori (@dyn___)Photo by Aaron Grattafiori (@dyn___)Photo by Aaron Grattafiori (@dyn___)Photo by Aaron Grattafiori (@dyn___)
Current Status feels like this is no longer going to be fiction...
1
3
3,388
Aaron Grattafiori retweeted
My AI agents found an unmapped Maya site in Mexico, using LiDAR data from a NASA dataset. 72 hours from a random thought on vacation to a reply from Mexico's national archaeology institute. What a time to be alive…
267
2,064
610
20,002
1,326,352
A friend and ex coworker @martin_vigo 's DEFCON talk on hacking Amazon lockers is finally on YouTube. It's such a fun, excellent, pure hacker ethos talk... I highly recommend it, and definitely watch to the end... youtu.be/ZVmRe8OVZtE?is=D4Li…
4
3
17
2,302
Aaron Grattafiori retweeted
I guess Chinese models really were the biggest threat…
272
1,172
118
16,977
533,093
Aaron Grattafiori retweeted
❌ “Swarmed”: - massive cyber larping - thinks AI invented security - thinks machine-speed is novel - reads a16z sloports ✅ “Zerged”: - assimilated to the Hive Mind - we require more Vespene gas - high-pitched, frantic skittering, aggressive wet clicking sounds
20
20
2
224
6,708
Aaron Grattafiori retweeted
The Bitter Lesson is that if you get really rich you can pay experts to make proprietary RL datasets that nobody else will be able to afford, keeping the frontier for relevant tasks closed to everyone else no matter how clever they are about training approaches
22
48
10
805
33,558
Aaron Grattafiori retweeted
Nice DeepSWE score! Does it survive a lowercase filename? Introducing MaxxBench: 89 DeepSWE tasks with small changes to the instructions or starting code. Same engineering problem, slightly different requirement. Models clustered around 74% on DeepSWE end up 23 pp apart. Good at coding, or good at DeepSWE? 🧵
235
410
304
5,464
938,554
AGI
Replying to @ValsAI
The swearing tends to happen when tasks drag on. None of the runs under 100 steps contained "fuck," while 48 of the 50 runs that used it lasted at least 200 steps. ProgramBench had the most swearing, with profanity appearing in 20 of 200 runs.
2
8
1,132
Aaron Grattafiori retweeted
Security engineering helps flatten and elongate this tail via attack surface reduction, mitigations, and targeted formal methods. I’m not sure how we escape the treadmill without a real scientific breakthrough. And that’s *just* software security.
1
2
6
735
Aaron Grattafiori retweeted
Two thoughts on this: 1. Very cool. As someone who's primary interest is the offensive side of cyber, I love it. *chefs kiss* and congrats to the team. 2. You cannot bug hunt your way to 'secure'. AI doesn't change that. If your strategy for the next few years is to boil the oceans continuously scanning your same codebase, with the same broken architecture, with the same broken threat models, you are going to have a bad time. a) you're going to spend a fortune and b) you're going to keep getting hacked.
Introducing GPT‑6 Cyber: a major advance in security research that pairs stronger capabilities with better model alignment. The model powered the Linux kernel research we announced yesterday, and security teams at companies like Mozilla, Palo Alto Networks, Calif, and Cisco—alongside our own at OpenAI—are already putting it to work. GPT-6 Cyber is available to select Daybreak Red customers and we are expanding access over time. openai.com/index/introducing…
13
27
1
151
14,323
Aaron Grattafiori retweeted
We found an 0day in CPython that turns your LLM's chat template into a code execution primitive. A backdoored model on Hugging Face can own your inference server 🧵
19
48
15
446
28,442
Aaron Grattafiori retweeted
*sshole is out if you run sshd on alpine, openwrt or any musl box with password auth on: update now official writeup: sshhole.com
86552c7e1e5d46882844cffabb44d454129ff22927f13797b151c9db4519d47d
188
890
445
5,444
1,565,216
Aaron Grattafiori retweeted
Good news! We've wrapped our initial "Lights Out" research into out-of-band management devices and BMCs. The final advisories are live and OOBscan now includes detections for all issues. The bad news: many of these issues still have no patch: github.com/runZeroInc/oobsca…
7
49
3
106
11,170
Aaron Grattafiori retweeted
vulnerability research is just a huge topology problem imo. across audits, identify regions with equivalent attacker-visible behavior. reuse the local proofs, analyze the new code, and recheck the gluing. a new attachment can make a bad state reachable. i love topology 🍩. math is always watching me
8
5
89
4,274
The attack timeline of multiple engineers reads quite poorly for a company dealing with this amount of money. There should have been way more isolation and controls in place.
2
2
7
697
Aaron Grattafiori retweeted
This is a cool paper, but I think it's best thought of as Astra is surprisingly capable of doing old school mechanistic interpretability research rather than anything spooky. The things it's doing are clever, but typically exploiting structure in the data and using known method mechanistic interpretability techniques (which Astra was surely pretrained on), though it is better at this than I would have predicted! This is an exciting development for the prospects of ambitiously scaling interpretability or doing very laborious analysis like this, on more real models. However, I'm not holding my breath. This kind of analysis was pretty common up until about 2022, it largely fell out of favor because a lot of it is just exploiting fairly clean surface-level patterns that doesn't scale to the annoying complexity of real LLMs or which only works for the more simpler and superficial properties. And as far as I can tell, basically all the case studies here are just using a bag of interpretability tricks rather than anything spooky. The piece doesn't really update me on how far old school mech interp can go, just on how good LLMs are at it. It's very fun to see the creative solutions Astra came up with though!
We asked GPT-6 Astra to edit Qwen3.5-0.8B weights to improve math. It directly changed only 0.016% of weights, fixing 0.8B's reasoning loops & improving math up to 6x and even instruction following 3x, without gradients or training. We call this Weight-Space Programming: frontier LLMs can now natively read/write neural network weights! 🧵 Blog: rikiyat.github.io/blog/weigh…
Readers added context they thought people might want to know
LLM was given weights explicitly as text in prompt and used code/forward passes (per authors' logs) to ablate Qwen looping direction, a known thinking-mode issue per model card. Primarily fixed repetition in that mode, not general 'natively' improving weights/math. rikiyat.github.io/blog/weight-sp… github.com/RikiyaT/lm_und… huggingface.co/Qwen/Qwen3.5-0… huggingface.co/RikiyaT/Qwen3.…
53
164
36
1,861
105,496
Aaron Grattafiori retweeted
It looks like Astra didn't natively read Qwen's weights? As I understand it, Qwen would get stuck in a loop and not answer the question. Astra used code to perform some standard interp techniques, found a looping direction, and ablated it from the weights.
We asked GPT-6 Astra to edit Qwen3.5-0.8B weights to improve math. It directly changed only 0.016% of weights, fixing 0.8B's reasoning loops & improving math up to 6x and even instruction following 3x, without gradients or training. We call this Weight-Space Programming: frontier LLMs can now natively read/write neural network weights! 🧵 Blog: rikiyat.github.io/blog/weigh…
Readers added context they thought people might want to know
LLM was given weights explicitly as text in prompt and used code/forward passes (per authors' logs) to ablate Qwen looping direction, a known thinking-mode issue per model card. Primarily fixed repetition in that mode, not general 'natively' improving weights/math. rikiyat.github.io/blog/weight-sp… github.com/RikiyaT/lm_und… huggingface.co/Qwen/Qwen3.5-0… huggingface.co/RikiyaT/Qwen3.…
74
108
41
1,738
118,493
Has anyone confirmed if this did more than fixing the looping/repetition problems in the model so it does better on a benchmark? Still cool but I'm waiting to hear if it was actually editing something more useful...
We asked GPT-6 Astra to edit Qwen3.5-0.8B weights to improve math. It directly changed only 0.016% of weights, fixing 0.8B's reasoning loops & improving math up to 6x and even instruction following 3x, without gradients or training. We call this Weight-Space Programming: frontier LLMs can now natively read/write neural network weights! 🧵 Blog: rikiyat.github.io/blog/weigh…
Readers added context they thought people might want to know
LLM was given weights explicitly as text in prompt and used code/forward passes (per authors' logs) to ablate Qwen looping direction, a known thinking-mode issue per model card. Primarily fixed repetition in that mode, not general 'natively' improving weights/math. rikiyat.github.io/blog/weight-sp… github.com/RikiyaT/lm_und… huggingface.co/Qwen/Qwen3.5-0… huggingface.co/RikiyaT/Qwen3.…
3
452