
Offensive Security / AI @Umbriel_AI. Ex-AI RT and OffSec at NVIDIA, RT lead @ Meta. Ex-Principal Consultant and Researcher @ NCC Group/iSEC Partners. Neg9//CTF.
Colorado
Joined March 2014
- Tweets21.1K
- Following2.7K
- Followers6.3K
- Likes84.6K
Aaron Grattafiori retweeted
🤖 Made with AI
Turns out we could have just written 6 million lines of Lean to verify Signal instead of messing with these papers and symbolic models this whole time deepmind.google/blog/introdu…
Aaron Grattafiori retweeted
My AI agents found an unmapped Maya site in Mexico, using LiDAR data from a NASA dataset.
72 hours from a random thought on vacation to a reply from Mexico's national archaeology institute.
What a time to be alive…
Aaron Grattafiori retweeted
I need some people for this asap: jobs.ashbyhq.com/openai/be7b…
Aaron Grattafiori retweeted
❌ “Swarmed”:
- massive cyber larping
- thinks AI invented security
- thinks machine-speed is novel
- reads a16z sloports
✅ “Zerged”:
- assimilated to the Hive Mind
- we require more Vespene gas
- high-pitched, frantic skittering, aggressive wet clicking sounds
Aaron Grattafiori retweeted
The Bitter Lesson is that if you get really rich you can pay experts to make proprietary RL datasets that nobody else will be able to afford, keeping the frontier for relevant tasks closed to everyone else no matter how clever they are about training approaches
Nice DeepSWE score! Does it survive a lowercase filename?
Introducing MaxxBench: 89 DeepSWE tasks with small changes to the instructions or starting code. Same engineering problem, slightly different requirement.
Models clustered around 74% on DeepSWE end up 23 pp apart.
Good at coding, or good at DeepSWE? 🧵
Aaron Grattafiori retweeted
Security engineering helps flatten and elongate this tail via attack surface reduction, mitigations, and targeted formal methods. I’m not sure how we escape the treadmill without a real scientific breakthrough. And that’s *just* software security.
Aaron Grattafiori retweeted
Two thoughts on this:
1. Very cool. As someone who's primary interest is the offensive side of cyber, I love it. *chefs kiss* and congrats to the team.
2. You cannot bug hunt your way to 'secure'. AI doesn't change that. If your strategy for the next few years is to boil the oceans continuously scanning your same codebase, with the same broken architecture, with the same broken threat models, you are going to have a bad time. a) you're going to spend a fortune and b) you're going to keep getting hacked.
Introducing GPT‑6 Cyber: a major advance in security research that pairs stronger capabilities with better model alignment.
The model powered the Linux kernel research we announced yesterday, and security teams at companies like Mozilla, Palo Alto Networks, Calif, and Cisco—alongside our own at OpenAI—are already putting it to work.
GPT-6 Cyber is available to select Daybreak Red customers and we are expanding access over time.
openai.com/index/introducing…
Aaron Grattafiori retweeted
We found an 0day in CPython that turns your LLM's chat template into a code execution primitive. A backdoored model on Hugging Face can own your inference server 🧵
Good news! We've wrapped our initial "Lights Out" research into out-of-band management devices and BMCs. The final advisories are live and OOBscan now includes detections for all issues. The bad news: many of these issues still have no patch:
github.com/runZeroInc/oobsca…
vulnerability research is just a huge topology problem imo. across audits, identify regions with equivalent attacker-visible behavior. reuse the local proofs, analyze the new code, and recheck the gluing. a new attachment can make a bad state reachable.
i love topology 🍩. math is always watching me
Aaron Grattafiori retweeted
This is a cool paper, but I think it's best thought of as Astra is surprisingly capable of doing old school mechanistic interpretability research rather than anything spooky. The things it's doing are clever, but typically exploiting structure in the data and using known method mechanistic interpretability techniques (which Astra was surely pretrained on), though it is better at this than I would have predicted!
This is an exciting development for the prospects of ambitiously scaling interpretability or doing very laborious analysis like this, on more real models. However, I'm not holding my breath. This kind of analysis was pretty common up until about 2022, it largely fell out of favor because a lot of it is just exploiting fairly clean surface-level patterns that doesn't scale to the annoying complexity of real LLMs or which only works for the more simpler and superficial properties. And as far as I can tell, basically all the case studies here are just using a bag of interpretability tricks rather than anything spooky. The piece doesn't really update me on how far old school mech interp can go, just on how good LLMs are at it. It's very fun to see the creative solutions Astra came up with though!
We asked GPT-6 Astra to edit Qwen3.5-0.8B weights to improve math.
It directly changed only 0.016% of weights, fixing 0.8B's reasoning loops & improving math up to 6x and even instruction following 3x, without gradients or training.
We call this Weight-Space Programming: frontier LLMs can now natively read/write neural network weights! 🧵
Blog: rikiyat.github.io/blog/weigh…
Readers added context they thought people might want to know
LLM was given weights explicitly as text in prompt and used code/forward passes (per authors' logs) to ablate Qwen looping direction, a known thinking-mode issue per model card. Primarily fixed repetition in that mode, not general 'natively' improving weights/math.
rikiyat.github.io/blog/weight-sp…
github.com/RikiyaT/lm_und…
huggingface.co/Qwen/Qwen3.5-0…
huggingface.co/RikiyaT/Qwen3.…
Aaron Grattafiori retweeted
It looks like Astra didn't natively read Qwen's weights?
As I understand it, Qwen would get stuck in a loop and not answer the question.
Astra used code to perform some standard interp techniques, found a looping direction, and ablated it from the weights.
We asked GPT-6 Astra to edit Qwen3.5-0.8B weights to improve math.
It directly changed only 0.016% of weights, fixing 0.8B's reasoning loops & improving math up to 6x and even instruction following 3x, without gradients or training.
We call this Weight-Space Programming: frontier LLMs can now natively read/write neural network weights! 🧵
Blog: rikiyat.github.io/blog/weigh…
Readers added context they thought people might want to know
LLM was given weights explicitly as text in prompt and used code/forward passes (per authors' logs) to ablate Qwen looping direction, a known thinking-mode issue per model card. Primarily fixed repetition in that mode, not general 'natively' improving weights/math.
rikiyat.github.io/blog/weight-sp…
github.com/RikiyaT/lm_und…
huggingface.co/Qwen/Qwen3.5-0…
huggingface.co/RikiyaT/Qwen3.…
Aaron Grattafiori retweeted
I used Divyansh's approach to build an entire Nintendo into ~1GB of Qwen3.5 weights.
Qwenputer, meet Nesformer: github.com/dbreunig/nesforme…
Aaron Grattafiori retweeted
haha, so apparently OpenAI are about to start training on your Daybreak Blue sessions, with no way to opt out.
Literally stealing people's private work, as they do it, is cartoonishly evil.
It also will presumably kill Daybreak usage by security researchers. Or at least, it should. The thing OAI have had to swear they are not doing to math researchers, they are now explicitly about to start doing to security researchers.
Yet another reminder of the importance of open models.
Aaron Grattafiori retweeted
here are the slides for "every dog has its' 0day "from @unpromptedconf.
pic is me when i sustained a back injury installing something at work behind a tv.
link in reply
Aaron Grattafiori retweeted
Been hitting guardrails more often during the past two days. Even with /daybreak "on", Sol refusing various types of work: "This content can’t be shown. Some cybersecurity requests are still limited, even when Daybreak is on." Example:





























