Aaron Grattafiori (@dyn___) header
Aaron Grattafiori (@dyn___) profile picture

Offensive Security / AI @Umbriel_AI. Ex-AI RT and OffSec at NVIDIA, RT lead @ Meta. Ex-Principal Consultant and Researcher @ NCC Group/iSEC Partners. Neg9//CTF.

Colorado
Joined March 2014
Photo by Aaron Grattafiori (@dyn___)Photo by Aaron Grattafiori (@dyn___)Photo by Aaron Grattafiori (@dyn___)Photo by Aaron Grattafiori (@dyn___)Photo by Aaron Grattafiori (@dyn___)Photo by Aaron Grattafiori (@dyn___)Photo by Aaron Grattafiori (@dyn___)Photo by Aaron Grattafiori (@dyn___)Photo by Aaron Grattafiori (@dyn___)Photo by Aaron Grattafiori (@dyn___)
Aaron Grattafiori retweeted
My AI agents found an unmapped Maya site in Mexico, using LiDAR data from a NASA dataset. 72 hours from a random thought on vacation to a reply from Mexico's national archaeology institute. What a time to be alive…
267
2,062
608
20,001
1,330,306
Aaron Grattafiori retweeted
I guess Chinese models really were the biggest threat…
272
1,171
118
16,977
533,207
Aaron Grattafiori retweeted
❌ “Swarmed”: - massive cyber larping - thinks AI invented security - thinks machine-speed is novel - reads a16z sloports ✅ “Zerged”: - assimilated to the Hive Mind - we require more Vespene gas - high-pitched, frantic skittering, aggressive wet clicking sounds
20
20
2
224
6,709
Aaron Grattafiori retweeted
The Bitter Lesson is that if you get really rich you can pay experts to make proprietary RL datasets that nobody else will be able to afford, keeping the frontier for relevant tasks closed to everyone else no matter how clever they are about training approaches
22
48
10
805
33,563
Aaron Grattafiori retweeted
Nice DeepSWE score! Does it survive a lowercase filename? Introducing MaxxBench: 89 DeepSWE tasks with small changes to the instructions or starting code. Same engineering problem, slightly different requirement. Models clustered around 74% on DeepSWE end up 23 pp apart. Good at coding, or good at DeepSWE? 🧵
235
410
306
5,465
938,931
Aaron Grattafiori retweeted
Security engineering helps flatten and elongate this tail via attack surface reduction, mitigations, and targeted formal methods. I’m not sure how we escape the treadmill without a real scientific breakthrough. And that’s *just* software security.
1
2
6
735
Aaron Grattafiori retweeted
Two thoughts on this: 1. Very cool. As someone who's primary interest is the offensive side of cyber, I love it. *chefs kiss* and congrats to the team. 2. You cannot bug hunt your way to 'secure'. AI doesn't change that. If your strategy for the next few years is to boil the oceans continuously scanning your same codebase, with the same broken architecture, with the same broken threat models, you are going to have a bad time. a) you're going to spend a fortune and b) you're going to keep getting hacked.
Introducing GPT‑6 Cyber: a major advance in security research that pairs stronger capabilities with better model alignment. The model powered the Linux kernel research we announced yesterday, and security teams at companies like Mozilla, Palo Alto Networks, Calif, and Cisco—alongside our own at OpenAI—are already putting it to work. GPT-6 Cyber is available to select Daybreak Red customers and we are expanding access over time. openai.com/index/introducing…
13
27
1
151
14,325
Aaron Grattafiori retweeted
We found an 0day in CPython that turns your LLM's chat template into a code execution primitive. A backdoored model on Hugging Face can own your inference server 🧵
19
48
15
446
28,442
Aaron Grattafiori retweeted
*sshole is out if you run sshd on alpine, openwrt or any musl box with password auth on: update now official writeup: sshhole.com
86552c7e1e5d46882844cffabb44d454129ff22927f13797b151c9db4519d47d
188
889
445
5,445
1,565,343
Aaron Grattafiori retweeted
Good news! We've wrapped our initial "Lights Out" research into out-of-band management devices and BMCs. The final advisories are live and OOBscan now includes detections for all issues. The bad news: many of these issues still have no patch: github.com/runZeroInc/oobsca…
7
49
3
106
11,171
Aaron Grattafiori retweeted
vulnerability research is just a huge topology problem imo. across audits, identify regions with equivalent attacker-visible behavior. reuse the local proofs, analyze the new code, and recheck the gluing. a new attachment can make a bad state reachable. i love topology 🍩. math is always watching me
8
5
89
4,275
Aaron Grattafiori retweeted
This is a cool paper, but I think it's best thought of as Astra is surprisingly capable of doing old school mechanistic interpretability research rather than anything spooky. The things it's doing are clever, but typically exploiting structure in the data and using known method mechanistic interpretability techniques (which Astra was surely pretrained on), though it is better at this than I would have predicted! This is an exciting development for the prospects of ambitiously scaling interpretability or doing very laborious analysis like this, on more real models. However, I'm not holding my breath. This kind of analysis was pretty common up until about 2022, it largely fell out of favor because a lot of it is just exploiting fairly clean surface-level patterns that doesn't scale to the annoying complexity of real LLMs or which only works for the more simpler and superficial properties. And as far as I can tell, basically all the case studies here are just using a bag of interpretability tricks rather than anything spooky. The piece doesn't really update me on how far old school mech interp can go, just on how good LLMs are at it. It's very fun to see the creative solutions Astra came up with though!
We asked GPT-6 Astra to edit Qwen3.5-0.8B weights to improve math. It directly changed only 0.016% of weights, fixing 0.8B's reasoning loops & improving math up to 6x and even instruction following 3x, without gradients or training. We call this Weight-Space Programming: frontier LLMs can now natively read/write neural network weights! 🧵 Blog: rikiyat.github.io/blog/weigh…
Readers added context they thought people might want to know
LLM was given weights explicitly as text in prompt and used code/forward passes (per authors' logs) to ablate Qwen looping direction, a known thinking-mode issue per model card. Primarily fixed repetition in that mode, not general 'natively' improving weights/math. rikiyat.github.io/blog/weight-sp… github.com/RikiyaT/lm_und… huggingface.co/Qwen/Qwen3.5-0… huggingface.co/RikiyaT/Qwen3.…
53
164
36
1,861
105,510
Aaron Grattafiori retweeted
It looks like Astra didn't natively read Qwen's weights? As I understand it, Qwen would get stuck in a loop and not answer the question. Astra used code to perform some standard interp techniques, found a looping direction, and ablated it from the weights.
We asked GPT-6 Astra to edit Qwen3.5-0.8B weights to improve math. It directly changed only 0.016% of weights, fixing 0.8B's reasoning loops & improving math up to 6x and even instruction following 3x, without gradients or training. We call this Weight-Space Programming: frontier LLMs can now natively read/write neural network weights! 🧵 Blog: rikiyat.github.io/blog/weigh…
Readers added context they thought people might want to know
LLM was given weights explicitly as text in prompt and used code/forward passes (per authors' logs) to ablate Qwen looping direction, a known thinking-mode issue per model card. Primarily fixed repetition in that mode, not general 'natively' improving weights/math. rikiyat.github.io/blog/weight-sp… github.com/RikiyaT/lm_und… huggingface.co/Qwen/Qwen3.5-0… huggingface.co/RikiyaT/Qwen3.…
74
108
41
1,738
118,495
Aaron Grattafiori retweeted
I used Divyansh's approach to build an entire Nintendo into ~1GB of Qwen3.5 weights. Qwenputer, meet Nesformer: github.com/dbreunig/nesforme…
1/4 Meet Qwenputer: Qwen3.5-4B with a full RISC-V CPU inside its weights, using the model's own Gated DeltaNet layers as RAM. It runs C and MicroPython in its forward passes, no external runtime. On DeepMind math: base 55–90%, base + Python tool 95–100%, Qwenputer 97.5–100%.
29
64
26
743
43,697
Aaron Grattafiori retweeted
haha, so apparently OpenAI are about to start training on your Daybreak Blue sessions, with no way to opt out. Literally stealing people's private work, as they do it, is cartoonishly evil. It also will presumably kill Daybreak usage by security researchers. Or at least, it should. The thing OAI have had to swear they are not doing to math researchers, they are now explicitly about to start doing to security researchers. Yet another reminder of the importance of open models.
87
200
82
1,494
208,292
Aaron Grattafiori retweeted
here are the slides for "every dog has its' 0day "from @unpromptedconf. pic is me when i sustained a back injury installing something at work behind a tv. link in reply
1
1
14
583
Aaron Grattafiori retweeted
Been hitting guardrails more often during the past two days. Even with /daybreak "on", Sol refusing various types of work: "This content can’t be shown. Some cybersecurity requests are still limited, even when Daybreak is on." Example:
7
4
18
2,330
Aaron Grattafiori retweeted
12
19
4
227
6,025