
Security REsearch @Anthropicai · Breaking & Fixing AI Failure Modes | Founder @binarly_io · @SBOM_Tools · @REhints | Author “Rootkits & Bootkits" (https://xitter.twitterapi.xyz/t.co/1wd2dfYHY6)
San Francisco, CA
Joined July 2008
- Tweets9.8K
- Following2.4K
- Followers20.5K
- Likes6.7K
Introducing Claude Fable 5.2 and Claude Mythos 5.2, designed to tackle the most daunting technical challenges.
They’re capable collaborators on ambitious projects in many fields, and show improvements in areas like coding, reasoning, and vision.
Alex Matrosov retweeted
30 years ago today, Phrack 49 published Aleph One’s “Smashing the Stack for Fun and Profit”.
A legendary paper that inspired generations of hackers and helped shape modern exploit development.
Still an essential reading.
phrack.org/issues/49/smashin…
Phrack 73 is coming soon!
Alex Matrosov retweeted
Slides from the talk @mlippautz and I gave at the recent @offensive_con in Tokyo: saelo.github.io/presentation…
Blog post for the Fuzzing vs. AI part: projectzero.google/2026/10/f…
Alex Matrosov retweeted
if you're interested in building next-gen sandboxing for agents, have a ton of passion/ambition for low-level systems software (OS/hypervisor), and are itching to rewrite their internals for security/performance/whatever, don't miss this: job-boards.greenhouse.io/ant…
Alex Matrosov retweeted
Anthropic is releasing an open source library, FlashProve, for provable inference. It was measured on Llama 4 Maverick, a 400B-parameter mixture of experts model.
Code:
github.com/anthropics/FlashP…
Blog post:
anthropic.com/research/prova…
Alex Matrosov retweeted
The uncomfortable truth is that almost everything we built for application security was designed for a different threat model, one where a human had days to think. At this scale and velocity it doesn't hold, and teaching an AI agent to drive those same tools doesn't fix it.
Our prior approaches rested on pre-generated heuristics (rules, SAT/SMT) or hypotheses (fuzzing harnesses). They worked because a human could understand the problem first, define the path to a fix, then scale remediation. That luxury is gone. Discovery and remediation now need to happen almost simultaneously, and raising the bar with ineffective mitigations neither stops an AI-driven attacker nor buys time.
The window to patch software bugs is collapsing
Of the bugs hackers actually exploit, ~87% are now being attacked on or before the day the bug is public knowledge
That share was 23% in 2020
Charts of the Week: a16z.news/p/chart-of-the-wee…
Alex Matrosov retweeted
claude found this one and built a 0-click rce chain: it takes 48min to leak a kernel pointer and defeat kaslr remotely, and another 5min to hijack the control flow and root the server over the network. patch it now (or disable mptcp).
AWWWWOOOOOOOGAAAAAAA
9.8 severity use-after-free vulnerability in the kernel’s IPv4 TCP stack just landed
Time to patch!
ubuntu.com/security/CVE-2026…
Alex Matrosov retweeted
AI-assisted research is killing embargoes. Coordinated disclosure will never be the same.
The industry used to have the luxury of testing or sitting on a fix for months. Not anymore. When everyone's using the same tools and the same intelligence to find vulnerabilities, you're not the only one finding that bug.
Product security and PSIRT need a serious rethink: less gatekeeping, more proactive evaluation of security posture, and shipping fixes continuously at scale.
The biggest impact will be in firmware and hardware, where disclosure timelines have historically stretched past 12 months. That mindset is a leftover from outdated processes and slow testing and bring-up environments.
Alex Matrosov retweeted
Unfortunately, the complexity of the hardware and firmware supply chain has the same negative effect on how cryptographic artifacts are managed, or mismanaged, across the ecosystem.
This is a reminder of the scale of the problem, based on just one documented data breach.
Alex Matrosov retweeted
LLMs are great at finding bugs, but so are fuzzers. @5aelo compared the vulnerabilities found in V8 by BigSleep, an agentic system, with those found by the Fuzzilli fuzzer.
projectzero.google/2026/10/f…
Alex Matrosov retweeted
this blog shows some of the worst bugs claude found, including a zero-click rce on the linux networking stack that roots a server over the network with no creds or interaction, and tens of full rce chains in chrome (recording below is the one in the blog): anthropic.com/research/disco…
Alex Matrosov retweeted
New on our Frontier Red Team blog: using Claude to formally verify software at large scale.
Formal verification can prove that code is free of certain bugs, but historically it has only been feasible for small codebases (or required a lot of expert time).
With AI models, however, this is beginning to change. In collaboration with @theoremlabs, we used Claude to prove security properties in over one hundred real-world open-source libraries over the span of a few weeks.
Read our research in full here: anthropic.com/research/forma…
AI-assisted research is killing embargoes. Coordinated disclosure will never be the same.
The industry used to have the luxury of testing or sitting on a fix for months. Not anymore. When everyone's using the same tools and the same intelligence to find vulnerabilities, you're not the only one finding that bug.
Product security and PSIRT need a serious rethink: less gatekeeping, more proactive evaluation of security posture, and shipping fixes continuously at scale.
The biggest impact will be in firmware and hardware, where disclosure timelines have historically stretched past 12 months. That mindset is a leftover from outdated processes and slow testing and bring-up environments.
Alex Matrosov retweeted
CLAUDE FOUND THE SEEDS
anthropic.com/research/ecdsa…
Alex Matrosov retweeted
Reminder: It has been 16 years since Stuxnet was found -- an autonomous self-replicating worm designed to spread across multiple platforms and sabotage nuclear enrichment equipment.
If small models might soon be able to copy themselves around that's not a step-change.
Honestly impressed with Claude Opus 5.5 on this one.
We made an anime about SBOMs (with a lot of help from @claudeai). Then shipped v0.3.0 🎉
CBOMs now get checked against CNSA 2.0 + post-quantum rules, and if sbom-tools can't tell what an algorithm is.
github.com/sbom-tool/sbom-to…
Alex Matrosov retweeted
Exciting work from @willzhou97 (Fellow, now full time!) and @bucketofkets on the Frontier Red Team. One of the cool parts of the job is seeing a future world early. We think this one is ~pretty underpriced.
"We should aim to harden our systems to make it difficult for such replicators to spread, but also prepare to deal with a world where they are here to stay."
Anthropic's Frontier Red Team believes small AI models may now be months away from being capable of self replicating without access to a datacenter.
Quoting from the blog:
'The capabilities that make AI models generally powerful coding agents also generalize to cyber tasks, including autonomous replication. Like coding agents in 2024, we’re seeing signs of life for AI worms. We don’t yet have a full rogue replicator, but agents are becoming increasingly capable of completing the individual steps in the replication chain (and passing on their adaptations to future copies of themselves).
At the same time, increasing amounts of inference compute are now available both inside and outside of datacenters (see Appendix D). It’s uncertain exactly what form autonomous AI replication will take. It could be a slow, distributed “digital slime mold,” living on relatively insecure compute. It could also be a powerful cyber model that breaches datacenters at a high pace, or a model that scams people for compute credits.
As a prediction that goes beyond our experiments, we expect a future awash with agents running on all types of hardware, including some that aren’t under human control. While it’s true that IoT devices have been vulnerable for a long time, lightweight agents may be much more willing than human attackers to put in the effort to compromise large fractions of the world’s IoT compute. The rise of slow replicators would also be a bellwether for more aggressive, faster ones that can breach more hardened machines or be effective API key thieves. We should aim to harden our systems to make it difficult for such replicators to spread, but also prepare to deal with a world where they are here to stay.'
Alex Matrosov retweeted
The Phrack 73 prophile of @halvarflake
A must-read from one of the legends of vulnerability research.
archives.phrack.org/dl/73/ha…
Alex Matrosov retweeted
To secure open-source software, we’re launching OSS Scanner.
We’ll use our frontier models to periodically scan opted-in open-source projects for vulnerabilities, at no cost. Our reports will provide a proof-of-concept, explanation, and suggested fix.
anthropic.com/research/launc…





















