Before local AI is banned, learn how to host and tune your own models. Specific learning curves to understand for me were: - Offloading portions of newer models to SSD rather than RAM - Prompt caching configs - Preload tuning - the right choice of model for the task - pre optimized models for your hardware and harness - finding the fastest inference server at the web/api level

Claude + Able (abliterated GLM) - a match made in heaven 🥰 🫂 💘

Sometimes you get on here and everyone is shouting about things you know… They are friends, and people you respect, or with titles, etc, and when those opinions get numerous you begin to doubt yourself… Don’t. 9 times out of 10, it’s hyperbole, groupthink, sensationalism, trolling, marketing, or grift. Test your assumptions and expertise, pivot if things change, but if you are true expert or practitioner, stay strong and confident in your abilities and intuition. 🫶

Guys I do sometimes prompt like… “find me a crit, make no mistakes” but only because I have 70+ thoroughly researched and defined skills for my custom harness…

Q: “Jason is the vuln apocalypse here!?!??” Eh, if you were around in the early web days we had worse weeks than this. We survived and were better for it.

I used REA on a modern anticheat to learn about what exactly was being sent to the provider about my machine. I was interested, mostly, in the privacy implications of kernel level anticheat. REA did a fantastic job. I’m a tough crowd when it comes to AI platforms, frameworks, skill packs, etc, etc, in offsec. I think most are bad. Over engineered in the harness, under engineered in the skills and agents. They don’t solve completion bias. REA was dope on this 1st run.

Hacking Vroom and Instaglam today in our course "Attacking AI"!

People saying ai replaces and automates… It literally doesn’t, it scales. 1% of people are completely automating or replacing . People just have this weird fucking selective memory about how things happen because they love the feeling of the scale. Brothers and sisters you literally re prompted those systems or had to re-architect them to change course several times. You had to review for hallucination. There was 100 small things you did to create that AI output at its final stage.

Corporate Defender AI Tip: A lot of organizations we work with are still having trouble getting AI approved as standalone access (OpenAI, Anthropic, Foundry Direct, Bedrock) For defenders working on large queues of alerts, email has been a dreaded (but accepted) form of collection for these types of alerts outside of the security product's dashboards themselves. Many companies' first foray into AI is enabling (and approving) something like Copilot across the M365 stack. A quick hack can just be to use the integrated copilot in Outlook with a starter prompt or a system prompt (if you have access to set it) and ask it to create summaries for you out of those email inboxes, sort them, apply limited logic tirage, etc (but this is ONLY if you lack the corporate approval for API access, lack access to a AI agent framework, or harness)