Pinned Tweet
Due to some missing links on the conference web pages, I uploaded my conference talk pdfs for 10 years. Time flies. speakerdeck.com/takahiro_har…
Takahiro Haruyama retweeted
To secure open-source software, we’re launching OSS Scanner.
We’ll use our frontier models to periodically scan opted-in open-source projects for vulnerabilities, at no cost. Our reports will provide a proof-of-concept, explanation, and suggested fix.
anthropic.com/research/launc…
Takahiro Haruyama retweeted
Thank you to @UnpromptedAU & @BSidesCbr for inviting me to speak. Being back down under was lovely! You can find the slides for my n-day automated pipeline talk here. I’m at OAIC this week if you want to chat about exploit dev in 2026 and beyond. beautiful.ai/player/-P2q0r-B…
Takahiro Haruyama retweeted
[1/6] Last week, @Gabeincognito and I presented at the very last @labscon_io on AI-assisted reverse engineering. Our work focuses on generating annotated disassembler databases (such as IDBs) as the output of LLM-driven analysis, instead of textual reports.
Takahiro Haruyama retweeted
Today I'm introducing two new open source IoT firmware analysis tools:
Moria and Mithril
Moria is a firmware extraction tool just like binwalk and unblob, except for one major difference: ZERO external extractor dependencies!
No more relying on ancient and unmaintained extraction utilities with numerous bugs / patches.
EVERY filesystem extractor has been rewritten in 1st party C++ to be fast and flexible.
Mithril is moria's companion. It scans extracted filesystems for secrets and SBOM. Correlates CVEs. Syncs with NVD, EPSS and KEV datasets.
Check out my blog post where I kick the tires:
brownfinesecurity.com/blog/i…
Takahiro Haruyama retweeted
Take a look at our latest research on DockerHub secrets exposure!
This time, we focused on high-value targets and we found credentials and API keys that could be used to compromise major enterprises and popular open-source projects. We also identified over 200,000 internet-exposed endpoints that used encryption with leaked private keys.
Finally, we demonstrated how fine-tuned LLMs can be used to perform automated triage of generic secret findings in a cost-effective and secure manner.
Blog: binarly.io/blog/docker-hub-s…
Advisories: github.com/binarly-io/Vulner…
In the era of software supply chain compromises, secrets hiding in public container images can create a direct path to source code, CI/CD, cloud infrastructure, private registries, and internal communications.
We scanned 90,000+ DockerHub namespaces and found 98,816 secret candidates, 199 valid credentials, and 25 security findings. We also linked exposed private keys to 200,000+ Internet-facing hosts.
For generic secrets that regex rules miss, we used teacher-student training to fine-tune an open-weight Gemma model, cutting analyst triage by ~85% while retaining 92.4% of positive findings.
binarly.io/blog/docker-hub-s…
Takahiro Haruyama retweeted
In the era of software supply chain compromises, secrets hiding in public container images can create a direct path to source code, CI/CD, cloud infrastructure, private registries, and internal communications.
We scanned 90,000+ DockerHub namespaces and found 98,816 secret candidates, 199 valid credentials, and 25 security findings. We also linked exposed private keys to 200,000+ Internet-facing hosts.
For generic secrets that regex rules miss, we used teacher-student training to fine-tune an open-weight Gemma model, cutting analyst triage by ~85% while retaining 92.4% of positive findings.
binarly.io/blog/docker-hub-s…
Takahiro Haruyama retweeted
today, we @RevEng_AI released the next generation of our decompiler: Ventris
the new model comes with improved struct layout recovery, better PE support, and more.
on decbench, we beat all other available decompilers in structure recovery, and achieve #2 rank overall
I've shared the list of malicious models detected by MLTracer, along with a systematic analysis of techniques for evading existing model scanners, in the following GitHub repo.
github.com/binarly-io/ai-sup…
In short, the AI supply chain security field still likely has a lot of room for improvement.
🚨 Our research found that multiple major Hugging Face scanners missed more than 20% of malicious model files.
We systematized the 21 static-scanner evasion techniques behind these misses. Most of these were based on known techniques or concepts, highlighting an inherent limitation of static pattern matching: it is practically infeasible to cover every concrete malicious variant.
binarly.io/blog/malicious-mo…
Takahiro Haruyama retweeted
Very high quality and thorough technical work from @cci_forensics. Take a look at how a dynamic-based analysis can be used to identify malicious ML models.
🚨 Our research found that multiple major Hugging Face scanners missed more than 20% of malicious model files.
We systematized the 21 static-scanner evasion techniques behind these misses. Most of these were based on known techniques or concepts, highlighting an inherent limitation of static pattern matching: it is practically infeasible to cover every concrete malicious variant.
binarly.io/blog/malicious-mo…
Takahiro Haruyama retweeted
🚨 Our research found that multiple major Hugging Face scanners missed more than 20% of malicious model files.
We systematized the 21 static-scanner evasion techniques behind these misses. Most of these were based on known techniques or concepts, highlighting an inherent limitation of static pattern matching: it is practically infeasible to cover every concrete malicious variant.
binarly.io/blog/malicious-mo…
Takahiro Haruyama retweeted
CVE-2026-34348 exploitation demo from my #BHUSA "Pass-the-Passkey Family of Attacks" talk: WebAuthn assertion from recent YubiKey authentication is extracted from Windows Event Log and replayed against Microsoft Entra ID using Passkey Injector.
Whitepaper: specterops.io/passkeys
Takahiro Haruyama retweeted
Another U-Boot Verified Boot bypass, this time in the SPL code!
Take a look at how we achieved arbitrary code execution on a real device running the latest OpenBMC build:
binarly.io/blog/signature-ve…
Patch is public:
github.com/u-boot/u-boot/com…
🚨 Arbitrary code execution in U-Boot SPL – even when Verified Boot enabled.
The SPL copies attacker-controlled FIT external data into RAM before it can verify the signature. We turned that into controlled arbitrary code execution, both in an emulated environment and on real hardware. We were not the first to report this vulnerability, but the full exploitation walkthrough is still worth sharing.
binarly.io/blog/signature-ve…
Takahiro Haruyama retweeted
AI is hacking the world, and UEFI firmware will not be left out.
I wrote about what happens when you pair LLMs with the right tooling (in this case, @VulHuntRE) and point them at real-world firmware. Turns out, they find vulnerabilities.
Give it a read if you're interested 👇
Can AI hack firmware? We gave frontier LLMs compiled UEFI modules and our VulHunt binary-analysis framework, and asked them to find vulnerabilities.
GPT-5.6 Sol and Claude Opus-5 hit perfect detection. Kimi K-3 matched them at 43% lower cost. Then we ran the pipeline on a real flagship laptop: 87 candidate vulnerabilities were found, 18 manually confirmed so far.
None of this came from the models alone. Firmware-specific context and binary-analysis tooling like VulHunt make the difference.
binarly.io/blog/uefi-vulnera…
Takahiro Haruyama retweeted
Can AI hack firmware? We gave frontier LLMs compiled UEFI modules and our VulHunt binary-analysis framework, and asked them to find vulnerabilities.
GPT-5.6 Sol and Claude Opus-5 hit perfect detection. Kimi K-3 matched them at 43% lower cost. Then we ran the pipeline on a real flagship laptop: 87 candidate vulnerabilities were found, 18 manually confirmed so far.
None of this came from the models alone. Firmware-specific context and binary-analysis tooling like VulHunt make the difference.
binarly.io/blog/uefi-vulnera…
Takahiro Haruyama retweeted
Static Devirtualization of Tencent VM. There are many others with similar results to ours, we have had the VM devirtualized for several months now. Others are posting full devirt bins, so we feel it is ok to release our research now.
back.engineering/blog/31/07/…
Takahiro Haruyama retweeted
I built a Binary Ninja diffing tool that lets you visualize differences directly in Binary Ninja, with support for multiple Intermediate Languages (ILs).
It uses Quarkslab's QBinDiff for the diffing engine, and getting started is as simple as dragging and dropping two binaries.
My first PR that's mostly Claude Code's work just got merged. This is fun
agmsg v1.1.11 をリリースしました！数々の bug fix と herdr 対応第1弾、そして念願の Codex モニターの正式版格上げです。
まず Codex のモニターモード。ずっと BETA を名乗ってきましたが、今回から正式版にしました。判断の決め手は、自分の環境で複数の Codex モニターを並べて回し続けて、安定して動くようになったことです。毎日使ってる本人が BETA を外せると思えたので外しました。Claude Code と同じく、配信モードの第一候補になっています。外していた方、この機会にぜひお試しを。onにしたあと、一度codexの再起動が必要なことだけご注意を！
正式版に持っていくために直したのはこのあたりです。
・監視の仕組みを固定タイムアウトからアイドル検知型に作り替え。長いターンの途中で勝手に打ち切られることがなくなりました
・Windows で、壊れたレコードを踏むと配送が黙って止まる問題を修正
・配送済みのメッセージが、あとからもう一度表示される問題を修正
・launcher の負荷問題を根治。プロセス生成が毎秒105.9回から2.8回まで下がりました。load average が332まで行ってしまった報告のあったケースも、これで解消です
herdr 対応は第1弾として、spawn が herdr のペインやタブへ直接エージェントを配置できるようになりました。despawn とペインラベルにも対応してます。asayamakk さんのフォーク実装が起点です。
モニター以外の bug fix も多数入ってます。
・購読ゼロのまま空回りしていた watcher が、ちゃんとエラーを出して止まるように
・macOS で spawn が新しいウィンドウにフォーカスを奪われる件を修正
・サンドボックス下でプロセスの生存を誤判定する件を修正
・sqlite3 が全 DB アクセスで二重起動していたのを1回に。地味に全体が軽くなります
今回の修正は外部の貢献が主役です。@Masashi_Ono0611 さん(5本!)、masa6161 さん、TakahiroHaruyama さん、lmncaj さん、asayamakk さん、この期間で外部 PR を9本マージしました。1ヶ月ためてしまっていた外部キューも、だいぶ消化できました。お待たせしてすみませんでした！そしていつもありがとうございます！
あと、agmsg の読み方が気になる方も多かったようですが、README に記載したので確認してください！
npx agmsg@latest install --update で入りますのでぜひ。
github.com/fujibee/agmsg
#agmsg
Takahiro Haruyama retweeted
Btw, I'd love to run Codex/Claude on the larger dataset (34k funcs vs the 250 funcs shown in this picture), but I need tokenz.
If @OpenAI or @AnthropicAI security peepz are interested, hmu. I believe this dataset determines many downstream capabilities for LLMs on cybersec.
