“Making the internet a more secure place” sounds like an impressive and altruistic mission. However, the reality is far more complex than it may initially appear.
Imagine that someone in your neighborhood decides, on their own initiative, to make the neighborhood safer. They install a gate at the entrance and put up additional barriers. Some residents welcome the initiative, believing that the person has good intentions. But what happens when the police need to enter the neighborhood in an emergency? Suddenly, their ability to respond depends on whether that individual decides to open the gate.
This illustrates a fundamental problem: Good intentions alone cannot justify actions that have significant consequences for public safety and national security, particularly without proper oversight, accountability, and regulation.
Beyond that, I believe there are some important ethical questions that organizations like yours need to address.
What ethical framework governs your decisions about whom to assist and how? How can you be certain that your mobile forensics work isn’t inadvertently undermining a legitimate law enforcement investigation into child exploitation? What mechanisms do you have in place to determine whether an Iranian “opposition” organization is genuinely what it claims to be, rather than an entity linked to terrorism or hostile intelligence activities?
These are not hypothetical concerns. They reflect the very real complexity of operating in an environment where the distinction between legitimate activism, criminal activity, and national security threats is not always clear.
I would argue that we should place significantly more trust in Western democratic government agencies, which operate within established legal and institutional frameworks, than in private companies, particularly when some of the largest technology companies have repeatedly demonstrated that they cannot always be trusted to protect their users’ privacy. To be clear, I am referring to Big Tech in general, not your company specifically.
Ultimately, we are discussing some of the most sophisticated and sensitive technological capabilities in existence. These are capabilities traditionally developed and deployed by advanced nation-states, mostly Western democracies.
The question is not simply whether we all want a safer internet. Of course we do. The real question is who should have the authority to make these decisions, under what rules, and with what level of accountability.
And perhaps most importantly, who gets to decide what “safer” actually means—and for whom?
Calif was founded with a mission to make the Internet a more secure place for everyone. In the last few months, we have been seeing significant advances in AI model capabilities, especially in the domain of offensive security research. In addition to publishing our research and learnings, we wondered what else we could do to help defenders.
While large corporations and government agencies have the dedicated budget and human resources for incident response and forensics, there are non-profit organizations –- collectively known as civil society organizations –- investigating digital threats affecting vulnerable groups and they are funded entirely by volunteers. In order to perform their job, the civil society researchers may need to extract data from mobile devices for forensic purposes, reverse engineer malware, and conduct similar security tasks. This work can be challenging given the restricted environments on some mobile devices.
We understand these technical challenges and will offer our research services and capabilities to these organizations, free of charge. We support them and their mission.
If you represent such an organization and need assistance, contact us at [email protected].
dune crawl3er retweeted
Everywhere you see this flag 🇵🇸, you see chaos, terrorism, and violence.
I wonder why?
dune crawl3er retweeted
While reverse engineering down to 1:1 of the original code has always been possible (despite taking skills and a lot of time), I believe the current advancement with AI will push more and more vendors to ship heavily obfuscated and DRM protected code
dune crawl3er retweeted
We discovered a sophisticated recording device that was hidden inside one of our offices. We used our models to understand the device and where it had come from, identifying that a specific employee had planted it a few days earlier. We referred the matter to the FBI, and we’re grateful to the agents and prosecutors who moved quickly to make an arrest. The FBI’s investigation is ongoing and we will continue to support their work.
At this time, we have no indications of this individual inappropriately accessing or exfiltrating model weights, source code, or customer data. The employee was terminated.
We take protecting our technology, data, and people seriously, and as a matter of national importance. Our security program is designed to protect against a wide range of threat actors, from insider risks to cybercriminals to nation states, and this case is an example of how AI can help address these sophisticated security threats.
dune crawl3er retweeted
Lobbying geohot.github.io//blog/jekyl…
dune crawl3er retweeted
Finding and Exploiting Spacecraft Vulnerabilities xitter.cf/i/broadcasts/1kKzDPeDN…
dune crawl3er retweeted
The Phrack 73 prophile of @halvarflake
A must-read from one of the legends of vulnerability research.
archives.phrack.org/dl/73/ha…
We’re releasing a broad range of new mathematical results produced by an internal frontier model.
We’ve been consulting with the independent Advisory Group on Mathematics and Artificial Intelligence at the Institute for Advanced Study, and we have drawn on their advice and public recommendations to inform how we release these results.
github.com/openai/math
dune crawl3er retweeted
All vendors should have a plan for rapid remediation in the case of active exploitation.
Here’s some emergency fix strategies we’ve seen over the years:
projectzero.google/2026/10/e…
Can we please not normalize the wrong use of the word “exploit”? You don’t “find” exploits in software, nor can software “contain exploits” the model can find.
Vulnerabilities are found. Exploits are written, crafted, engineered, but they aren’t found in software. This irks me.
Our Black Hat talk on the OpenAI-Hugging Face incident is now live on youtube.
This is a watershed moment for the industry. I encourage all defenders to watch, consider how attack dynamics will imminently change, and plan for accelerating defense.
youtube.com/watch?v=87DyyMV0…
dune crawl3er retweeted
Huawei phones are super insecure lol
I am not aware of the details of this case, but this kind of situation highlights why SIGINT is so important





























