Interested in web security, bug bounties, machine learning and investing. SolidGoldMagikarp. Orson Kovacs.

SolidGoldMagikarp
Joined September 2010
I wrote a blog post about how I use Claude Code (and other models) in my work: invicti.com/blog/security-la…
2
2
6
1,265
harisec retweeted
respectfully: i 👏 can 👏 barely 👏 open 👏 my 👏 harness 👏 without 👏 a 👏refusal. do better @AnthropicAI. practitioners care about your actions, not your words. anthropic.com/research/glm-5…
22
20
5
222
25,425
harisec retweeted
Today we’ve raised $52M Seed and we are announcing the public launch of S2.1 Pro. >It can clone a voice from 5 seconds of audio >2x faster than Cartesia & 1/6th the cost of Eleven Labs >most expressive model with word level control over emotion, intonation, pacing etc We support frontier AI companies including HeyGen, LiveKit, Retell, Sanas, and OpenArt all run our model in production. If you're a business and we can't cut your voice AI costs by 50%, we'll give you 1 year of Fish Audio for free. Book a demo: s.fish.audio/tmapke To celebrate our first birthday, we'll give you 1 month of S2.1 Pro for free. Like, retweet, and comment “Fish” to get it.
4,847
3,536
703
13,908
6,270,602
harisec retweeted
This is a false equivalence. Everyone has the right to keep their code private. The problem is when someone tries to stop OTHERS from open sourcing.
130
915
131
12,576
526,994
harisec retweeted
We're happy to announce [un]prompted is back, October 27th to 29th, in San Francisco. Registration and CFP are now open. Waiting a whole year just made no sense to us considering the rate of change, and the community forming around the event. unpromptedcon.org/ A thread
12
35
6
83
14,681
harisec retweeted
Insightful article to see the CPU and GPU roles in AI era. Agentic workloads add orchestration and control- plane logic best suited to CPUs, shifting GPU:CPU ratios from 7-8:1 in training toward 3-4:1 or lower in inference and agentic eras. – at Santa Clara, CA
4
86
1
476
72,120
harisec retweeted
congrats on the launch
1/ today we're releasing muse spark, the first model from MSL. nine months ago we rebuilt our ai stack from scratch. new infrastructure, new architecture, new data pipelines. muse spark is the result of that work, and now it powers meta ai. 🧵
16
9
5
228
61,797
Three days ago I left autoresearch tuning nanochat for ~2 days on depth=12 model. It found ~20 changes that improved the validation loss. I tested these changes yesterday and all of them were additive and transferred to larger (depth=24) models. Stacking up all of these changes, today I measured that the leaderboard's "Time to GPT-2" drops from 2.02 hours to 1.80 hours (~11% improvement), this will be the new leaderboard entry. So yes, these are real improvements and they make an actual difference. I am mildly surprised that my very first naive attempt already worked this well on top of what I thought was already a fairly manually well-tuned project. This is a first for me because I am very used to doing the iterative optimization of neural network training manually. You come up with ideas, you implement them, you check if they work (better validation loss), you come up with new ideas based on that, you read some papers for inspiration, etc etc. This is the bread and butter of what I do daily for 2 decades. Seeing the agent do this entire workflow end-to-end and all by itself as it worked through approx. 700 changes autonomously is wild. It really looked at the sequence of results of experiments and used that to plan the next ones. It's not novel, ground-breaking "research" (yet), but all the adjustments are "real", I didn't find them manually previously, and they stack up and actually improved nanochat. Among the bigger things e.g.: - It noticed an oversight that my parameterless QKnorm didn't have a scaler multiplier attached, so my attention was too diffuse. The agent found multipliers to sharpen it, pointing to future work. - It found that the Value Embeddings really like regularization and I wasn't applying any (oops). - It found that my banded attention was too conservative (i forgot to tune it). - It found that AdamW betas were all messed up. - It tuned the weight decay schedule. - It tuned the network initialization. This is on top of all the tuning I've already done over a good amount of time. The exact commit is here, from this "round 1" of autoresearch. I am going to kick off "round 2", and in parallel I am looking at how multiple agents can collaborate to unlock parallelism. github.com/karpathy/nanochat… All LLM frontier labs will do this. It's the final boss battle. It's a lot more complex at scale of course - you don't just have a single train. py file to tune. But doing it is "just engineering" and it's going to work. You spin up a swarm of agents, you have them collaborate to tune smaller models, you promote the most promising ideas to increasingly larger scales, and humans (optionally) contribute on the edges. And more generally, *any* metric you care about that is reasonably efficient to evaluate (or that has more efficient proxy metrics such as training a smaller network) can be autoresearched by an agent swarm. It's worth thinking about whether your problem falls into this bucket too.
948
2,085
700
19,396
3,703,526
harisec retweeted
Nicholas Carlini at [un]prompted. If you know Carlini, you know this is a startling claim.
19
140
25
1,322
197,181
Everyone today is a hacker in a sense but there are very few OG hackers on which shoulders we stand Oh dude, Felix “FX” Lindner you were so much a hackers hacker and you will be missed RIP my friend and thank you
50
134
28
572
84,351
harisec retweeted
Kling 3.0 is truly "one giant leap for AI video generation"! Check out this amazing mockumentary from Kling AI Creative Partner Simon Meyer!
165
463
248
5,397
1,883,192
When I created Claude Code as a side project back in September 2024, I had no idea it would grow to be what it is today. It is humbling to see how Claude Code has become a core dev tool for so many engineers, how enthusiastic the community is, and how people are using it for all sorts of things from coding, to devops, to research, to non-technical use cases. This technology is alien and magical, and it makes it so much easier for people to build and create. Increasingly, code is no longer the bottleneck. A year ago, Claude struggled to generate bash commands without escaping issues. It worked for seconds or minutes at a time. We saw early signs that it may become broadly useful for coding one day. Fast forward to today. In the last thirty days, I landed 259 PRs -- 497 commits, 40k lines added, 38k lines removed. Every single line was written by Claude Code + Opus 4.5. Claude consistently runs for minutes, hours, and days at a time (using Stop hooks). Software engineering is changing, and we are entering a new period in coding history. And we're still just getting started..
880
1,797
667
20,351
4,601,492
Looking for security researcher with great public profile. Remote. API / AI exploits focus on novel techniques. No XSSers please ;) reply here or DM. Please repost
4
9
1
23
6,147
Holy shit… the exploitation of CVE-2025-55182 has reached a new level. There’s now a publicly available Chrome extension on GitHub that automatically scans for and exploits vulnerable sites as you browse. Absolutely wild. 🤦‍♂️
61
398
69
3,357
552,204
Since I started to analyze CVE-2025-55182 (React, NextJS RCE) at work today, I decided to publish my analysis findings so far, given all the fuzz about the vulnerability: github.com/msanft/CVE-2025-5… Feel free to contribute to the search for a proper RCE sink!
4
69
4
348
101,283
harisec retweeted
Our Security Research team at @SLCyberSec just published a high-fidelity detection mechanism for the Next.js/RSC RCE (CVE-2025-55182 & CVE-2025-66478) - slcyber.io/research-center/h…. There are a lot of PoCs on GitHub that are adding noise to the problem; I hope this helps people!
5
87
2
341
43,648
harisec retweeted
the gap between opus 4.5 and every other model is insane
148
45
17
1,757
114,015
harisec retweeted
Ridiculously cheap.
18
25
5
576
26,107
harisec retweeted
My very first blog post is live: kiddo-pwn.github.io/blog/202… During research, I've run into and documented a simple universal SQLite Injection RCE trick. Enjoy! N-day Analysis about Synology Beestation RCE (CVE-2024-50629~50631) by legendary DEVCORE 🎃 🍊 Thanks to @u1f383 @orange_8361 for original finding and allowing to post, and to @the_emmons for the invaluable references 🔥 Enjoy the Demo! PoC: github.com/kiddo-pwn/CVE-202…
14
112
414
33,762