Building offsec agents: https://xitter.cf/t.co/G9EtnC3eaB PGP https://xitter.cf/t.co/3WXr0Rgpa3
Somerville, MA
Joined June 2008
- Tweets26.9K
- Following6.7K
- Followers35.3K
- Likes70.3K
Pinned Tweet
This was quite a ride :) I'm incredibly proud of XBOW's Native Team for their work on this, and looking forward to sharing details on the chain once we're able to!
This seems like a neat way to obfuscate some malicious code but I don’t see where it could be a vulnerability? By the time you’re running someone else’s regularizer you’re already running untrusted code and it could just tamper with the weights directly?
Brendan Dolan-Gavitt retweeted
gotta give it to @OpenAI and their sane daybreak program
heif heist by harsh
kvmescape by paulos
php2shell by lcfr
gitlab rces by joaxcar
chrome full chain by moyix
wordpress rce by hashkitten
all largely thanks to openai daybreak giving researchers access to gpt 5.6 sol.
Brendan Dolan-Gavitt retweeted
The abundance of RCE in these days, remind me the 2000. Exploits were shared, traded but also kept private, some lived for years.
Brendan Dolan-Gavitt retweeted
We're doing an AMA on Reddit with @moyix!
Drop your questions in the reddit thread + he'll answer live tomorrow, Thursday, 10/22 from 12-1pm ET. 🤓
reddit.com/r/cybersecurity/s…
Crazy coincidence that all these great vuln researchers had breakthroughs in the weeks right after gpt-5.6-sol was released :D
Brendan Dolan-Gavitt retweeted
there's still a considerable gap between open and frontier models, and an even bigger gap between frontier models alone and frontier models in the hands of skilled researchers.
a huge number of people threw tokens at the bug and produced mostly slop PoCs.
the benchmark saturation you see online often doesn't translate into frontier level offensive capability. sure, deepseek flash and kimi k3 can probably develop exploits for a good number of vulnerabilities, but the capability gap is still substantial. they mostly failed for this php bug. prove me wrong.
having a more capable model than your adversary is an advantage, and pairing it with a skilled researcher can make that advantage even greater for defenders. everyone involved in this research had access to the best cyber models.
i personally think we should preserve that capability gap rather than dismiss its defensive value without evidence.
There we go
wiz.io/blog/php2shell-php-rc…
Brendan Dolan-Gavitt retweeted
php2shell is the most consequential vulnerability I have ever helped discover. I am proud of how our team worked closely in coordination with the PHP Foundation to provide support and to harden the patch in preparation for this release.
Please read more about our approach:
OpenAI models helped researchers—operating as part of our Patch the Planet initiative—discover critical security flaws in PHP, an open-source programming language used to run an estimated 70% of websites.
Over the past two months, we led a coalition of maintainers, researchers, and security providers to prepare fixes and protections ahead of disclosure. This duration was necessary because the fix was quite intricate and required a major change to the PHP engine. Every site using PHP can now safely upgrade their version to stay secure, in addition to applying mitigations from various security vendors.
Due to the severity of these flaws and PHP’s widespread use, we consider this bug to be one of the most impactful vulnerabilities in recent memory. It also marks a new phase, where AI can find security bugs with internet-scale impact.
This is an example of the Defender’s Window in action: to our knowledge, frontier AI was able to find this vulnerability ahead of attackers, giving defenders time to prepare.
openai.com/index/coordinated…
Readers added context they thought people might want to know
Wiz Research wasn't the first one to discover the exploit. An independent researcher first discovered it: x.com/calif_io/statu…
Brendan Dolan-Gavitt retweeted
php2shell - A tale of two PHP remote vulnerabilities:
calif.io/php2shell
It’s going to be really funny if everyone pointing their LLMs at the PHP codebase tonight finds dozens of OTHER critical vulnerabilities aside from the ones getting fixed tomorrow
Brendan Dolan-Gavitt retweeted
You don't need to fix bugs or port to rust to improve security! Having models help with secure design and minimizing threat surface is a great use case
Reducing the attack surface of deployed services and apps is a fundamental component of software that is secure by design. Earlier this year we tasked Claude with autonomously mapping and reducing the attack surface of 25 large and widely used OSS codebases. This blog post covers some of our methodology and a preview of the data we collected.
This research resulted in a significant reduction in OpenSSH pre-authentication attack surface (now fixed in 10.6). And over 500 findings where reachability could be reduced and configurations hardened to ensure security controls weren’t silently disabled.
anthropic.com/research/attac…
Brendan Dolan-Gavitt retweeted
its obviously not *good* but admittedly having a private key of *4* as a globally trusted cert authority is one of the funniest bits of all time
Brendan Dolan-Gavitt retweeted
📣📣📣 Calling all Chrome bug hunters! 📣📣📣
Rules updates: We're rewarding more types of deep security research, recognizing high-value fixes across more severity tiers, and providing new opportunities for researcher recognition.
For details, see our latest blog post 👇
bughunters.google.com/blog/c…
Brendan Dolan-Gavitt retweeted
I found two Windows 0-days with a frontier model, the first in 76 minutes. Then I replayed the same hunt on Qwen, DS4, GLM and more.
How much frontier capability survives on local models, and how much human direction does it take?
“To the Frontier and Back Again” @UnpromptedAU
Brendan Dolan-Gavitt retweeted
kind of dark that one of the major tells of AI writing is being scrupulous about what the evidence does and doesn't demonstrate
Brendan Dolan-Gavitt retweeted
"Security Through Obscurity Is Dead and LLMs Killed It."
@moyix's @UnpromptedAU talk: a cat pic you can’t photocopy and an emulated HP printer that "runs out" of toner. Send this to your friends and coworkers who think their secrets are safe inside a compiled binary:
unprompted.au/videos/securit…
This might actually be the most fun I’ve ever had giving a talk. Featuring Lune, the Adversarial Cat!
Woot! the @unpromptedau talks are starting to coming come online! 👀
This one by @moyix was probably my favorite: 15mins of unadulterated old-school “I’m hacking this because I think I can” followed by a one-shot live exploit demo involving a t-shirt with a cat on it worn by @mdowd. Seriously just go watch it
(and subscribe for the others… More on the way!)
Watch Brendan Dolan-Gavitt: Security Through Obscurity Is Dead and LLMs Killed It unprompted.au/videos/securit…
Brendan Dolan-Gavitt retweeted
Videos of unprompted.au talks are up!
How’s that FOMO holding up one month on? 👀
Whether you missed out or just want to relive the best bits, the unprompted.au talks are now online!
All the AI. All the cyber. None of the FOMO. 🐙
youtube.com/@unpromptedAU
Brendan Dolan-Gavitt retweeted
Woot! the @unpromptedau talks are starting to coming come online! 👀
This one by @moyix was probably my favorite: 15mins of unadulterated old-school “I’m hacking this because I think I can” followed by a one-shot live exploit demo involving a t-shirt with a cat on it worn by @mdowd. Seriously just go watch it
(and subscribe for the others… More on the way!)
Watch Brendan Dolan-Gavitt: Security Through Obscurity Is Dead and LLMs Killed It unprompted.au/videos/securit…