Security Robot Overlord @ Google. Vulnerability Management @paradoxengine.criscio.net @paradoxengine@infosec.exchange
Italy
Joined April 2008
- Tweets5.2K
- Following378
- Followers2.7K
- Likes4.2K
Claudio Criscione retweeted
This is the first time I've ever seen a site do this, the obvious simple response to a disclosure of a vulnerability without a fix: sacrifice availability to preserve safety. This option should be why we do full disclosure.
Claudio Criscione retweeted
Some stats on #php2shell. In the 10 hours before it was publicly announced, across the @Cloudflare network we saw thousands of attempts to exploit it. That jumped to tens of thousands in the 45 minutes post announcement, hundreds of thousands within 2 hours, and millions now.
Claudio Criscione retweeted
A few of us have been predicting saturation of adversarial contact points for a while, but this is first set of good graphs I’ve seen of it.
Imagine it will take owning agencies a very substantial amount of time to realize what is happening.
Claudio Criscione retweeted
volume does matter
look, i get it. if you were an engineer before agents came along, you're rightfully skeptical about lines of code and number of PRs being used as a metric for any kind of productivity. and i agree! or at least, i used to. for ease of explanation i will talk about this from the perspective as being an engineer on a large team of at least 50.
volume didn't matter before because we focused on impact. you could have high impact even with a few PRs: for example you could make a one line config change and save the company millions of dollars.
but before agents, the times where i saw volume come into the conversation were for the outliers. on the negative end you might have someone who is struggling to perform, on the other end you might have someone who was a "coding machine" archetype. a coding machine was someone who could just lock themselves in a room and emerge with a stack of PRs that solve a huge number of problems. so volume did matter, but only at the tail ends of the distribution, and combined with impact.
if you've ever worked at a large tech company before, you'll get what i mean. the thing about agents is that big tech co problems are now small-medium co problems as well.
how do agents change this calculus? well, everyone now has the ability to become a coding machine. you have incredibly capable frontier models that can write code better than any of us, at a rate much faster than we can. in this world, if you're still producing the same number of PRs as before, why wouldn't you pause to wonder why you're not being more productive? alien intelligence is here, and yet you can't outship a human coding machine?
this brings me back to why i keep talking about trust (xitter.cf/poteto/status/21020504…). if you haven't put in the work to trust your agent's output, it is very difficult to scale up your productivity.
and yes, this approach does require more tokens, but i think about this in terms of cost per intelligence. before agents, this cost was very high - you needed to hire many software engineers with high 6 figure salaries to do the work. tokens are still expensive today, but are likely to get cheaper over time (xitter.cf/theo/status/2107924138…) factoring in the cost of intelligence. what looks exorbitant today will likely be affordable in 6 moths to a year. a single engineer with agents can do the work of tens if not hundreds of engineers, at a fraction of the cost.
the reality that i don't think has hit yet is that job of the software engineer has truly changed. our job is not merely to produce software any longer (well tbh it was never only about the code, but bear with me for the sake of the explanation), but the machine that writes the software. this idea of a software factory, or a Michelin kitchen as i like to call it, is still a topic of research. and it's the type of stuff i like to share, not to flex, but to show you what's possible when you put a lot of rigor into using agents at scale
Claudio Criscione retweeted
Tal attempts to explain why the current vulnpocalypse isn't (yet) a breachpocalypse. while his explanation may not be the correct one (he suggests alternatives too), it still makes an interesting hypothesis. a nice read.
1/ My new blopost on "Why the AI Vulnpocalypse Isn’t the Breachpocalypse (Yet)?"
TL;DR: The vuln surge (‘The Vulnpocalypse’) is real. The breach surge isn’t. YET. Vulns were never the bottleneck; the economics are.
medium.com/@TalBeerySec/why-…
Claudio Criscione retweeted
Introducing PageBreak, an agentic vulnerability discovery tool using deterministic validation to achieve a near-zero false positive rate.
How it works: blog.google/security/agentic…
For real-world vulnerabilities PageBreak has discovered 👇
bughunters.google.com/blog/p…
Claudio Criscione retweeted
We have discovered a massive, ongoing criminal exploitation campaign using Cairn, an autonomous penetration-testing harness, and other AI agents to target hundreds of organizations and successfully breach and impact tens of them (at least). The image below shows just a few days of activity, with up to 25 organizations being attacked simultaneously at the peak.
our intreim report: gambit.security/blog-posts/a…
Yeah. Actually exploitable-at-scale memory corruption vulns are one of the priors that I'm having to re-evaluate unfortunately.
@argvee had told us, but we are only starting to see it now (and I still don't know how frequent this is going to be).
Fun times
Hacktron has a good point here: hacktron.ai/blog/hacking-ope…
"Software has long benefited from a kind of security through complexity. The code and even the vulnerability could be public, but turning a bug into a reliable exploit still required rare expertise, significant time, and knowledge of the target environment. Known memory corruption vulnerabilities were expensive to operationalize, while zero-days were mostly reserved for the highest-value targets."
I love working in Vuln Management.
Over the last week everyone was going crazy about agents swarms collaborating through radio waves and whatnot.
I kept smiling.
And sure enough, they don't patch their stuff, just like everyone else.
Less APT more apt update folks.
Claudio Criscione retweeted
>be me
>discover effective altruism
>apparently normal charity is inefficient
>why donate to random sad thing when spreadsheet can tell you optimal sad thing
>fair enough
>buy mosquito nets
>save lives
>numbers look good
>feel powerful
>couple years later
>someone asks an innocent question
>why only count people alive today
>huh
>future people matter too
>obviously
>my grandchildren shouldn't matter less just because they haven't spawned yet
>reasonable.jpg
>keep following logic
>what about their grandchildren
>also yes
>what about people in 500 years
>sure
>5000 years
>why not
>500 million years
>starting to get weird but morality is morality
>open calculator
>humanity could survive for an astronomically long time
>could colonize galaxy
>could have trillions upon trillions of descendants
>maybe digital people too
>maybe simulated civilizations
>maybe dyson spheres full of happy uploaded minds
>calculator starts smoking
>realize currently living humans are rounding error
>8 billion people suddenly looking extremely beta
>future contains potentially 10^something people
>can't even fit beneficiaries in google sheets
>new moral priority unlocked
>protect the long-term future
>stop thinking in units of "people helped"
>start thinking in "fraction of cosmic endowment preserved"
>malaria?
>terrible
>but only kills existing humans
>AI extinction could delete the entire light cone
>nuclear war could permanently derail civilization
>bad institutions could lock in terrible values for ten million years
>someone invents wrong constitution in 2140
>quadrillions suffer
>better fund governance workshop now
>friend says maybe we should improve hospitals
>explain opportunity cost
>friend says hospitals are full of actual sick people
>explain scope sensitivity
>friend stops inviting me to dinner
>need to decide what to fund
>easy
>expected value
>suppose project has one in a million chance of preventing extinction
>sounds tiny
>but extinction destroys 10^50 future lives
>multiply
>mother of god
>$10 million project has expected value of several galaxies
>charity evaluation complete
>someone asks where the one-in-a-million number came from
>expert judgement
>which expert
>us
>how calibrated
>extremely thoughtfully
>reduce estimate to one in ten million to be conservative
>still beats curing cancer by 38 orders of magnitude
>epistemic robustness achieved
>someone says maybe project doesn't work
>assign 20% chance
>still astronomical
>maybe project makes problem worse
>assign 5% chance
>still astronomical
>why 5
>because 30 felt pessimistic
>publish 46-page report
>contains seventeen sensitivity analyses
>every sensitivity analysis begins after assuming intervention has positive sign
>critic says you're multiplying enormous hypothetical stakes by extremely uncertain probabilities
>yes
>that's literally why it's important
>critic says the uncertainty might be structural rather than numerical
>make probability smaller
>critic says no, I mean maybe your model is wrong
>make probability smaller again
>critic begins rubbing temples
>discover AI safety
>perfect longtermist cause
>AI might kill everyone
>or create utopia
>or seize galaxy
>or tile universe with paperclips
>or create billions of conscious software minds
>finally a problem with numbers big enough for me
>start AI safety nonprofit
>mission: prevent dangerous AI
>hire smartest people available
>smartest people immediately start building better AI to understand dangerous AI
>interesting
>we must understand capabilities to understand safety
>we must scale models to study alignment
>we must race ahead so less responsible actors don't get there first
>we must deploy systems to learn how deployment can go wrong
>we must build the thing quickly because building the thing quickly is dangerous
>outsider asks why the people most worried about AI apocalypse all work at AI companies
>complicated field
>company releases stronger model
>very concerned
>company begins training even stronger model
>extremely concerned
>company raises $14 billion
>concern reaches unprecedented levels
>need to influence government
>future is at stake
>normal democratic process too slow
>politicians don't understand exponential curves
>public doesn't understand x-risk
>experts must guide them
>who counts as expert
>people who understand x-risk
>who understands x-risk
>our friends
>someone objects that this seems politically convenient
>explain we're representing future generations
>future generations unavailable for comment
>develop concept of value lock-in
>terrifying possibility that one ideology controls civilization forever
>therefore extremely important that civilization adopts correct values before lock-in
>whose values
>let's circle back
>begin with impartial morality
>end with small group of people deciding what quadrillions of hypothetical beings would want
>beautiful arc
>meanwhile actual humans keep doing annoying things
>voting wrong
>having parochial attachments
>loving family more than strangers
>caring about local community
>getting upset when told their suffering is cosmically negligible
>evolutionary biases everywhere
>explain that moral intuition cannot be trusted
>except intuition that future digital people count
>and intuition that extinction is uniquely bad
>and intuition that our probability estimates are sane
>and intuition that our institutional choices improve the future
>those intuitions survived peer review
>someone donates $5k to local homeless shelter
>inefficient
>could have funded 0.0000000000003% of an AI governance researcher
>think of all the simulated people you just killed
>okay maybe don't phrase it that way publicly
>PR team says "future generations deserve a voice"
>much better
>journalist asks what longtermism means
>say "future people matter"
>everyone agrees
>great
>journalist asks what follows from that
>well technically we should redirect enormous resources toward low-probability interventions affecting astronomical futures
>journalist raises eyebrow
>return to "future people matter"
>motte has entered the chat
>critic: of course future people matter
>me: glad we agree
>critic: I don't agree that your institute knows how to help them
>me: why do you hate our grandchildren
>eventually notice uncomfortable implication
>if future value dominates everything
>then helping people today mostly matters through effects on future
>education matters because future institutions
>health matters because future productivity
>democracy matters because future trajectory
>human beings slowly become instrumental variables in their own moral philosophy
>see starving child
>feel compassion
>check spreadsheet
>child's direct welfare contribution negligible
>but perhaps childhood nutrition improves national institutional quality
>compassion restored
>tell myself this is impartial altruism
>one day assistant asks obvious question
>"how do you know your intervention actually improves the far future?"
>silence
>open spreadsheet
>increase column width
>add confidence interval
>assistant asks again
>"no, I mean how do you know the sign is positive?"
>stare into cosmic light cone
>10^50 people staring back
>none of them exist
>none of them can tell me
>none of them can falsify my assumptions
>realize I have invented the perfect constituency
>infinitely important
>completely silent
>and always represented by me
I finally decided to try out omarchy. Support for the keyboard did not work quite right so I hooked up a robotic arm and it LLM-generated a driver based on the aptic feedback. It also added support for my standing desk and for fidgeting, while it was at it.
Claudio Criscione retweeted
Excellent OpEd in the FT by Mario Draghi arguing that (1) without higher productivity Europe cannot sustain our social model; (2) that AI is our best possibility to do that; (3) that dependence on US and China makes this hard for sovereignty.
He proposes building up European compute, using our data advantage, and pooling corporate demand to finance it.
ft.com/content/f054f927-b512…
upstream disclosure is a massive challenge. Give me a pipe to full-disclosure.. (And a 6 weeks vacation to avoid dealing with the resulting disaster :/)
Patrick Garrity of Vulncheck has been tracking Project Glasswing. This is how Mythos performed. TLDR: 202 vulns fixed due to Mythos.
Anthropic claims to have discovered 26,153 findings.
Of those, only 2,736 (10.5%) have reached its disclosure ledger.
Of the total volume of Glasswing findings, only 202 (0.8%) have been fixed, 245 (0.9%) have been withdrawn, and 2 (0.01%) are marked as duplicates.
2,096 (8%) have been reported to the maintainer (marked as disclosed, but not confirmed as fixed), and 191 (0.7%) are in the ledger but appear not to have been reported to the maintainer (marked as pre-disclosure).
A mismatch in findings
Anthropic’s own dashboard states 421 findings patched upstream, resulting in 462 advisories (GHSA/CVEs assigned); however, the ledger itself shows only 202 fixed findings.
If we look at the GHSA ledger, CVE ledger, and main ledger (yes, there are three), the numbers also don’t add up.
The CVE ledger lists 70 CVEs while the main ledger has 82 CVEs. The GHSA ledger lists 49 GHSAs, while the main ledger lists 77 GHSAs. None of which add up to the claim of 421 findings fixed upstream.
Claudio Criscione retweeted
One very interesting thing about code reviews starting to fade in many places:
I still remember how, as a manager, code reviews would be one of the places where conflict between individuals or teams would be very EASY to spot for me, as a manager (then figure out how to deal with it).
What happens when there's not much of this code review happening? Does it mean there's no longer any conflict (or interaction?) between devs on the same team, or between teams?
As a broader question: are AI agents drastically changing team dynamics? Or just hiding them? They sure feel they are reducing human-to-human interaction via the code, I'll be honest
This is the way to go. As usual chrome leads. Automated, fast updates for everything everywhere.
📢 @googlechrome is moving to a 2 week release cycle! More in goo.gle/4r2mmSK
Also, a short history on browser update frequency:
• 2001: MSFT shipped IE6 & didn't release a major update for 5+ YEARS! Safari updated ~annually
• 2010: Chrome commits to 6-week releases & automatic updates. (People called us crazy.)
• 2021: Chrome updates to 4-week releases. (People said it was too fast.)
• 2026: Chrome goes to 2-week releases. (Opinions TBD :)
Release early, release often for fresher features and faster fixes... especially important with AI vuln discovery! 💪
Claudio Criscione retweeted
MikroTik ssh 0day in the wild with massive exploitation going on since September 2. Patches went out on Sep 3. Initially looked like a 1day but now it seems exploitation actually began one day before the patches were released. 🤯
Heads up, there is a 1-day full MikroTik RCE chain against SSH being used in the wild. Patch was released yesterday, so if you have a MikroTik router with ssh open on the internet, it may already be compromised. Detection guidance and IOCs courtesy of @CERT_Polska_en cert.pl/en/posts/2026/09/vul…
Claudio Criscione retweeted
AI/Agentic attacks have made headlines recently, but agents are highly "suggestible", allowing us to easily detect (or derail) them.
Our new "Agent Provocateur" deploys in minutes & works.
Read more here, including how to ask agents for reverse shells blog.thinkst.com/2026/09/get…
Claudio Criscione retweeted
My favourite clip: "....OK, anyways"
Episode out with @ajeya_cotra, one of the authors of the METR/Redwood investigation into the OpenAI / Hugging Face attack.
We go through not only what happened, but what it means for how we should train future, smarter AIs which might be involved in the process of recursive self-improvement.
Look up Dwarkesh Podcast on YouTube, Spotify, Apple Podcasts, etc.
0:00:00 - Agents get kicked off
0:06:45 - Self-sacrificing behavior
0:13:43 - Potemkin villages
0:23:27 - The Hugging Face attack
0:35:23 - The slopvestigation
0:52:02 - Understanding the AI's motives
1:05:31 - The actual dangers of anthropomorphizing
1:14:30 - What smarter models might do
1:30:29 - The implications for recursive self-improvement
1:38:10 - Is this the case for open source?
1:53:04 - How do we prevent this in the future?
2:15:58 - The clearest warning shot we might ever get