Generating AI slop @QED_Audit ex. @TeamAtlanta24, @osec_io, @georgiatech
/proc
Joined April 2019
- Tweets1.8K
- Following878
- Followers1.9K
- Likes2.1K
pr0cf5 retweeted
On July 25, we hacked OpenAI.
Two bugs let us take over ChatGPT/Codex accounts of OpenAI employees (+some unaffiliated users) and reach connected services: Outlook, Slack, GitHub, etc.
We proved it with a PR in OpenAI’s internal codebase . It took us <72h. 🧵
pr0cf5 retweeted
During my time at @QED_Audit I circled back and took another quick look at browser/JSE vulnerability research. AI agents flying high, seemingly finding & exploiting bugs everywhere, and there's this: a **constant integer overflow** in V8, alive for over 3.5 years. (1/5)
@QED_Audit found CVE-2026-19174, an integer overflow in V8 that gives you arbitrary code execution in Chrome. The bug is one line of constant arithmetic. It survived 3.5 years of fuzzing, manual audit, and LLM-driven review. (1/n)
pr0cf5 retweeted
@QED_Audit found CVE-2026-19174, an integer overflow in V8 that gives you arbitrary code execution in Chrome. The bug is one line of constant arithmetic. It survived 3.5 years of fuzzing, manual audit, and LLM-driven review. (1/n)
pr0cf5 retweeted
Some people saw the "count Rs in strawberry" example and dismissed the capabilities.
But I saw it and thought I cannot spell strawberry either, and I still can be productive.
pr0cf5 retweeted
Recently I uploaded two new videos! But I have been pretty inactive the past 2-3 years and a lot has happened.
Let me share an update about my life, AI and the future of LiveOverflow.
pr0cf5 retweeted
LLM-driven security isn't just about finding implementation bugs in code. it's breaking cryptographic protocols at the logic level.
AI agents are necessary to secure every layer of a project, from theoretical foundations to the frontend.
We found a key-recovery attack on TALUS v4, a PQ threshold signature scheme in NIST’s Threshold Call, using @QED_Audit’s bug finder.
Huge thanks to the authors for the quick response and fix in v5.
📄 Attack: eprint.iacr.org/2026/1668
🛠️ TALUS v5: arxiv.org/abs/2603.22109v5
pr0cf5 retweeted
We found a key-recovery attack on TALUS v4, a PQ threshold signature scheme in NIST’s Threshold Call, using @QED_Audit’s bug finder.
Huge thanks to the authors for the quick response and fix in v5.
📄 Attack: eprint.iacr.org/2026/1668
🛠️ TALUS v5: arxiv.org/abs/2603.22109v5
pr0cf5 retweeted
LOOKING TO BUY (LTB)
2,400 Oak Logs
ready to be processed into funeral coffins, sent directly to Seoul, Korea.
Also looking for a carpenter, my Korean carpenter was liquidated both figuratively and literally, leaving his wife and 1.5 children in crippling debt
pr0cf5 retweeted
zk.golf by @zksecurityXYZ challenges you to write the cheapest formally verified circuit and prove it correct in Lean 4.
For the SHA-256 challenge, we submitted a circuit with 1 witness and 1 constraint. It still verified.
Here is how we broke the spec. 🧵
pr0cf5 retweeted
Check out my "Audit Comp | Base Azul" card on @immunefi!
#OnchainDefender immunefi.com/s/pc/?u=QED&id=…
pr0cf5 retweeted
Over the past ~2 years, @commonwarexyz has been building a new kind of blockchain stack from the ground up.
Today, we’re excited to share the culmination of that work with Constantinople:
commonware.xyz/blogs/constan…
pr0cf5 retweeted
70k tps
400ms finalization
browser light client
native passkey wallet
… now available (for free)
pr0cf5 retweeted
The two THORChain critical bugs we reported in January were found with our AI auditor. Around the same time, there were many AI-generated PRs labeled as P0 security fixes, but they did not catch these issues.
A recent Huginn run reported 196 findings.
AI can now generate hundreds of plausible findings. The real value is identifying the few bugs that actually put funds at risk.
In January, QED Audit reported two critical THORChain bugs while their bounty program was still active:
> $40M asset theft
> drain all THORChain RUNE bonds
Both vulnerabilities were fixed, but unfortunately, we were not paid. However, we will not advocate for open disclosure as we believe responsible disclosure should remain separate from bounty or compensation disputes.
🧵(1/8)
pr0cf5 retweeted
In January, QED Audit reported two critical THORChain bugs while their bounty program was still active:
> $40M asset theft
> drain all THORChain RUNE bonds
Both vulnerabilities were fixed, but unfortunately, we were not paid. However, we will not advocate for open disclosure as we believe responsible disclosure should remain separate from bounty or compensation disputes.
🧵(1/8)
pr0cf5 retweeted
Back in January this year, we found a logic bug in @THORChain that allowed allowed arbitrary settlement of pool balances unbacked by actual fund transfers, leading to ~$8.5M worth of asset theft. It is currently fixed.
More on this Soon™
pr0cf5 retweeted
ADAPT enables efficient, dynamic updates for stake-weighted threshold signatures.
The subtle part is epoch-to-epoch safety: locally valid stake/threshold updates can compose into an unsafe reachable state.
REG-ADAPT adds a sequence-level guard.
pr0cf5 retweeted
For years, Rust binaries made reversing a nightmare. Modern decompilers only support C, lacking meaningful types, constructs, and language-specific functions. Led by @34r7hm4n, we're releasing our S&P work Oxidizer, the first deep Rust decompiler, built on angr!
Interested? 🧵👇
