Hacker. Co-founder Veracode. Former L0pht security researcher. GenAI Auto-repair of vulns is the future
Boston, MA
Joined March 2008
- Tweets30.6K
- Following1K
- Followers55.6K
- Likes8.2K
Pinned Tweet
28 years ago today, 7 members of the hacking group @L0phtHeavyInd told the U.S. Senate they could "shut down the internet in 30 minutes."
Chris Wysopal retweeted
My forward to the 40th anniversary Phrack, released today at [un]prompted. A true honor, and responsibility, I will not soon forget.
Thank you to the Phrack team for all you do, and for being what this community is about for so long. We owe you so much
Chris Wysopal retweeted
AI-driven threats demand collective resilience.
This Wednesday at 3 PM CDT, join @WeldPond at #FSISAC in Austin to explore how financial institutions can strengthen cyber defenses.
Connect with Veracode at Booth #68!
fsisac.com/events/americas-f…
Does anyone remember the time in the 90s when people thought the antivirus vendors were releasing viruses so companies had to buy their products?
Now AI is finding vulnerabilities, writing exploits, and creating threats so fast that the only way to defend yourself is to buy more AI.
It’s starting to feel like the 90s all over again.
Chris Wysopal retweeted
PHP2Shell exposed critical vulnerabilities in core PHP, affecting every PHP version released in the last decade
Patching still matters, but it cannot be the whole strategy.
@Weldpond on why resilience must be built in.
veracode.com/blog/the-week-s…
I'm excited to speak with @manicode tomorrow on how LLMs often write code with vulnerabilities if you don't give them any security intent and how we can improve GenAI secure coding.
AI writes more code than ever, but security isn't keeping pace.
Our 2026 GenAI Code Security Report found an average security pass rate of just 56%.
Tomorrow, join @WeldPond and @manicode to explore the findings and practical ways to close the gap. veracode.com/resources/webin…
Chris Wysopal retweeted
I'm going to be on a podcast tomorrow with @Veracode and the OG himself, @WeldPond
Please join us!
veracode.com/resources/webin…
Get ready for AI Security’s Fight Night! Three debates on Day 2 After Hours of [un]prompted. Your fight card:
Where is the Vulnpocalypse?
@EppSecurity, creator of the Zero Day Clock, and @jeremiahg, founder of WhiteHat Security and CEO of Root Evidence, will debate the resolution: “AI noise hasn’t moved the needle on current cyber risk.”
Burn Down the Playbook:
Can Yesterday’s Defenses Stop Tomorrow’s Attacks?
Tim Brown (CISO-in-Residence, Team8; former SolarWinds CISO) and @gadievron (CEO, Knostic; Chair, [un]prompted) will debate how to build a security program that can defend against agent swarms.
Too Big to Jail:
Do Human Attackers Also Get Misalignment and Act Rogue?
@k8em0 (Founder & CEO, Luta Security) vs. @raistolo (Full Professor, Politecnico di Milano) will debate if humans escape sandboxes, or do they use a sandbox escape? Should corporations be held accountable for cyber attacks? …What is consciousness anyway?
Debates shepherded by one of the world’s leading debate coaches, Professor Stephen Llano, Ph.D. (St. John’s University).
We’re 13 days out from [un]prompted II, the AI Security Practitioner Conference, where the AI security industry convenes to share what they’ve built, tested, deployed, and what failed.
October 27–29 at the Hibernia in San Francisco or online. Register: unpromptedcon.org
Thank you to our Sponsors: Knostic, TachTech, Censys, Ent, WorkOS, Decibel Partners, Whiterabbit, Zenity, RunSybil, AISLE™
Thank you to our Community Partners: SANS Institute, Cloud Security Alliance, RSAC, FIRST.
Chris Wysopal retweeted
BREAKING: The [un]prompted agenda is LIVE! 3 days. 81 sessions. 4 villages. Workshops. 2 social gatherings. Let's go!! @unpromptedconf, where the AI security industry convenes.
unpromptedcon.org/agenda-10-…
Share. See you in San Francisco or online in 17 days.
Chris Wysopal retweeted
Thrilled to be a part of this @Veracode webinar with @WeldPond on October 22nd @ 11am Eastern.
veracode.com/resources/webin…
I hope to see you there!
Chris Wysopal retweeted
Key Cybersecurity Metrics That Show Risk Is Really Declining hubs.li/Q04B4gqW0 from @viahubcorp @WeldPond @1kosmosblockid @DenizGezgin80 and more
Are human attackers "misaligned?" Do they "go rogue" and "escape sandboxes?" If we don't use this language with humans why are we using it with agentic processes?
In cybersecurity we use the language that an attacker "used a sandbox escape" yet frontier labs use the language that an agent "escaped the sandbox."
What is going on here? It's like agents are super anthropomorphized.
Great reporting by @KimZetter on hardware implants in Ledger wallets stealing crypto recovery seeds via cellular connections.
Buying from an authorized reseller may not be enough.
Question for hardware security researchers: Could we develop an inexpensive SDR-based test to detect these implants by monitoring for unexpected LTE transmissions during wallet initialization, without opening the device?
zetter-zeroday.com/who-is-pl…
Chris Wysopal retweeted
The answer is only relevant to a small niche of infosec. Most organisations are hacked by vectors that don’t involve memory corruption exploits. Agentic hacking doesn’t look like exploits, it looks like breadth-first searches for every possible mistake and misconfiguration.
Chris Wysopal retweeted
In the history of nuclear weapons safety, there was a debate between the military and the scientists at Sandia National Labs about whether traditional analog electronics were safe enough to control detonation. The labs demonstrated that in the case of a fire, the circuit boards could short and cause safety mechanisms to fail.
This prompted the development of "strong links" in Enhanced Nuclear Detonation Safety (ENDS). They were designed such that it was physically impossible to activate from random electricity, fire, or a physical crash. They could only activate by a complex and unique "intent" signal that cannot possibly be produced by natural events.
We are having a similar debate now around AI safety. The solution is to contain agents using signals that they cannot possibly produce.
More history around this by @SteveBellovin :
usenix.org/legacy/event/usen…
My wife @debkav is having The Matrix, “woman in a red dress effect”, in Milan
