Cyber Ops @MistralAI | Security researcher. Top 25 all-time @yeswehack. Here for the unintended features. 🇫🇷
/var/run/docker.sock
Joined May 2014
- Tweets975
- Following1.1K
- Followers985
- Likes8.3K
Pinned Tweet
Thanks to the amazing @YesWeHack team for the trust 🙌
From my very first bug at FIC 2022 to today, I’m proud of the journey on YesWeHack.
Also a big shout-out to fellow Hunters for the incredible collabs — @Icare1337 , @truffzor , @jtof_fap & @LdrTom 💪
#exegol4thewin
Ever found someone else’s SIM card in your mailbox? 📱📫
It’s one of the wildest bugs @Wlayzz has ever found – and just one of several interesting insights he shares in our latest hunter interview.
Watch his story now 👇
#YesWeRHackers #BugBountyTips
Lucien retweeted
Evolving threat 🚨 CVE-2026-111497, previously known to affect Node.js (node2shell) and Python has evolved into “HTTP2Shell.”
A significant blast radius.
This vulnerability leaves many libraries and applications using HTTP vulnerable to pre-auth RCE via Brotli decompression.
Please be aware. Fixes not yet available for all affected services. Look for Brotli (1.2.1) dependency upgrades when they become available.
Lucien retweeted
Vercel has proactively rolled out Firewall-level mitigations for today's Node.js RCE vulnerability, in advance of the official patch release.
All traffic for all deployments is automatically protected. We're actively monitoring and rolling out managed runtime upgrades.
Node.js Security Advisory: a high-severity RCE flaw in Node's Brotli decoder affects Node.js 22, 24, and 26.
Vercel WAF rules are live for every project and block known exploit patterns.
vercel.com/kb/bulletin/node-…
Lucien retweeted
I really hope that bug bounty platforms (cc @Bugcrowd @HackerOne @intigriti @yeswehack) will apply their 0day usual policies and will reject the farming of php2shell that is coming very soon.
Don't add to the triage fatigue, please
#BugBounty
Lucien retweeted
To teach a lesson,
After Wiz rushed to buy php2shell domain and use its marketing machine to steal the spotlight, I spotted "phpbleed" in a recent Calif tweet and bought phpbleed.com before wiz could pull the same stunt again.
A big budget can buy a domain. It shouldn't buy someone else's research credit.
If you have contacts at CISA or in the press, do the right thing: make sure the researchers who actually did the work get the recognition they deserve.
Hack the planet. Credit the researchers.
This game steals more hours of sleep than bug bounty. It’s so addictive 😩
I made a fun little game: ZeroDay Tycoon 🐛
Start as a broke bug bounty hunter, survive triage and your worst enemy (Duplicate), and build a cybersec empire.
100% free, plays in your browser.
👉 zeroday-tycoon.com
💬 discord : discord.gg/nYHtxf5FZX
Lucien retweeted
Yes, we were awarded a 44 000$ bounty on @Hacker0x01 ! #TogetherWeHitHarder #BugBounty
Another critical with the squad @Icare1337 @truffzor @Wlayzz 🔥👊
Lucien retweeted
I’m in Seoul building Mistral’s founding Korea team.
Looking for kind, ambitious researchers and engineers to build and customise LLMs for real problems, from data and evals to RL and training at scale.
Here until 16th October. DM me or apply here: jobs.ashbyhq.com/mistral.ai/…
Lucien retweeted
Proud to partner with Aikido Security to power Depi's malware detection 🤝
Attack dependencies before threat actors do. Detect malware with Aikido's feed. React with context from our dependency graph.
Three layers, one platform.
Hack the planet 🔥
Aikido Intel now powers @0xDepi's malware detection.
Depi maps every package, pipeline and maintainer between you and a supply chain compromise. Aikido Intel's feed now powers the malware detection behind it.
💜🤝💙
Learn more about Aikido Intel: intel.aikido.dev/
I just joined the cyber team at @MistralAI last week 🐈
Perfect timing to watch Le Chonk ship from the inside. Massive respect to the science team, insane work.
Sure it will have a big impact for cyber sovereignty in the world.
We pushed the performance of ML4 on a very wide range of capabilities. On many of them, it reaches SOTA performance with the open models. In some domains such as visual grounding, legal, or spreadsheet manipulation, it even outperforms the best models.
ML4 ranks among the bests on AA Cyber Index, scores 82% on vulnerability reproduction and patching, and 93% on Cybench. Open models are the best defense for enterprises today: capable, auditable, self-hosted and governed under enterprise policies -- and more importantly, they do not refuse to help.
3/n
Lucien retweeted
That one took some groundwork. Trained and served on our own compute, and RL shows no sign of saturation
Meet Mistral Large 4, aka Le Chonk.
• 1T parameters, natively multimodal. 49B active.
It is the best open weights model from US or Europe on aggregated benchmarks.
• State-of-the-art on critical workloads, including cyber defense, manufacturing and finance and it surpasses closed frontier models on visual grounding.
• Forged in Europe end-to-end and is deployable from Europe via our own Mistral Cloud infrastructure.
• Available to all via API today. Working with cybersecurity partners privately.
Open weights release end of October.
Lucien retweeted
Today, we are launching a preview of our new model, Mistral Large 4 (ML4), aka le Chonk 🐈.
ML4 is a 1T-parameter model with 49B active parameters, trained natively with multimodal capabilities.
It is at the frontier of open models, and by far the strongest open-weight model from the US or Europe.
The RL run behind this preview is still in flight and shows no sign of saturation -- we will release a final version before the end of the month along with the weights of the model.
🧵
1/n
Meet Mistral Large 4, aka Le Chonk.
• 1T parameters, natively multimodal. 49B active.
It is the best open weights model from US or Europe on aggregated benchmarks.
• State-of-the-art on critical workloads, including cyber defense, manufacturing and finance and it surpasses closed frontier models on visual grounding.
• Forged in Europe end-to-end and is deployable from Europe via our own Mistral Cloud infrastructure.
• Available to all via API today. Working with cybersecurity partners privately.
Open weights release end of October.
Lucien retweeted
Meet Mistral Large 4, aka Le Chonk.
• 1T parameters, natively multimodal. 49B active.
It is the best open weights model from US or Europe on aggregated benchmarks.
• State-of-the-art on critical workloads, including cyber defense, manufacturing and finance and it surpasses closed frontier models on visual grounding.
• Forged in Europe end-to-end and is deployable from Europe via our own Mistral Cloud infrastructure.
• Available to all via API today. Working with cybersecurity partners privately.
Open weights release end of October.
🤖 Made with AI
Lucien retweeted
On July 25, we hacked OpenAI.
Two bugs let us take over ChatGPT/Codex accounts of OpenAI employees (+some unaffiliated users) and reach connected services: Outlook, Slack, GitHub, etc.
We proved it with a PR in OpenAI’s internal codebase . It took us <72h. 🧵
Lucien retweeted
This is basically an Opus 4.5/4.6 level model that will work on anything with 8 Gb RAM
Today, we’re announcing Ternary Bonsai 2 27B.
Based on Qwen3.8 27B, Bonsai 2 27B is 9x smaller than its full-precision counterpart while retaining 98.2% of its aggregate benchmark performance.
Two months after the first Bonsai 27B release, the biggest change is quality. The footprint remains 5.9 GB, but the gap to full precision has narrowed materially, with particularly strong gains in agentic coding, multimodal reasoning, and long-horizon tool use.
Ternary Bonsai 2 27B is available today under Apache 2.0.
Lucien retweeted
🎙️🇫🇷 Nouvel épisode du podcast Hack'n Speak accompagné de @kevin_mizu 🔥🥇
Épisode dédié à son parcours, ses recherches, son XSS DOMPurify et bien sûr un peu, beaucoup d'IA :)
Bonne écoute à toutes et à tous 🎶
creators.spotify.com/pod/pro…
