Pinned Tweet
We just dropped a new paper 🚀 🚀 Meet MAPTA, a multi-agent pentesting AI for the web. With just a few tools, it crushed the XBOW benchmark with 76.9%.
MAPTA has already uncovered and reported critical security issues to Tier-1 companies, with multiple CVEs pending.
Full details on the vulns are coming once we’re past the responsible disclosure gag 🤩
AI for Security has never been more exciting.
Let me present MAPTA, our multi-agent framework that found multiple (now confirmed!) Remote Code Executions (RCE's) in flagship web products of Tier-1 companies. Why the secrecy? We're good boys, letting them cook patched through responsible disclosure.
What's our secret sauce? 1/n
how do people actually get access to Daybreak Red and Claude CVP Red? on the surface, it seems like you just fill out a form, complete ID verification, and get access, but this doesn’t work in the real world. At @BugBunny_ai, long before we started playing the bug bounty game, we were submitting issues to open-source projects while being fully bootstrapped. We have 120+ CVEs assigned yet can’t get access, and we’re also No. 1 on the HackerOne business leaderboard for 2026, but none of this seems to matter in the application process
Zero sense of urgency?
Full technical details are available on our blog: wiz.io/blog/php2shell-php-rc…
Advisory website: php2shell.com
people need to pay more attention to cache read pricing. It's where most inference providers make their money.
DeepSeek API (off-peak): $0.15 in / $0.60 out / $0.003 cache read
inference.net: $0.08 in / $0.50 out / $0.008 cache read
inference.net looks cheaper, but its cache reads cost 2.7x as much!
for example, 1B input tokens (99% cached) + 7M output:
DeepSeek: $8.67 ($1.50 new input, $2.97 cache, $4.20 output)
inference.net: $12.22 ($0.80 new input, $7.92 cache, $3.50 output)
this means inference.net, while cheaper on the surface actually costs 41% more...
I don’t think cyber refusals are applied equally across daybreak blue accounts. My older account barely gets any refusals, but a new one is basically unusable on the same prompt. Has anyone else noticed this?
Appreciate the feedback, we shipped some major updates to @BugBunny_ai this month, sometimes I am quite shocked at how good this has become
I tried @BugBunny_ai using the coupon code shared by @Zaddyzaddy, and I’m genuinely impressed by what Zaddy has built.
I ran it against a private bug bounty target I’ve been actively hunting, where I’d already found and reported multiple High and Critical bugs.
About an hour later, BugBunny came back with 8 findings. One Medium and the Critical were already known and reported by me, but the other findings were new to my research.
Honestly, seeing an agent uncover things I hadn’t found myself is impressive. Huge respect to Zaddy for building this.
Just extended this to 100 more 🤩
Code: BUNNYMAGIC
To everyone who has been wanting to try out @BugBunny_ai here’s a coupon code limited to the first 100 signups
Code: BUNNYMAGIC
run it up 🤩
Z A D D Y retweeted
Will probably release RSI loops to let anyone improve huggingface.co/Akahsizrr/Cyb… at home on their own GPUs tonight.
It's gonna be a whole " post-training harness " with RSI loops on command.
You will be able to command improvements on the model and get it done.
working on recipes for different kind of consumer cards as well to accelerate the time training will take for LorA, Full param FT & RL ( especially rollouts ) will take so it will be a good opportunity for me to showcase our work on custom engine for both inference and training locally!
More soon. For now deffo go check the model, it's very good especially for its size!
Ouch no support for hopper GPUs
🚀 Introducing DeepInfer, our in-house inference framework, now fully open source!
Powering DeepSeek-V4.1-Flash at scale with high throughput and low latency. We’re sharing our production stack to help the community lower compute costs, reduce energy use, and make AI more affordable.
🔗 github.com/deepseek-ai/DeepI…
1/4
To everyone who has been wanting to try out @BugBunny_ai here’s a coupon code limited to the first 100 signups
Code: BUNNYMAGIC
run it up 🤩
the bunny 🐰 is celebrating its first birthday, here is a free coupon code to tryout bugbunny.ai limited to the first 100 users
Code: BUNNYMAGIC
apply at checkout
We gave MiniMax’s new M3.1 Flash 100 pull requests with known vulnerabilities and one hour per PR in the @BugBunny_ai VulnPR-100 benchmark.
It found 35/100 for $11.85, or $0.34 per vulnerability found.
That matches Mistral Large 4’s score at roughly 4.5× lower review cost.
DeepSeek V4.1 Flash 1017 still found 19 more vulnerabilities while costing less.
I’m curious what these 24/7 agents will actually be doing during an active breach.
Say an attacker exfiltrates unencrypted API keys from a database. Beyond detection and log analysis, what can the agents autonomously do to contain the breach?
I understand using these agents for hardening pre-breach but don’t really see how they can save you afterwards
