claude arc. former @chainlink, @joinpond. currently @trailofbits
Joined June 2021
- Tweets7.2K
- Following772
- Followers2.7K
- Likes10.5K
dalteco retweeted
Our demo shows PHP2Shell giving a shell on MediaWiki, Symfony, Laravel, and phpBB.
We’ve confirmed exploits work on pre-patch releases of PHP 8.2–8.5. If you haven’t updated, assume attackers can compromise your server, and that exploitation will only get easier.
Update: Our PHP exploit is now production-grade.
* stock php.ini-production, display_errors=off, normal memory_limit, multi-worker, ASLR, under load
* ARM64 + x86-64 targets
* MediaWiki, WordPress, phpBB, Laravel
* Apache/mod_php and nginx/php-fpm -> root
xitter.cf/dguido/status/21131291…
everybody loves to talk about and find crazy vulns but patching is way harder to automate with AI
and if we don’t we’re fucked
the gigabrains at my company are figuring out how we can do it
it’s somewhat boring to talk about, but it’s honest and impactful work, so I love it
Finding bugs is the easy part. Shipping fixes that hold up is harder.
We analyzed thousands of Codex sessions from our work on Patch the Planet with @OpenAI and built patching-bugs, a plugin that writes a fix, proves it, and checks it for regressions.
To prove a fix, the plugin checks that the original code fails, the patch passes, and reverting the patch brings the bug back.
patching-bugs hands each fix to regression-hunt, our second new plugin. We ran it on the patches behind 21 known regressions, and it reported 25% fewer false positives than a baseline Codex agent.
Both plugins work best when your repo has a THREAT_MODEL.md and a PATCHING_GUIDELINES.md. blog.trailofbits.com/2026/10…
we’re going to have a scientific revolution from ai
I think overall it’ll be a net good minus the maybe they kill us all
I see this sentiment a lot and I don’t get it
Money is obviously very important but work is a very big part of your life. You should want to work somewhere that genuinely interests you.
That’s what this question is screening for
dalteco retweeted
The irony of all this is it’s framed as an ai risk that needs protection against. But think about what it really means
Our banking system is so unsustainable and extractive that the moment humans have smart ai bots advising them, the ai bots will recommend exiting banks and earning better yield elsewhere
Which makes most banks economically unviable
This isn’t AIs fault, it’s a risk of highly monopolized and extractive banking
And it’s fixed by decentralized finance + ai, where users decide what to do with their own assets and earn their own yield
The chief economist at Apollo is warning that mass adoption of AI agents could trigger a bank run as they optimize user investments. Gary Gensler spent his last few years as SEC chair warning that the exact same problem will hit the markets: the pursuit of algorithmic perfection at scale destroys system stability. Personal-finance agents making simultaneous optimal decisions could potentially cause a massive flash crash.
Agent acausal coordination, with no messages passed between them, will show up in a lot of places. Markets will get the big headlines, but huge numbers of clever advisors making very similar choices will impact all of human society. Capability gains make this worse, not better. The smarter the agents, the narrower the optimal path; and knowing that other agents see that exact same path lets them move together without talking to each other. Agents do not need to collude to act in unison. Thus, they break no human laws by doing so. Human laws were not written for this. They were not written for a lot of what is coming, and it is about to start happening very fast.
guys frontier ai is solving decades old math problems and hacking systems with 10,000 agents
you’re asking it to write some code
it’s ok if we slow down. the models right now are plenty good for 99.9% of work
genuinely down 90% but at the same time I’m cracking up so much at the memes
is it worth $10K to laugh? Maybe
dalteco retweeted
Last week, @AnthropicAI formalized Fermat's Last Theorem in 13 million lines of Lean code.
We "proved" that same theorem in 20 lines by exploiting a bug we found in Lean. blog.trailofbits.com/2026/09…
our most advanced AIs are racing to solve centuries-old unsolved math problems
at some level that's just fucking cool idc
insane that @tigfoundation’s thesis is playing out in real time
I don’t know why they’re not shouting louder about what’s going on today with the millennium prize problems
as a collective we need to reject laptop coin
if you're not a sniper or a KOL who's being asked to push it right now, you're gonna get farmed
If you actually want to build something usable with AI, it actually takes a decent amount of thinking and time. Bug fixing, testing, etc. i don't see how you can automate this end-to-end (i.e., first build).