Pinned Tweet
Every morning,a Gazelle wakes up,it knows it must outrun d fastest lion or it will be killed.Also, a lion wakes up, It knows it must run faster than d slowest gazelle, or it will starve. It doesn't matter if you're the lion or a gazelle-when the sun rises, you'd better be running – at Victoria Island, Nigeria
DML retweeted
We got Microsoft Authenticator to hand over account tokens to a fake Teams app.
The app needed zero Android permissions. It just claimed to be Teams, and Authenticator never checked who was actually asking.
The result: full delegated access to mailbox, files, and calendar through Microsoft Graph.
Full write-up by @ofekdavidlevin with code and PoC: enclave.ai/blog/authmask-we-…
Readers added context they thought people might want to know
Microsoft patched this (CVE-2026-80097) in Authenticator v6.2606.4246+. It requires a malicious app already on the device. No exploitation reported at advisory time. Update via Google Play.
enclave.ai/blog/authmask-…
msrc.microsoft.com/update-guide/v…
DML retweeted
nerds, thank me later...
systemdesign.io
DML retweeted
开源了我的 XSS 审计技能 ,过去一年我用它发现了几十个获得赏金的 XSS 漏洞,连续四个季度进入微软 MSRC Top 10
github.com/songjianyang/xss-…
DML retweeted
I texted my children that we got the puppy they’ve been begging me for and sent them a link with pictures. 🐶When they clicked on the link, it took them to a webpage that said YOU’RE GROUNDED. They’ll be spending the weekend retaking our family’s cybersecurity training course.
DML retweeted
messaging my wife a link containing proof of her husband cheating on her from an anonymous instagram account and then when she clicks on it texting her to let her know she failed the family phishing test and she has to retake my cybersecurity course
DML retweeted
No. I think AI will eliminate entire classes of bugs, probably faster than most people expect. But the idea that we will stop shipping security vulnerabilities entirely by mid 2027 seems extremely unlikely.
Take seL4, one of the best examples of formally verified software. You can mathematically prove code behaves according to its specification, but that doesn’t mean the entire system is secure. There are still assumptions about hardware, architecture, configuration, and everything else.
Even when AI is designing the entire system, those assumptions still exist. And the same advances in AI that make systems more secure will also make attackers more capable.
Cybersecurity isn’t like translation, where you can eventually approach some ceiling of performance. It’s an adversarial problem, and I don’t see that arms race ending any time soon.
Will the models stop writing code with bugs by mid 2027?
xitter.cf/BVeiseh/status/2113389…
DML retweeted
A guy built an AI that thinks it’s 1899, then tried to get it to beat Einstein to his most famous theories.
I got $90,000 for a RCE in Google.
simonkoeck.com/writeups/goog…
DML retweeted
Cloudflare open sourced a security audit skill that orchestrates coding agents through six phases of reconnaissance and validation to produce independently verified, machine-readable findings.
github.com/cloudflare/securi…
DML retweeted
I've decided to finally release my vulnerability hunting methodology that I've been using for several months now, both in testing as well as live engagements with great success.
I was inspired by (and huge congrats to) the @Blackfrost_AI team open-sourcing Cyber-Frost Harness, their reproducible security-agent runtime with procedural skills, an evidence ledger, and isolated Docker targets for red/blue/purple work. 🎉
If you like the Cyber Frost Harness, and want some out of the box vulnerabilty hunting and POC development kit to go along with it - check out my VulnHunter.
It's already loadable: their harness reads standard SKILL.md skills. Point skill_dir at VulnHunter's (or run its installer), and the hunting, falsification, and PoC disciplines load immediately.
Repo: github.com/nealbridges/VulnH…
CREDITS: This is fork of @CapitalOne original repo. I simply took it a step further on POC development and model agnostic. I'm also actively developing in my forked repo as I make more changes to it and welcome the contributions from the community as well.
I think I'm doing the whole "respect who you give credit to" drama, and I asked my model to double and triple check it. So i can blame the model if its wrong. Otherwise, dont put me on blast on X if i suck at credits. /s
Looking forward to developing on this further with the community.
DML retweeted
An alternative to the fellowships: consider designing your own adventure! (Especially if you're e.g. mid-career or otherwise have constraints that would make it hard to take 3 months off to do a thing. Or if you just hate slogging through applications.) Link in thread!
New post! I've done a few advising calls with people looking to get into AI safety fellowships and realised there's lots of concrete advice I kept on repeating.
There's lots of unusual advice that I haven't heard elsewhere, give it a read!
lesswrong.com/posts/PiP4JqQF…
DML retweeted
Google Mantis is a skills pack for security review with coding agents
Install:
npx skills add google/mantis
Key commands:
/mantis-threat-model: builds a threat model from your codebase
/mantis-researcher: scans for vulnerabilities
/mantis-review: filters false positives
/mantis-reproduce: writes a PoC and runs it in a sandbox
/mantis-patch: applies a fix and confirms it blocks the PoC
/mantis-report: generates the final security report
This is a good use case for running your agent in a sandbox, since the reproduce and patch steps execute generated code
github.com/google/mantis
DML retweeted
Zurp is now open source. 🧰
Meta Bug Bounty's research toolkit, inside the proxy you already have open. Meta context, CSRF token handling and FBDL access. Every capability is available to your AI agents too.
github.com/facebookincubator…
DML retweeted
Introducing PageBreak, an agentic vulnerability discovery tool using deterministic validation to achieve a near-zero false positive rate.
How it works: blog.google/security/agentic…
For real-world vulnerabilities PageBreak has discovered 👇
bughunters.google.com/blog/p…
DML retweeted
10 AWS Projects You Can Build in a Weekend
• Static Website → S3 + CloudFront
Learn: hosting, CDN & caching
• URL Shortener → Lambda + DynamoDB
Learn: serverless APIs & NoSQL
• Image Resizer → S3 + Lambda
Learn: event-driven architecture
• Serverless API → API Gateway + Lambda
Learn: REST APIs & serverless compute
• File Backup System → S3 + Lifecycle Rules
Learn: storage classes & automation
• Uptime Monitor → CloudWatch + SNS
Learn: monitoring & alerting
• Contact Form Backend → Lambda + SES
Learn: event handling & email workflows
• Expense Tracker API → Lambda + DynamoDB
Learn: CRUD operations & databases
• Log Analytics Setup → CloudWatch + S3
Learn: logging & observability
• 3-Tier App → EC2 + RDS
Learn: compute, databases & architecture
Don’t just build projects.
Know what each one teaches you.



























