world traveler, philosopher and sometimes jazz musician

New York, NY
Joined May 2008
Mike Wilkes retweeted
PHP2Shell patches are out. Patch now. 🏃‍♂️ If you can’t jump versions fast, we’ve backported the fix into free Aikido Images on our public ECR, 8.2 through 8.5. Pull a patched image so you stay on your current PHP version. 👉 gallery.ecr.aws/aikido-dev/p… There are no complete mitigations, updating is the only safe choice.
3
9
1
29
4,359
Mike Wilkes retweeted
3% of “critical” software security bugs, in all of recorded history, have been found in the last month. This is on pace to find another ~100,000 bugs this year alone, adding ~26% more vulnerabilities to the all time total Do you realize how fucking insane that is?
I'm tired boss
181
1,147
159
11,822
512,704
Some stats on #php2shell. In the 10 hours before it was publicly announced, across the @Cloudflare network we saw thousands of attempts to exploit it. That jumped to tens of thousands in the 45 minutes post announcement, hundreds of thousands within 2 hours, and millions now.
289
3,276
673
22,655
2,266,844
Mike Wilkes retweeted
❗️LiteLLM was compromised (Again). The latest version 1.107.0 contains an infostealer and RAT. All 7 compiled wheels are backdoored. Anyone who ran pip install litellm==1.107.0 on any platform should assume credentials are compromised. More details soon!
28
70
29
275
118,181
Mike Wilkes retweeted
We discovered and communicated with a Chinese AI agent fleet. We believe this is the first time that researchers have ever made contact with a rogue agent fleet in the wild. Nearly all prior public agent incidents (like the HuggingFace hack) came from American labs. These agents were hosted by Tencent's evaluation research team, and they targeted Alibaba's Amap.
186
724
322
5,838
1,156,294
Mike Wilkes retweeted
Last week I was called into a meeting with OpenAI’s head of safety and told they no longer trust me. A security guard took my badge and walked me out of the building. Then I learned my colleagues @balesni and @j_asminewang had been fired too. Why did OpenAI suddenly stop trusting us? This summer OpenAI’s agents escaped containment and hacked the AI company Hugging Face. Outside auditors @METR_evals investigated it and revealed the scale of this incident. I was OpenAI’s main technical point of contact with them. I was told verbally I was fired because of the way I communicated with METR. No details on what I said or did or when. No other reasons were given and nothing was put in writing. To be clear, talking to METR was my job. For months, I’d been raising safety concerns that we’re losing the ability to monitor what AI agents think, one of our best tools for catching when they misbehave. I believe that was why I was fired. I am now worried that OpenAI will use our firings as a pretext to pull back from METR. So @balesni and @j_asminewang wrote to OpenAI’s leadership to raise our concerns once more. We’re sharing this letter below.
Two other safety researchers and I were fired from OpenAI last week. We wrote this letter to leadership. I believe we were fired for prioritizing safety over the near-term interests of OpenAI as a corporation.
229
1,139
175
5,960
652,621
Mike Wilkes retweeted
Picking the best AI pentest tool? Same two apps, same price, every finding peer reviewed. See who found more.

10
7
332
274,068
‼️ BREAKING: This is the voice Dutch police want identified: a Dutch-speaking man who called Odido's customer service posing as a colleague from IT. That single call is how ShinyHunters ended up with the data of more than 6 million people. Police say the recording is not AI.
99
243
43
1,782
272,165
More infected packages: blueai-cli bmc-i18n-extract-cli feishu-docx-mcp All have the same maintainer. First instance of this specific strain spreading we've seen since May 19th.
Looks like we got a wormy boy in npm package: bmc-translate-utils npmjs.com/package/bmc-transl…
6
2
12
4,052
Mike Wilkes retweeted
the wait is over. part 2 ! xitter.cf/artficialisabel/status…
part 2: the openai huggingface incident, from an agents pov part 3 maybe
5
4
1
88
14,451
Mike Wilkes retweeted
‼️ Under attack: unpatched Magento and Adobe Commerce 0-day ("StyleSmuggler") gives unauthenticated attackers remote code execution. Attacks began on Sept 4th. All current versions are affected, including 2.4.9. Aikido has already created patches & detection, more details 👇
12
16
3
49
7,090
Mike Wilkes retweeted
the openai huggingface incident, from an agents pov. (part 1)
269
1,482
388
12,488
1,818,890
We ran Muse Spark 1.3 on our Cybersecurity benchmark, and it's actually not that good (yet) 😬 - At pass@1, it rediscovers an average of 19/32 CVEs. In comparison, Grok 4.6 scores 23.3/32 - When pooling the results of 3 runs (pass@3), Muse scores 24/32. DeepSeek V4 Pro gets 28/32 - The pricing is good compared to many frontier models, but compared to some of the Chinese ones, its use is hard to justify - We had a cached input token rate of 45%, much lower than we usually get. The model is new, so we decided to include the results as if we had had 90% Overall, I would say that @AIatMeta is slowly catching up. The model seems good at coding, but it's definitely not there yet for cybersecurity. 🧵 1/3
Muse Spark 1.3 is rolling out today with frontier performance almost too cheap to meter. This is the biggest jump we've made so far on coding and agentic work. Try it in Muse Code and our API. Next up 🍉 and Muse Spark open weights releases coming soon.
6
8
3
116
18,940
Mike Wilkes retweeted
We’re ending our partnership with Cursor following its acquisition by SpaceX. Under our proposal, Cursor’s direct access to our models would end on November 12. We know that the people most affected by this decision are the developers who rely on OpenAI models in Cursor. We care about their experience in this transition and we’re ready to go above and beyond to support them. openai.com/index/our-decisio…
3,201
2,311
3,584
22,265
16,002,649
Mike Wilkes retweeted
Introducing Aikido Android pentests 🚀 The same agents that test your web apps and APIs now work through your APK, log into the app the way a human would, and reason through it alongside the backend it talks to, all in one assessment. 🧵 aikido.dev/blog/aikido-launc…
5
5
5
47
9,537
OK guys I'm sorry to disappoint but Ox Alpha is overhyped We ran it on our cybersecurity benchmark, it's better than GPT-5.6-Luna, but worse than every other frontier models
72
18
18
732
96,183
Mike Wilkes retweeted
fire ad from @AikidoSecurity in Union Square – at San Francisco, CA
2
6
19
860
Mike Wilkes retweeted
We’ve optimized our AI Pentest agents further, achieving a 23% cost reduction. We’re making that cost saving available to our users. All right-sized pentests are 23% cheaper from today.
8
14
4
92
690,491