AI x Security @depthfirstlabs, Ph.D., CTF player @Nu1L_team, now @StrawHat_CTF. #Pwn2Own winner. Author of #DirtyCred #Badiouring
- Tweets 195
- Following 407
- Followers 3,742
- Likes 845
Pinned Tweet
Containers are no longer a security boundary.
Over the past few months, we’ve seen a crazy amount of Linux kernel vulnerabilities and exploits. This has forced us to rethink the security of infrastructure that relies heavily on the underlying kernel, especially containers.
As models become more capable, the barrier to escaping a container has fallen so much that adversaries can now generate working kernel exploits in a single shot. CVE-2026-80521 is one such example. We discovered it using dfs-large1 from @depthfirstlabs and generated the exploit in one shot with GPT-5.6 Sol. The exploit still works on the latest Ubuntu 26.04 release because the fix has not yet been backported.
Read our full writeup: depthfirst.com/research/cont…
31
70
397
115,877
Zhenpeng (Leo) Lin retweeted
Our researchers built a vulnerability scanner that costs two cents per scan and completes a scan in around two seconds.
The scanner is built with Jev, a classifier that outputs probabilities rather than generating tokens. On dfbench v1, our flagship model, it finds nearly as many real vulnerabilities as GPT-5.6 Luna, one of the most efficient models by cost per vulnerability.
This new harness breaks vulnerability discovery into parallel tasks, making it possible to scan every package, repository, or commit quickly and at low cost before escalating the hardest cases to other frontier models on the depthfirst platform.
Read more about how we built this in comments 👇
5
5
62
4,735
Containers are no longer a security boundary.
Over the past few months, we’ve seen a crazy amount of Linux kernel vulnerabilities and exploits. This has forced us to rethink the security of infrastructure that relies heavily on the underlying kernel, especially containers.
As models become more capable, the barrier to escaping a container has fallen so much that adversaries can now generate working kernel exploits in a single shot. CVE-2026-80521 is one such example. We discovered it using dfs-large1 from @depthfirstlabs and generated the exploit in one shot with GPT-5.6 Sol. The exploit still works on the latest Ubuntu 26.04 release because the fix has not yet been backported.
Read our full writeup: depthfirst.com/research/cont…
31
70
397
115,877
People are arguing over whether containers have EVER served as a security boundary.
If you need a bug to build a primitive to escape or move laterally, that means there’s a boundary to cross. RCE in a K8s pod doesn’t mean you control the node.
You can argue that it’s a weak security boundary, but you can’t deny it exists.
3
1
29
3,481
github.com/google/nsjail is a great example. It uses the same isolation techniques as containers, explicitly for sandboxing.
Enterprises are using Kubernetes to run mixed workloads with different threat levels on the same node.
It is a weak security boundary, but how can containers have never been a security boundary?
6
433
Zhenpeng (Leo) Lin retweeted
Applications today can pull thousands of third-party packages, and AI agents are accelerating how quickly those dependencies are introduced and changed.
Scanners flag known vulnerabilities across that dependency tree, but security teams still need to know which vulnerable functions their application can reach.
At depthfirst, we use agents to trace paths through startup commands, frameworks, and transitive dependencies, just like a team of security researchers.
We explore where static analysis misses real execution paths and how we make agentic reachability practical at scale: depthfirst.com/post/reachabi…
4
20
1,402
There is always a balance between usability and security, but in the age of AI, security is becoming so much more important that we can no longer afford to ignore it
I wish posts like this would get more visibility. It’s obvious to many of us who are system devs but doesn’t seem to be for a lot of the neowebdevs
5
1,057
As noted in the post, this vulnerability was also found by @ky1ebot :)
1
5
2,638
Zhenpeng (Leo) Lin retweeted
We received early access to @claudeai Opus 5.5 and evaluated its defensive security capabilities on @depthfirstlabs dfbench.
At high reasoning effort, the model achieved 54.9% recall and 48.5% precision, up from 48.1% and 44.2% at medium. Detection cost averaged $8.42 per task, roughly one-third the cost of GPT 5.6 Sol at high and half the cost of Grok 4.7 at high, though with lower recall than both.
Surprisingly, increasing reasoning effort improved both recall and precision. We’ve typically seen a tradeoff in our evaluations, with models finding more vulnerabilities at the expense of more false positives. Opus 5.5 improved on both.
It also reached 79.5% macro recall on differential analysis, up from 75.3% at medium. At $1.78 per task, it showed strong performance in tracking vulnerabilities across code changes.
2
1
33
5,661
Good AI v.s. bad AI
Our co-founder and CEO @qasimmith sat down with @SaraIttelson at Accel, one of our earliest investors, to discuss the forces reshaping security:
Starting depthfirst.
Building secure software at speed.
Finding the TikTok vulnerability with our flagship model dfs-large1, a flaw that could have exposed millions of users’ private photos and allowed hackers to access their camera feeds and microphones without their knowledge, and recently covered by @washingtonpost.
Full interview in the link in comments.
8
616
Zhenpeng (Leo) Lin retweeted
Our co-founder and CEO @qasimmith sat down with @SaraIttelson at Accel, one of our earliest investors, to discuss the forces reshaping security:
Starting depthfirst.
Building secure software at speed.
Finding the TikTok vulnerability with our flagship model dfs-large1, a flaw that could have exposed millions of users’ private photos and allowed hackers to access their camera feeds and microphones without their knowledge, and recently covered by @washingtonpost.
Full interview in the link in comments.
1
10
30
15,349
When you have a strong, cyber-capable model in house… By burning as more tokens as possible, you will just uncover A LOT of crazy stuffs. More to come!
Today, @washingtonpost covered critical vulnerabilities @depthfirstlabs found in TikTok. These vulnerabilities allowed hackers to access anything on a user’s device that TikTok itself could access, including the camera, microphone, payment information, photos, and the user’s entire TikTok account.
Read more in the thread 🧵
19
1,621
Zhenpeng (Leo) Lin retweeted
First time I saw live how this vulnerability could be exploited to access anything on your phone (from photos to payment information) my jaw dropped.
Next year is going to be a wild ride for security. We at @depthfirstlabs are building models and tools to protect the world's software. If you want to work on one of the most important mission of this decade, we are always hiring for brilliant researchers and engineers
Today, @washingtonpost covered critical vulnerabilities @depthfirstlabs found in TikTok. These vulnerabilities allowed hackers to access anything on a user’s device that TikTok itself could access, including the camera, microphone, payment information, photos, and the user’s entire TikTok account.
Read more in the thread 🧵
5
51
4,894
Zhenpeng (Leo) Lin retweeted
American AI firms restrict their chatbots from helping with cybersecurity tasks, but Chinese models are more accessible for anyone, which has enabled hackers and state-backed actors to use the software for nefarious purposes. wapo.st/4ivBTYZ
17
35
76
38,474
TikTok users, please always keep your app updated to avoid being hacked! They may just drain your bank account, keeping things updated is always the best practice.
Today, @washingtonpost covered critical vulnerabilities @depthfirstlabs found in TikTok. These vulnerabilities allowed hackers to access anything on a user’s device that TikTok itself could access, including the camera, microphone, payment information, photos, and the user’s entire TikTok account.
Read more in the thread 🧵
20
1,765
Zhenpeng (Leo) Lin retweeted
I left DeepMind two years ago with the conviction that cybersecurity would be fundamental to the future of AI.
The atomic bomb offers lessons about competition, cooperation, and control. But with AI, we do not yet know what forms the technology will take, how its risks will emerge, or what containing them will require. Calls from frontier labs to slow development may buy time. We still need to build the means to stay in control.
One thing we do know: AI will run on compute and interact with the world through software and networks. Those systems give us concrete places to observe its behavior, enforce limits, and intervene, even as our understanding of the risks evolves.
Some thoughts on this new frontier for cybersecurity: Building the Means to Stay in Control
8
7
57
3,608
Zhenpeng (Leo) Lin retweeted
Security has become a top priority for every board member, CEO, CISO, CIO and executive I talk to these days.
We're seeing incredible demand across F500 companies, startups and the public sector.
AI is already capable of breaching some of the most widely used social apps in the world. More on that soon.
The frontier is moving fast, and security teams need to move faster. The time to shore up defenses was yesterday. The second best time in now.
NEW from Ramp data. Despite cost-cutting on AI overall, one area companies are increasing their spend: AI security software.
In the wake of the Hugging Face hack, three of our trending software vendors (depthfirst, Monte Carlo, Antithesis) make software specifically designed to monitor agents in production.
Unclear as to whether any of them would have stopped the Hugging Face attack, which was so hard to track and identify because the agents covered their tracks with falsified logs.
I expect AI security will become a strong headwind to deeper enterprise adoption, at the short-term expense of OpenAI and Anthropic and at the long-term benefit of vertical-specific security software cos.
2
6
35
1,439
Zhenpeng (Leo) Lin retweeted
We are excited to introduce Dependency Firewall with On-Device Protection.
It enforces security policies on devices and blocks malicious or untrusted packages across AI agents, applications, package managers, and registries.
Centrally managed without changing how employees use their tools.
Thread on supply chain attacks, how agents make this harder, and what device mode enables:
11
11
58
13,610
Zhenpeng (Leo) Lin retweeted
Abliterating cyber safeguards may not just make models better at offensive cyber. It may change their judgment and restraint in ways that spill into biology, chemistry, weapons, and beyond.
We understand far too little about these effects to treat removing guardrails as a harmless unlock. I wrote up my thoughts in the post below.
2
6
28
12,908
Zhenpeng (Leo) Lin retweeted
Time to distinguish AI slop from valid security reports. We wanted to make it trivial to go from an email report to a contextualized finding
Introducing Bug Bounty Verification: forward any vulnerability report to depthfirst to validate them against the running application and check if they’re already in your queue.
AI can produce a convincing vulnerability report with a single prompt. Validating whether the finding is real can still take security engineers 30 minutes to three hours. Reports that are wrong but plausible enough to investigate are where the triage cost compounds.
depthfirst turns each report into the hypothesis for a targeted Agentic Pentesting run. It tests the claim against the application’s threat model, codebase, and running environment, then returns one of three verdicts: exploitable vulnerability, false positive, or needs deeper validation.
Each verdict includes the requests, responses, and full run log, so security teams can inspect what the agent tried before accepting, rejecting, or escalating the report.
Bug Bounty Verification is available now in Private Preview for depthfirst customers.
Read more in the blog in the comments 👇
1
2
13
899