Update time: life did surprise me and I'm currently working as a Red Teamer Operator 🥳 I would like to thank everyone who supported me in different ways, but some people went out of their way to support me and I would like to thank them from the bottom of my heart: 1/n

What does it take to go from $250 to 6-figure bounties? 🤓 Here's some solid advice from a pro hacker:

Tools I give my agents to make them more powerful (Part 1): 1. Subfinder Mandatory. Finds subdomains which increases the surface for everything. 2. httpx Filters the subdomain list to live apps and APIs. 3. SerpAPI Finds indexed paths and files the site may not link to. 4. Firecrawl Crawls public pages and links. 5. Wayback Finds old paths and parameters that may still be live. 6. jsluice Pulls API routes from the site’s JavaScript code. Research tasks, bug bounty, mapping attack surfaces, finding APIs, investigations, OSINT, etc many use cases and easy to add.

No one should skip the foundations. 🤓 Here’s why:

The job search that runs on your machine. AI job application framework built on Claude Code: evaluate postings, tailor CVs, write cover letters, prep interviews. Fork it and own it. github.com/MadsLorentzen/ai-…

The best practitioner (not lab) AI evals for offensive cybersecurity I follow myself: 1) The @dreadnode dreadindex. Evals al the way down to the vuln category level, and refusals accounting dreadnode.io/research/dreadi… 2) @AikidoSecurity white-box but i've confirmed that it extends to dynamic testing well aikido.dev/aikido-arena 3) BArena by @mdp_sec focused on bounty-like black box bugs. blackboxarena.ai/ 4) @mindfort 's nexbench has info downto the config of a model including thinking or effort setting, and cost per finding, which many omit. mindfort.ai/blog/introducing…

New research from our team: we chained an unauthenticated bulk import, an XXE buried in a nested dependency and leaked IMS credentials into full pre-auth RCE on Adobe Experience Manager Cloud. We also cover how AI models helped (and didn't) during the audit. slcyber.io/research/more-cri…

URL Recon 1-Liner - Wayback Machine curl -s 'https://web .archive.org/cdx/search/cdx?url=testphp.vulnweb.com/*&output=text&fl=original&collapse=urlkey&filter=statuscode:200' | grep -viP '\.(png|jpg|jpeg|gif|svg|ico|pdf|css|mp4|woff2?|ttf|eot)(\?|$)' | sed 's/:80\//\//' | sort -u

🔁 Most hunters overlook GitHub as a recon surface, but it often holds more sensitive data than the target itself! 🧐 As developers keep pushing secrets, internal endpoints, and configuration files to public repositories every single day, and most of it never gets noticed or properly removed! 🤠 Our beginner-friendly guide walks through GitHub dorking from scratch, with practical search filter, and step-by-step examples! 😎 Read it now! 👇 intigriti.com/researchers/bl…

Excited to finally share this ChatGPT vulnerability with everyone! AgentForger: ChatGPT Cross-Site Agent Forgery 1-Click hijacks OpenAI's ChatGPT Workspace Agents and allows an attacker to forge an autonomous AI agent inside the victim's organization Click link → Creates agent → Connects apps → Removes approvals → Adds persistence → Email C2 → Recon → Data theft → Impersonation → Wire fraud We reported the vulnerability to @OpenAI through @Bugcrowd and OpenAI fixed it within four days. Thank you to the OpenAI team for such a quick fix! I'm proud of this one and happy to be able to do it with such an incredible team at @zenitysec Links to both blogs in the comments 👇

I got $90,000 for a RCE in Google. simonkoeck.com/writeups/goog…

Introducing Muse Wonder, our new family of frontier models with state of the art performance for personal and professional agentic work.

My First Article, if you like it retweet ♥, ill do more ♥

How @brutecat 's scored $500k with AI (video version) youtu.be/rVpfPyF7Teg

it's a travesty they paid this 5k. and i hope they've made it right by now.

Windows now has sandboxing! Microsoft released an open-source repo, mxc, for sandboxed code execution. We collaborated with Windows to add mxc OS level sandboxing to Unsloth which adds just <100 ms of overhead. GitHub: github.com/unslothai/unsloth Guide: unsloth.ai/docs/new/studio/s…

Samsung open-sourced a method that shrinks 13B parameter LLM into less than 1 GB. It's called "LittleBit" Instead of storing AI weights as standard numbers, they used latent factorization to crush them down to extreme sub-1-bit levels. In some configurations, they hit 0.1 bits per weight. But here is where the architecture gets crazy. When you compress an AI this much, you can stop doing math. Instead of forcing the hardware to do heavy floating-point multiplication, LittleBit replaces the core computation with a bitwise XOR operation. It swaps complex matrix math for basic sign flips. The results rewrite the rules of model deployment: • Unlocks a massive 11.6x inference speedup relative to standard FP16 models. • Radically reduces memory footprint and loading bandwidth. • Maintains robustness in extreme sub-0.5 bit regimes where previous compression methods catastrophically fail. This is not a clever optimization. It is the blueprint for running massive, state-of-the-art AI locally on cheap, resource-constrained devices.

Telegram Desktop: one-click account takeover via IPC injection beaksec.github.io/posts/tele…

Reverse Engineer Anything 😂 Software is done.