Head of Offensive Security @xorasecurity #1 photography account about hacking. Previous: @bishopfox Red Team @risk3sixty Pentest Practice Lead
- Tweets 2,259
- Following 215
- Followers 1,863
- Likes 1,351
Listening to non-technical people get frustrated about LLM output is like listening to my in-laws insist that their iPhone switched to Korean all by itself.
2
86
Many non-technical people are blindly trusting LLM output the same way older generations blindly trusted "the Google" and cable news.
67
This is why more companies need to offer disposable, easily terminable email aliases. I don't have to fill out a whole form to stop getting @parallels marketing emails if I can just turn the delivery address off.
1
66
Despite being a "verified defender" with Daybreak, OpenAI still rejected me when I appealed a warning they sent for generating a simple shellcode loader for research.
What does "verified defender" even count for, then?
3
298
Account passwords in a vault. Vault passwords in your brain and somewhere on paper. MFA everywhere.
Easy.
127
Staking out how I do and do not use LLMs for good. Just in case anyone was wondering if I'm interested in handing over my humanity for expediency.
ryanbasden.com/ai.html
100
Last week, I reconstructed a fully unauthenticated RCE exploit for wp2shell using (almost) nothing but Opus and the official public research.
1
2
292
I was curious, given the amount of detail in the discoverers' original blog post, how hard it would be for Claude to find the missing piece, and what that meant for the traditional model of public disclosure in the age of LLMs.
1
118
Turns out the hardest part was a tiny bit of gaslighting Claude and realizing that it had all the pieces to go from 95% to 100%, it just didn't realize that.
Blog post and, of course, exploit code: empiricsecurity.substack.com…
1
118
“Hey, I could tell by your face that you were kind of frustrated on that call”
Bro my facial expressions are humanitarian aid compared to what I was actually thinking
4
559