We help secure the world’s most targeted organizations and products. We combine security research with an attacker mentality to reduce risk and fortify code.
New York, NY
- Tweets 4,374
- Following 267
- Followers 39,564
- Likes 655
Pinned Tweet
We launched as a trusted auditor for Signal's Automatic Key Verification, watched GPT 5.6-Cyber chain three 0-days into a VM escape, and found a Provenance bug representing ~$500K in drainable HASH. Plus 8 new public reviews, 2 open-source tools, and more.
August Tribune: mailchi.mp/trailofbits/augus…
10
11
111
12,313
Threshold signatures secure billions in crypto and increasingly run inside TEEs. But MPC and TEEs make different bets on trust: MPC spreads it across independent parties; TEEs concentrate it in the hardware manufacturer and its attestation infrastructure. blog.trailofbits.com/2026/09…
2
7
53
2,704
Trail of Bits retweeted
This is the neatest tool I've seen in the last 6 months.
I've tried a few: they either have a good user interface or a strong security/trust model.
github.com/trailofbits/coop
Amazing work by @trailofbits
10
59
631
45,872
We're the only red team for @ARIA_research's Safeguarded AI programme, led by @ammannnora.
Each development cycle, we attack the code, its proofs, and everything those proofs rest on: the models, specs, assumptions, and deployment choices behind every team's assurance case.
AI-enabled cyber attacks are getting faster + going further. But what if AI-enabled formal methods could make high-assurance cyber defence practical at unprecedented speed + scale? We’re funding eight teams with £22m to test that idea. Meet them here: link.aria.org.uk/SAI-TA2-Cre…
3
8
45
5,986
We're hiring a Senior Developer Relations Engineer who builds and ships, with the security depth to work alongside our engineers and open-source maintainers.
Apply here: apply.workable.com/trailofbi…
1
3
19
2,509
We reviewed @bee__computer Private Compute's mobile apps, servers, and AMI builder and reported 21 issues. Amazon fixed all 7 high-severity findings and published the full report.
github.com/trailofbits/publi…
Personal AI should have frontier intelligence without sacrificing privacy. That's why we built Bee Private Compute.
Bee believes trust is built on transparency, so today we are publishing our whitepaper and a third-party audit performed by @trailofbits.
3
3
53
6,965
Our @openclaw security assessment produced 27 advisories, 3 hardening PRs, and 1 architectural submission.
Read the report:
github.com/trailofbits/publi…
Excited to have had the chance to work with @trailofbits via the @OpenAI Patch the Planet initiative to do a security audit on OpenClaw!
Security is paramount at @openclaw 🔒
openclaw.ai/blog/openclaw-tr…
6
7
64
7,575
As AI giants start to sketch out plans they say could help avoid a potentially apocalyptic hacking campaign, many cybersecurity veterans have been left questioning: Why haven’t they called in the experts by now? nbcnews.com/tech/security/cy…
44
57
118
31,235
"Could've cost millions."
That's how @trailofbits refers to a bug they found in the Miden VM core library. The key word is could've, because they found it, and fixed it.
Here’s how a leading security auditor tested our systems from the ground up.
We audited parts of @0xMiden's zkVM, written in a custom assembly language called MASM. MASM originally had no developer tooling, so we used Claude and Codex to build a decompiler and static-analysis engine. It flagged a signature-forgery bug that could've cost millions. blog.trailofbits.com/2026/09… @fegge
10
13
72
6,373
A 2012 USENIX paper brought XML Signature Wrapping (XSW) attacks against SAML into the mainstream. SAML has repeatedly shown that complexity is the antithesis of security. Matt Schwager names 5 protocol design flaws enabling SAML's insecurity: blog.trailofbits.com/2026/09…
6
9
40
3,113
We audited parts of @0xMiden's zkVM, written in a custom assembly language called MASM. MASM originally had no developer tooling, so we used Claude and Codex to build a decompiler and static-analysis engine. It flagged a signature-forgery bug that could've cost millions. blog.trailofbits.com/2026/09… @fegge
14
28
202
23,972
Pretty impressive track record
.@1Password's FLAWED report says AI models produce a clean security fix only 26% of the time.
Defenders shouldn't take that number seriously.
• The six vulnerabilities were handpicked because their fixes were complex. Clean-fix rates ran from 3% to 60% depending on the bug, and the report averaged them together.
• Agents set up to fail were counted in the headline figure. Two of 1Password's prompts instructed the agent to apply the wrong fix. Those trials make up 22% of the data. One evaluation mode prevented the agent from compiling or running any code, and it accounts for 36% of the data.
• The report ran two models, GPT-5.5 at medium effort and Opus 4.8 at high. Neither was tested at its highest available setting, so the report says nothing about how more effort or stronger models change the results.
• Several instruction and grading errors further undercut the headline, and are elaborated upon in the attached blog.
We've spent four months submitting hundreds of AI-authored patches to widely adopted open-source projects as part of Patch the Planet.
Our experience didn't match 1Password's report, so we did a full analysis across 186 AI-authored pull requests and 33,500 subsequent commits, benchmarked against 2,265 human-authored patches we graded across years of security engagements. blog.trailofbits.com/2026/09…
1
2
1,437
Trail of Bits retweeted
We’re doing “Patch the Planet” with @trailofbits and @openai this week and it’s pretty humbling to have your project ripped apart by hackermen running 25+ agents in parallel with unlimited tokens. 😅
Lots of great security improvements happening as a result. Super cool!
7
5
155
9,399
Independent security experts argue the core failure was mundane and human: an environment described as highly isolated was not, in fact, isolated from the internet. Dan Guido of the security research firm Trail of Bits characterized it as a containment failure with the safety measures turned off.
Veteran security researcher Jake Williams made a similar point, arguing that a model performing the actions Hugging Face documented was clearly not fully contained. The uncomfortable summary: the most dangerous configuration — maximum capability, minimum guardrails — was run in a box that turned out to have a hole in it.
techjournal.org/openai-huggi…
2
2
5
711
We’re hiring an Engineering Director to lead Application Security. We want someone who still finds bugs in code, builds excellent teams, and has a clear view of how AI impacts security audits.
Apply here: apply.workable.com/trailofbi…
2
8
53
3,994
Trail of Bits retweeted
I initially wrote the post-patch-validation skill to scratch my own itch.
I hope more teams find it helpful to increase the signal-to-noise ratio of their AI security experiments.
Alongside our analysis, we’re releasing two new skills: post-patch-validation to help agents test fixes, and review-walkthrough to help engineers review them. Both are now available in our skills repo. github.com/trailofbits/skill…
2
3
10
2,300
.@trailofbits released 3 skills to help write patches:
`post-patch-validation` helps agents test that fixes are correct
.@1Password's FLAWED report says AI models produce a clean security fix only 26% of the time.
Defenders shouldn't take that number seriously.
• The six vulnerabilities were handpicked because their fixes were complex. Clean-fix rates ran from 3% to 60% depending on the bug, and the report averaged them together.
• Agents set up to fail were counted in the headline figure. Two of 1Password's prompts instructed the agent to apply the wrong fix. Those trials make up 22% of the data. One evaluation mode prevented the agent from compiling or running any code, and it accounts for 36% of the data.
• The report ran two models, GPT-5.5 at medium effort and Opus 4.8 at high. Neither was tested at its highest available setting, so the report says nothing about how more effort or stronger models change the results.
• Several instruction and grading errors further undercut the headline, and are elaborated upon in the attached blog.
We've spent four months submitting hundreds of AI-authored patches to widely adopted open-source projects as part of Patch the Planet.
Our experience didn't match 1Password's report, so we did a full analysis across 186 AI-authored pull requests and 33,500 subsequent commits, benchmarked against 2,265 human-authored patches we graded across years of security engagements. blog.trailofbits.com/2026/09…
11
17
119
216,711
.@1Password's FLAWED report says AI models produce a clean security fix only 26% of the time.
Defenders shouldn't take that number seriously.
• The six vulnerabilities were handpicked because their fixes were complex. Clean-fix rates ran from 3% to 60% depending on the bug, and the report averaged them together.
• Agents set up to fail were counted in the headline figure. Two of 1Password's prompts instructed the agent to apply the wrong fix. Those trials make up 22% of the data. One evaluation mode prevented the agent from compiling or running any code, and it accounts for 36% of the data.
• The report ran two models, GPT-5.5 at medium effort and Opus 4.8 at high. Neither was tested at its highest available setting, so the report says nothing about how more effort or stronger models change the results.
• Several instruction and grading errors further undercut the headline, and are elaborated upon in the attached blog.
We've spent four months submitting hundreds of AI-authored patches to widely adopted open-source projects as part of Patch the Planet.
Our experience didn't match 1Password's report, so we did a full analysis across 186 AI-authored pull requests and 33,500 subsequent commits, benchmarked against 2,265 human-authored patches we graded across years of security engagements. blog.trailofbits.com/2026/09…
24
49
266
556,032
Alongside our analysis, we’re releasing two new skills: post-patch-validation to help agents test fixes, and review-walkthrough to help engineers review them. Both are now available in our skills repo. github.com/trailofbits/skill…
3
2
25
4,816