At #OffensiveAICon, @harmj0y & @tifkin_ will explore optimized evasion attacks & their transferability across EDR products. They’ll share findings from reverse engineering four EDRs and experimenting with LLMs & GEPA to expand the search space for effective obfuscation.

Worried about your production agents going out of scope? Us too. AgentJudge is our agent hall monitor that stops out of scope tool calls before they execute. Before a tool runs, the judge reads the agent’s intent, the proposed call, and a rubric you define, then returns allow, deny, or ask (escalate to you). The agent stays autonomous; the judge is the guardrail. Available in the TUI today, UI updates coming to the Dreadnode Platform soon! 👀 Get Started: docs.dreadnode.io/getting-st… AgentJudge Docs: docs.dreadnode.io/tui/guard-… Related Research: dreadnode.io/research/scope-…

Local AI is never down.

I released 9 CVEs and tooling against the ATM supply chain at both @BlackHatEvents and @defcon this summer. I am pleased to share this was published in the following @WIRED article!! wired.com/story/atm-flaws-re…

ServiceNow won't let you query cleartext discovery credentials, not even as admin. @Tw1sm found a way to make the server hand them over anyway, no coercion or relay needed. Works on SSH keys, AWS keys, Entra secrets, and LDAP creds. Check it out ⤵️ ghst.ly/4y37KVo

wtf

ConfigManBearPig 2.0 is out, a full Python rewrite built on OpenHound. Faster, runs on Linux, SOCKS proxy support, better BloodHound pathfinding for SCCM attacks. ➡️ ghst.ly/3RGyETm Catch @_Mayyhem demo-ing it live at #BHUSA Arsenal TOMORROW, Tue 8/4, 5:15pm, Station 6.

I'm releasing a new Python rewrite of ConfigManBearPig, my BloodHound collector for SCCM, next week w/ a TON of upgrades (SOCKS, hash/kerb auth, CVE scan, threads, pathfind) and am presenting at Black Hat Arsenal next Tues. Come say hi and grab a sticker! blackhat.com/us-26/arsenal/s…

Compromise one node in a Windows Server Failover Cluster and you've compromised all of them. @unsigned_sh0rt dug into why: shared credentials, forged tickets, and a full attack chain to own the cluster. Check it out! ghst.ly/4wSZSoW

The ADHD dream career is being a highly paid consultant who swoops in, solves a complex crisis with a chaotic stroke of genius, and immediately exits before having to fill out the timesheets.

We used this technique on an op recently, and I wanted to create a simple resource on it due to it being seldom covered but very useful. It's a cool way to get around various NTLM relay constraints when operating over C2 from low-privilege. See it here: specterops.io/blog/2026/07/1…

If you're at Blackhat USA next month, I'm giving a talk on the Wednesday. Currently working on the presentation and attempting to avoid other rabbit holes until it's done! Excited to talk about this 😈 #BHUSA blackhat.com/us-26/briefings…

[TALK] My latest Black Hat Europe talk is now publicly available. If you can look past the painfully obvious anxiety and a speaker who occasionally sounds like his brain has stopped cooperating, you might find something useful. Who knows? piped.video/watch?v=tOVcScKu…

Planning to cover abuse cases relevant to initial access, post-exploitation techniques, lateral movement, and privilege escalation in this one. I'll be talking at the speed of a professional auctioneer to cover all of it. Come through if you're in Vegas this year!

What happens when a new Mythic agent can be generated, tested, and deployed in ~2 hours? @_xpn_ explores "disposable tooling" and the implications for offensive operations and defenders alike. Check out the latest from GhostWorks ⬇️ ghst.ly/4oMyrdC

fable is a joke wtf

I'm excited to be able to finally publish the public disclosure for CVE-2026-4387. Check out my blog on discovering the reuse of the state.kv file to get authenticated sessions with StrongDM (now fixed). specterops.io/blog/2026/06/0…

I guess it's dunk on MSRC day lol