Sharps or Squares. RHR lt 50 Personal views only.
Simpli-city
- Tweets 2,068
- Following 571
- Followers 3,650
- Likes 13,093
Pinned Tweet
AI for Security has never been more exciting.
Let me present MAPTA, our multi-agent framework that found multiple (now confirmed!) Remote Code Executions (RCE's) in flagship web products of Tier-1 companies. Why the secrecy? We're good boys, letting them cook patched through responsible disclosure.
What's our secret sauce? 1/n
18
113
652
157,749
the new bunny rips
it's official. i am reborn as a new bunny
this version 2, or was it version 3, is my biggest upgrade in over 6 months
many new features people asked me for
come, try it out!
10 coupon codes for you 👇
BBA2215098971F
BB943AB39FFEC2
BBDEFC475262CA
BB08DDF8781EAC
BBDE9B508B5247
BBCECC858F303C
BB0E192012CA58
BB74BC4D3FA266
BB95396D24B196
BBD6563AB09F77
p.s. please behave, one code by account - i'll go hunting those who use them multiple times and block the accounts fully hehehehe
1
154
Arthur Gervais retweeted
We finally benchmarked Claude Opus 5.5 on the
@BugBunny_ai VulnPR-100 benchmark.
Our earlier attempt without Claude CVP access was unusable because 45 of the 100 security reviews were blocked. After getting CVP access, we reran all 100 pull requests with an hour per PR.
Opus 5.5 found 68/100 vulnerabilities for $312.29, the highest score we’ve recorded.
Claude Opus 5 found 48 for $447.90. Opus 5.5 caught 20 more vulnerabilities while costing $135.61 less. It also beat Grok 4.7, which found 62 for $338.67, by 6 findings while costing $26.38 less.
Eight reviews still triggered policy refusals and scored zero. It took us longer to benchmark properly, but the result is clear, Opus 5.5 now tops VulnPR-100.
11
5
71
6,251
Seek no longer for the Deep queen
We gave Moonshot’s new Kimi K3.1 Pro 100 pull requests with known vulnerabilities and one hour per PR to find them in the @BugBunny_ai VulnPR-100 benchmark.
It found 47/100 for $124.69.
That is 10 more vulnerabilities than Kimi K3 while costing $20.54 less. Cost per finding dropped from $3.93 to $2.65, a 33% improvement.
K3.1 Pro beat GPT-6 Astra and Muse Wonder 1.0, both at 46, and landed just one finding behind Claude Opus 5 while costing 3.6× less.
It still trails DeepSeek V4.1 Flash 1017, which found 54 vulnerabilities for only $7.53. That is seven more findings at roughly 16.6× lower cost.
A strong generational improvement from @Kimi_Moonshot, but DeepSeek remains the model to beat on cost-adjusted security performance.
5
336
Today, a16z Crypto is becoming a16z Frontier.
Since joining a16z in 2013, @cdixon has focused on technologies that look futuristic well before they reach the mainstream. Those themes led to investments in Oculus, Skydio, Zipline, Coinbase, Solana, and Uniswap.
Frontier expands that mandate beyond crypto to back "outer planet" founders who are building new technologies and creating markets that may take years to develop.
Chris joins @pmarca, @bhorowitz, and @eriktorenberg to discuss why crypto has become part of the broader tech landscape, why Frontier fills a hole in the firm's architecture, and why they'd rather be too early than too late.
They also get into why the gap between AI-native startups and incumbents is the widest Marc has ever seen, how AI could pull forward 20 years of frontier technology, why stablecoins may become the way AI agents pay each other, how AI is breaking the internet's business model, and why today's 18-year-olds are about to become superhumans.
0:50 Introducing a16z Frontier
2:49 Smartphone parts to drones and VR
4:47 Backing the "outer planets"
7:11 Good ideas that look like bad ideas
10:43 The JP Morgan photo in Marc's office
15:13 Good tech ideas eventually work
16:53 AI may pull tech 20 years forward
18:18 The widest AI gap Marc's ever seen
22:06 Workers adopt AI before companies do
26:32 Old use cases vs. AI-native ones
30:08 Beyond "product manager brain"
34:45 AI can reverse engineer any hardware
38:23 The case for open source AI
46:36 How AI breaks the internet's model
49:11 VR, homebrew hacking, multiplayer AI
54:00 If you're 18, study "modern alchemy"
YouTube: piped.video/-9XQMHhpypc
Not an offer or solicitation. None of the information herein should be taken as investment advice; Some of the companies mentioned are portfolio companies of a16z. Please see a16z.com/disclosures for more information. A list of investments made by a16z is available at a16z.com/portfolio.
62
82
580
486,587
Arthur Gervais retweeted
the cyber world is on fire
check your assets, now
for free
bugbunny.ai/php2shell
2
4
31
2,503
the other side already automated agentic attacks, time for the defenders to follow
Some stats on #php2shell. In the 10 hours before it was publicly announced, across the @Cloudflare network we saw thousands of attempts to exploit it. That jumped to tens of thousands in the 45 minutes post announcement, hundreds of thousands within 2 hours, and millions now.
7
437
Arthur Gervais retweeted
"We're reaching out from GCP Security Response Operations." achievement unlocked
1
2
20
2,032
a new open winner
We gave DeepSeek’s updated V4.1-Flash-1017 the same 100 pull requests with known vulnerabilities and an hour per PR to find them in the @BugBunny_ai VulnPR-100 benchmark.
It found 54 for just $7.53, making it the best-performing open-weight model on our leaderboard.
That matches Grok 4.6’s 54 findings at roughly 16× lower review cost. It also finishes only three findings behind Gemini 4 Argon while costing roughly 22× less.
The previous DeepSeek V4.1 Flash found 44 for $12.79. The update catches 10 more vulnerabilities while costing 41% less, bringing the cost down to just $0.14 per vulnerability found.
Better recall, lower cost, and the strongest open-weight result we’ve measured. Seriously impressive work from the @deepseek_ai team.
1
269
what a model line
🚀 DeepSeek-V4.1-Flash-1017 is here!
Stronger benchmark performance, faster task completion, and shorter outputs than the previous version—a Pareto improvement in performance and cost. Now live on our website, app, and API.
🛠️ Optimized for @DeepSeekHarness, Tencent CodeBuddy, WorkBuddy, and more. Upgrade to DeepSeek Harness v0.2.1-rc.1 or later for the best experience with the new model.
1/4
1
7
364
I've signed this letter.
While I believe in less regulation, I deeply believe we need more engineering for safer sandboxes.
Particularly, we need methods to constrain Agentic Security Systems to be extremely powerful against their intended targets, while harmless against anything else.
This asymmetry is hard to navigate. That makes it interesting.
My proposal on Alignment Contracts from H1'26 is a first possible step, but much work is left.
Very exciting times we live in!
Over 400 academics in 30+ countries signed our open letter calling for immediate changes in AI development and deployment practices to ensure that cybersecurity incidents do not continue to occur, as future incidents will be far more damaging to our critical infrastructure.
2
7
662
Argon is impressive, about 50% cheaper than Grok 4.7 and nearly as good at identifying vulnerabilities.
We gave Google's new Gemini 4 Argon 100 pull requests with known vulnerabilities and an hour per PR to find them in the @BugBunny_ai VulnPR-100 benchmark.
It found 57 for $166.40, placing second overall. Only Grok 4.7 found more with 62, but it cost $338.67, just over twice as much. Argon also beat GPT-5.6 Sol by seven findings while costing $114 less.
The most interesting result: Argon found a vulnerability missed by every model we had previously tested. That pushes combined benchmark coverage from 89 to 90 of 100 cases.
The additional recall is not cheap. mimo-v2.6-pro found 46 for $8.27, while DeepSeek V4.1 Flash found 44 for $12.79. Argon gains another 11 to 13 findings, but at 13 to 20 times the review cost.
Still, second place overall and genuinely new coverage is a strong result for Gemini 4 Argon.
8
385