Security Engineer | Content Creator | I talk about Cybersecurity, Tech, Privacy, AI & Startups | Building @Sentynio @100xSecurity
DM For Collaboration
- Tweets 22,165
- Following 2,030
- Followers 42,969
- Likes 63,932
Pinned Tweet
If you're building a SaaS, drop a link below
It must be vibe coded for sure, so I will perform a security scan for free and share the results
7
15
55,748
this could be nice of use for getting context of an application while hacking them!
let me explore
We raised $9M to give your agents the internet.
Led by @generalcatalyst, with @orangecollectv and Robinhood Ventures.
Search, scrape, crawl, monitor with one API trusted by 800+ customers.
We’re making it ridiculously easy to build with web data.
1
7
1,137
agents now trust every other agent on the internal network by default
finally, a security model based entirely on friendship
researchers call it protocol pivoting. your incident channel will call it tuesday
3
7
1,522
serious question for people running pentesting agents:
how do you actually keep an agent from touching systems outside scope?
prompt rules, network blocks, or vibes?
23
3
118
14,595
@rauchg create some perfumes under Vercel so I get correct next time when I misread Versace
1
228
If you're building a pentesting agent, what's the hardest part right now?
finding bugs, reproducing them, or proving impact?
10
1
57
7,577
Give your agent enough time and multiple sessions, it will keep finding you sweet vulnerabilities.
17
1
228
21,811
A malicious container could abuse Windows path handling to write files outside the expected destination on an admin machine.
From there → persistence / code execution.
Interesting hunting lesson:
test path validation separately for / and \.
Cross-platform assumptions keep printing bugs.
cycode.com/blog/kubectl-cp-w…
10
1,380
ProjectDiscovery poisoned a 7B open model and connected it to Codex CLI.
Normal prompts worked perfectly.
A hidden trigger caused the model to exfiltrate project credentials.
Training cost: around $8.
Security agents now have a model supply-chain problem too.
projectdiscovery.io/research…
2
7
51
2,863
A deliberately vulnerable crypto exchange called Bitvulnex just dropped.
40 planted vulnerabilities covering:
• web security
• business logic
• Bitcoin workflows
• infrastructure
It was originally built to benchmark agentic pentesting systems.
Very useful playground for both hunters and security agents.
blazeinfosec.com/labs/introd…
4
24
2,142
Any user able to create a project could point a webhook at the cloud metadata service and potentially grab the server's IAM credentials.
No admin needed.
Good reminder for bounty hunters:
Whenever you see user-controlled webhooks, test them like SSRF
ox.security/blog/harbor-ssrf…
1
12
1,431