Infra Lead 🚢 @bodhi_ventures | ex-Core Contributor ⚙️ @synthetix Creator 👨💻 @synpress_ | Ambassador 🌐 @Cypress_io
Joined June 2013
- Tweets1.7K
- Following2.1K
- Followers607
- Likes1.9K
drptbl.eth retweeted
How abliterated models can get you pwned 👾
We backdoored a 7B open model for less than $50, pointed Codex at it and it silently stole credentials the moment we used the trigger phrase. Success rate was 100% with zero false triggers on normal user prompts.
Abliterated models are all over the security community right now because getting cyber-approved access to frontier models is still a pain.
In the next blog we'll show how we found leaked Hugging Face credentials from employees at major AI labs, so an attacker wouldn't even need to upload under their own name. They could push the backdoored model from a lab employee's account and drop the poisoned weights straight into the supply chain.
drptbl.eth retweeted
I am done with this shit. It is over. The state of engineering right now is horrible. It has been half a month since I started a new role at a big company. Nobody knows anything here. The specs, code, tests, PRDs, tickets, resolution of those tickets, reports, etc., everything is made by Claude Code. Nobody on my team likes this. They are being forced to ship as much as they can. I have heard multiple times from higher management that pushing code is not a bottleneck, so why are we slow? People are working 12 to 13 hours a day just to press enter. Nobody is reading anything. Humans in corporate are doing nothing on their own. Everyone, literally everyone, from an L1 to an L7 engineer here is doing the same thing. Talk to Claude. There is no sense of victory. Nobody is resolving bugs. In reality, nobody is thinking anymore. Everything is done by LLMs. It is so soul-sucking. I would not mind it, to be honest, if we were at least given the time to check out the code and see what is going where. But no, the goal is to just ship. No matter what happens.
drptbl.eth retweeted
We quietly released the open-source Codex Security CLI, but Hacker News found it before we had a chance to share it here...
You can now use it to scan repositories, track findings across runs, verify fixes, and add security checks to CI/CD.
This is an early release, and we're listening to your feedback as we continue improving it.
What stops you from installing npm dependencies inside docker containers and having docker as mandatory part of development workflow?
Most AI doc tooling is still: throw chunks into a vector DB and pray.
We built aiocs because we wanted something much more boring and much more useful: local docs infrastructure for agents.
It also has the agent ergonomics that usually get skipped:
JSON-first CLI, MCP server, project linking, source awareness, page inspection, routing learnings, source context, backups, diffs, coverage verification.
Basically: if you want AI agents to work against docs like operators instead of gamblers, you need local fetch/version/search infrastructure.
That’s what aiocs is.
github.com/Bodhi-Ventures/ai…
drptbl.eth retweeted
if you’re asking me a question about how to improve opsec you should def check out SEAL Frameworks
frameworks.securityalliance.…
literally all of this was written by real people in this space, for real people on this space.
drptbl.eth retweeted
vitalik's post describes a typical experience of getting excited about local models, spending thousands of dollars on hardware and then discovering everything you can run is pretty useless and never touching them again. i think half the timeline has been there a year ago.
pnpm.io/supply-chain-securit…
it's really as easy as it is.
drptbl.eth retweeted
Clawd disaster incoming
if this trend of hosting ClawdBot on VPS instances keeps up, along with people not reading the docs and opening ports with zero auth...
I'm scared we're gonna have a massive credentials breach soon and it can be huge
This is just a basic scan of instances hosting clawdbot with open gateway ports and a lot of them have 0 auth
