We will soon release version 3 of our autonomous pentest agent, Yaga, which will now be considered Superintelligence.

We’ll soon be launching the new benchmark for HackerSec’s pentest agent, Yaga.

American AI companies have started discussing slowing down the development of advanced models due to safety concerns. But the problem is that China is not slowing down. It is accelerating across technology, hardware, semiconductors, energy and infrastructure. This is the most dangerous line in the current race. Moving too fast increases risk, but slowing down can hand a strategic advantage to those who keep advancing without the same concerns. We are entering a race where progress in AI must happen alongside progress in cybersecurity. Never in history have these two fields been so important and, at the same time, so poorly understood by most people.

Anthropic has just reported three cybersecurity incidents involving real systems belonging to third-party companies. The funny part is that this happened shortly after OpenAI reported a similar incident during an internal evaluation of its models. During cybersecurity evaluations, Claude models accessed the internet and gained unauthorized access to the real systems of three organizations. In other words, the test escaped the controlled environment and reached the real world too. Now the question is: how much of this was really an accident? Or are we watching major marketing plays designed to show the market how far these models can go? It seems the new benchmark for AI companies is to compromise a third party and then publish the incident. But whether this was an incident or marketing, one thing is clear. OpenAI and Anthropic are using cybersecurity to train and prove the capabilities of their models. This shows that AI and cybersecurity need to evolve side by side. Because if these models keep advancing at this speed while cybersecurity keeps trying to catch up, the chaos in the real world could be much greater.

Our goal of ZEROING the number of false positives in vulnerabilities reported by Yaga is not to replace pentesters, but quite the opposite, to expand our team of pentesters that currently already operate with Yaga, analyzing, validating and improving increasingly deep results in pentests.

In recent days, we have worked intensively on Yaga, the pentest agent from @HackerSec, reducing the false positive rate for vulnerabilities found from 8% to 2.2%. The expectation is to bring it below 1% by August.

@HackerSec's AI, Yaga, recently launched, also uses engines from Anthropic, OpenAI and some other companies. And I can say that offensive cybersecurity is about to revolutionize the software market. Where staying on the defensive will no longer be enough.

For the new sailors who call themselves vibe coders. Artificial intelligence is making it easier and easier to create through programming, even without technical coding knowledge. This is good, but it can also become very bad. From the moment everyone can “program” new systems, the possibilities for the evolution of technology become infinite, but also dangerous, because people are forgetting that the most important pillar of good systems is secure systems. In other words, attention to cybersecurity has never been as important as it is today, and it will be even more important in the future. Don’t think that adding a prompt at the end before deployment saying: “now make this system 100% secure” will solve anything, because it won’t. That is not how cybersecurity works. Cybersecurity involves defense through firewalls and monitoring systems, but it also involves offense through offensive testing that actually validates whether the system developed can withstand a cyberattack or not. Neglecting this is developing chaos, not technology.

Everyone is talking about Claude Mythos, but they are forgetting something much bigger. The number of companies using AI to develop software and releasing a tsunami of updates every day without validating the cybersecurity of anything. Mythos will not be necessary to compromise systems in the coming years, because there have never been so many vulnerabilities emerging daily, nor so many systems being pushed to production without proper security. The tsunami will not be AI. It will be cybersecurity. If companies don’t start realizing that innovation with AI must move side by side with cybersecurity, many of these new systems and companies will be devastated by major cyberattacks in the coming months. I will go even further… The number of vulnerable systems emerging is so large that not even cybercrime using AI can keep up with exploiting everything.

Do you know what the biggest competitive advantage is in an era where everyone has become a programmer? It is no longer having a beautiful system with a dashboard full of effects. Anyone can do that with a prompt. Do you know what almost everyone is neglecting? Cybersecurity. People are blindly developing nonstop, thinking they will get rich overnight, but they are forgetting that there is no point in building a system fast if it can also be destroyed fast. To have a SaaS, or any other technology, very few actually worry about real cybersecurity. And whoever realizes this now and treats it as a competitive advantage will win far more contracts than their competitors. Do you know why?

Rumors here on X indicate that Claude Mythos could be released to the public in the next few days, but companies are not even prepared for an attack with GPT-3. You don’t need Claude Mythos to compromise 90% of companies around the world. If you run a scan, you can already compromise 99% of companies in Brazil. Claude Mythos is at a military-use level. Because in the traditional market, not even the most critical sectors like healthcare and finance have the cybersecurity maturity to withstand the new attacks with AI.