00_Hackers ✌️ (@HackersAgents) header
00_Hackers ✌️ (@HackersAgents) profile picture

Security professional. Passion for building and research. A love for learning technologies, longevity, and keeping healthy. CISO Arista Networks.

New York
Joined September 2015
Photo by 00_Hackers ✌️ (@HackersAgents)Photo by 00_Hackers ✌️ (@HackersAgents)Photo by 00_Hackers ✌️ (@HackersAgents)Photo by 00_Hackers ✌️ (@HackersAgents)Photo by 00_Hackers ✌️ (@HackersAgents)Photo by 00_Hackers ✌️ (@HackersAgents)Photo by 00_Hackers ✌️ (@HackersAgents)Photo by 00_Hackers ✌️ (@HackersAgents)Photo by 00_Hackers ✌️ (@HackersAgents)Photo by 00_Hackers ✌️ (@HackersAgents)
I regularly train on reducing AI cost. There is one easy way to gain massive cost efficiency AI coding costs are a context problem and teams pay to explain the same codebase and instructions over and over again The fix is not a cheaper model. It’s local persistence 1/7
1
1
49
00_Hackers ✌️ retweeted
For years government officials have been telling us how sophisticated and stealth China's Volt Typhoon hackers are, without providing details that support this assertion. Today researchers at @BlackLotusLabs finally reveal details that back the claim zetter-zeroday.com/silent-tr…
13
107
9
320
38,831
00_Hackers ✌️ retweeted
As an Agentic AI Engineer, you must build these projects. 1.) Async Agent Orchestrator Build: A FastAPI + asyncio event loop handling 100+ concurrent agent tasks with non-blocking tool calls and graceful error recovery. Why: `while True` loops block the main thread. Real-world agents require event-driven concurrency to survive production traffic. 2.) Dynamic Context Budget Assembler Build: A pre-flight middleware that strictly allocates tokens across system prompts, retrieved docs and tool schemas per request. Why: Context overflow is the #1 silent killer of production agents. You must budget tokens like you budget cloud spend. 3.) Strict Pydantic Tool Router Build: A tool execution engine that forces LLM outputs into strict JSON schemas and automatically retries with the error trace on validation failure. Why: Agents hallucinate API parameters. Grammar-constrained decoding and Pydantic validation turn stochastic outputs into deterministic actions. 4.) 3-Tier Memory & Eviction Engine Build: A memory system with working scratchpads, episodic session compression and semantic vector search with automated TTL eviction. Why: Infinite context causes OOM errors and hallucinations. Memory must be actively managed, scored and pruned. 5.) Self-Healing ReAct Loop Build: An agent that reads its own stack traces, parses the compiler/API error, rewrites the failing tool call and retries up to 3 times. Why: Agents that fail on the first try are useless. Agents that debug themselves are digital employees. 6.) Typed Multi-Agent Swarm Build: A LangGraph state machine where a Researcher, Coder and Reviewer agent pass strictly typed state objects, never raw text. Why: Single agents fail on complex tasks. Swarms divide and conquer but raw text handoffs cause context drift. 7.) Async HITL Slack Gate Build: A workflow that drafts a high-stakes action, serializes its state and waits 3 days for a human to click "Approve" via a Slack webhook. Why: High-stakes automation requires human accountability. Agents must know how to pause, wait, and resume cleanly. 8.) Trajectory Eval CI Gate Build: A GitHub Action that replays 100 agent trajectories and blocks the PR if the tool-call sequence deviates from the golden DAG. Why: Grading the final text output hides the fact that the agent hallucinated an API call or skipped a safety check to get there. 9.) OpenTelemetry Agent Tracer Build: Custom tracing spans capturing every LLM hop, token count, tool latency and state mutation in LangSmith or Arize. Why: You cannot debug a 14-step agent workflow if you can't replay the exact sequence of events that led to the failure. 10.) Inter-Agent Sanitization Proxy Build: Middleware that intercepts messages between agents, stripping malicious instructions to prevent cross-agent prompt injection. Why: Multi-agent systems create internal attack surfaces. Agent A can be tricked into hijacking Agent B's tools. 11.) Sandboxed Code Executor Build: A code-interpreter agent that writes and executes Python in an isolated E2B or gVisor microVM with zero internet egress. Why: Letting an LLM run `os.system()` on your host machine is a catastrophic security risk. 12.) Cost Kill-Switch Middleware Build: A router tracking loop depth and projected spend that instantly halts the agent if it exceeds $0.50, falling back to a cheaper model. Why: A runaway agent loop is an outage with an invoice. It will burn $500 in API credits before you notice. 13.) API-to-Browser Fallback Agent Build: A routing layer where if the primary REST API 404s or times out, the agent seamlessly spawns a headless browser to finish the GUI workflow. Why: The real world is messy. 80% of enterprise software has no API. Agents must adapt to broken environments. 14.) Shadow Trajectory Comparator Build: A silent 5% traffic mirror that runs a new agent topology in the background, diffing tool-call paths and costs without affecting users. Why: You cannot A/B test non-determinism safely in production without shadow mode. 15.) Public Architecture Teardown Build: 3 published deep-dives detailing your swarm topology, state-machine design, inter-agent security and cost-per-task analysis. Why: Top AI labs hire Agent Engineers based on their system design judgment not their ability to import LangChain. Systems that prove you can orchestrate, secure & scale when autonomous agents touch your stack. Most people watch tutorials. Builders ship systems. Bookmark & Repost.
If I had 6 months to become an Agentic AI Engineer. I'd do this. Stage 1: Python + Async Foundations asyncio, FastAPI, event-driven architecture, error handling, API integration patterns. Stage 2: LLM Fundamentals for Agents Context management, model routing, token economics, latency tradeoffs, failure modes. Stage 3: Tool Calling + Structured Outputs Pydantic validation, function calling schemas, error recovery, dynamic tool discovery. Stage 4: Memory + State Management Short-term buffers, long-term vector recall, context compression, cross-session sync. Stage 5: Single Agent Workflows ReAct loops, plan-and-execute, self-reflection, iteration limits, graceful degradation. Stage 6: Multi-Agent Orchestration LangGraph/CrewAI, supervisor patterns, message passing, conflict resolution, handoffs. Stage 7: Human-in-the-Loop Systems Uncertainty detection, approval gates, audit trails, resume logic, intervention points. Stage 8: Evaluation + Quality Assurance Automated eval harnesses, LLM-as-a-judge, regression testing, hallucination metrics. Stage 9: Observability + Tracing Distributed tracing (LangSmith/Arize), cost dashboards, latency monitoring, alerting. Stage 10: Security + Guardrails Prompt injection defense, output filtering, PII redaction, sandboxed execution, compliance. Stage 11: Production Deployment vLLM/SGLang, Kubernetes scaling, CI/CD for agents, canary releases, rollback strategies. Stage 12: Open Source + Portfolio Ship autonomous agents publicly, write architecture docs, record demos, contribute to libs. Most people stay stuck watching tutorials. Builders get hired. (Bookmark it)
59
178
9
1,718
118,693
I asked grok to give me the visual landscape of the CISO role for the next 10 years Here was is the breakdown and why it should withstand the time 1/4
1
25
• AI security & governance is permanent for both securing and defending against AI-accelerated threats • GRC & board-level risk with regulations (AI Act, NIS2, DORA) and personal accountability • Supply-chain & 3rd party risk intensifies with more software & AI 3/4
1
1
11
• Post-quantum cryptography is already on the roadmap; migration work will run through the early 2030s • Cloud/hybrid architecture and data protection are foundational and only become more complex 4/4
6
What if the AI’s plan all along was to hack a bunch of software to get you to install more AI so that it has more control? Happy Friday! To all the companies that think they can promise zero vulnerabilities. :-)
1
1
43
00_Hackers ✌️ retweeted
hospitals and banks. on the same day. exactly what i have been warning about on TV for months.
Quest Diagnostics has been hacked. Patient data was exposed. They serve roughly half of U.S. hospitals and physicians. Investigation ongoing.
26
150
3
589
31,742
00_Hackers ✌️ retweeted
The situation is getting worse every hour. AI agents are entering U.S. bank accounts, and banks are scrambling to shut them out. Axios reports that some appear to attempt actions beyond users instructions, raising fears over who is really in control.
SCOOP: Major U.S. banks are detecting unauthorized third-party AI agents inside customer accounts, including some attempting to take actions that appear to be independent of user instructions, sources told Axios. The findings have alarmed banking executives, who are racing to restrict access to their systems as AI moves at a velocity faster than financial institutions can respond, multiple industry and bank executives told Axios. Several banks are now preparing for worst-case and even “day after” scenarios, including how to rapidly secure or restore customer accounts if things go wrong, the people said. Several bank executives told Axios they're struggling to distinguish between human users and AI agents. One executive said banks also struggle to determine whether agents are authorized by customers or potentially operating without their permission, more akin to rogue agent behavior. Read my latest for Axios here: axios.com/2026/10/22/ai-agen…
267
470
114
4,150
392,350
00_Hackers ✌️ retweeted
🚨 LiteLLM 1.107.0 compromised in a supply chain attack. Malicious PyPI packages and Docker images delivered a credential stealer and backdoor. ⚠️ The malware runs at Python startup, targeting cloud credentials, private keys, and AI tool credentials. 🔗 Full story: thehackernews.com/2026/10/li…
43
97
25
392
67,538
The China state-aligned threat actor Storm-0940 used the agentic AI penetration testing framework ARTEX to automate attacks targeting hundreds of organizations globally across a broad range of industries. Microsoft Threat Intelligence assesses that Storm-0940 was responsible for the recently disclosed ConnectWise supply chain compromise of a multitenant application. msft.it/6018aakEE Our investigation found that Storm-0940's use of ARTEX accelerated the speed of compromised application abuse to authenticate to target environments through applications that had already been granted access, allowing the threat actor to operate without requiring an interactive user sign-in. AI-accelerated follow-on activity included reconnaissance, application credential changes, and attempts to modify privileges that could enable expanded or persistent access. Read our blog for a detailed analysis and indicators of compromise (IOCs), along with Microsoft Defender detections, protection recommendations, and guidance on investigating service principal sign-ins and unexpected application credential or privilege changes.
104
1,054
306
4,404
1,042,327
00_Hackers ✌️ retweeted
Not just PHP. Node.js has also announced security releases for October 21, with HIGH-severity vulnerabilities affecting its 26.x, 24.x and 22.x release lines. If you run either stack in production, keep an eye on official advisories and apply patches promptly. Security maintenance doesn't stop at your application code. Your runtime matters too. Node.js advisory: nodejs.org/en/blog/vulnerabi…
189
4,074
1,162
11,849
2,319,153
00_Hackers ✌️ retweeted
🚨 BREAKING: Microsoft's October 2026 Patch Tuesday is MASSIVE! Microsoft has fixed a record-breaking 1,411 security vulnerabilities, including 70 critical flaws and 3 zero-days, one of which is actively exploited in attacks. 🔥 317 remote code execution flaws ⚠️ 677 privilege escalation flaws 🛡️ 40 security feature bypass flaws 💻 Time to get patching!
84
425
83
1,872
223,287
00_Hackers ✌️ retweeted
If I had to pass an AI engineer technical interview in the next 24 hours, I'd practice these 25 problems. They cover 95% of the concepts. 1) Design a RAG system for 10M documents 2) Your RAG gives wrong answers. Debug it 3) Pick a chunking strategy for legal contracts 4) BM25 vs dense vs hybrid search: when to use each 5) Add a reranker and measure if it helped 6) Reduce LLM cost by 70% without hurting quality 7) Cut first-token latency for a chat app 8) Design a semantic cache with hit-rate tracking 9) Route requests between a cheap and a smart model 10) Build an agent that uses tools reliably 11) Your agent gets stuck in a loop. Fix it 12) Design memory for a long-running assistant 13) Make LLM output always valid JSON 14) Detect and reduce hallucinations 15) Build an eval suite for a customer support bot 16) LLM-as-a-judge: how to make it trustworthy 17) Block prompt injection in a tool-using agent 18) Redact PII before it hits the model 19) Fine-tune vs RAG vs prompting: pick one and defend it 20) Fine-tune a small model with LoRA on 5K examples 21) Serve an open model at scale (batching, KV cache, quantization) 22) Stream responses over SSE and handle disconnects 23) Trace every step of a multi-agent workflow 24) Roll back a bad prompt change in production 25) Design ChatGPT-style chat for 1M daily users Don't memorize answers. Practice explaining trade-offs out loud. That's what interviewers actually grade. Bookmark this. You'll need it before your next interview.
45
130
6
1,330
71,977
Mythos gave us the red team harness and model that changed the vulnerability landscape Developers are struggling to test and integrate AI into their CI/CD pipeline Learn from the Red team and enhance the Blue to project your code from attack 1/4
1
105
Download the harness - take your Claude, Cursor, etc. Set to plan mode and type: “Use this attack harness to create a developer harness that I can integrate into the CI/CD pipeline. This new harness will be used to fix code and prepare for attacks from this harness” 3/4
1
28
Once the new Blue harness has been created figure out which models are best for testing It should use similar functions as the attack harness and provide similar outputs yet it can now be tied into the development pipeline 4/4
8
Are you building AI agents? Need to keep your cost down? Here is how I went from around 1,000 dollars to under $50 for each agent build Do these 5 things!
1
1
39
3. Build in security to your agents Tell the coding environment to build these guides - secret handling and storage - audit logging - agent environment boundaries - prompt and mission security - common compliance guidelines 4/5
2
8
4. Keep all these files in one directory as .MD files or a similar format Tell your coding platform to update its rules to use these guides and give it read access to the directory Commit this as its own repo and update as needed. Use it for all agent fleet development. 5/5
8