MattKicks retweeted
most agent training fixes the model
Google just open-sourced EnvHarness, which fixes the environment instead. it wraps an existing setup and adds three pieces: setup (change the starting state), rule (constrain what happens next), and link (change what the agent sees). the agent, the base environment, and the eval stay untouched
on WebArena, SWE-bench Verified, and ALFWorld it lifted several models by 2.9 to 3.7 points, including Qwen3.6 27B and Claude Sonnet 4.6
the useful part is the split. if the agent keeps failing the same way, you do not always need a bigger model. you can make the environment show it the failure more clearly
open-source stacks can do this without retraining. the loop is the environment, not just the weights
MattKicks retweeted
Presentation slides (all 107 of them):
quentinkaiser.be/assets/qkai…
A general public documentation page has been published at qkaiser.github.io/broadcom-w… under the name 'WPSplinter'. I hate designer name vulns as much as you do, but I needed a site for the general public. Answering emails one by one won't cut it.
MattKicks retweeted
Anthropic’s Claude AI Resolves Decades-Old Mystery of NIST Elliptic Curve Seeds in Under 30 Minutes crowdfundinsider.com/2026/10…
MattKicks retweeted
The club of blockers is growing. Schwab joins JPMorgan, Citi, and BofA in blocking AI agents from moving customer money
buff.ly/89KiOPw
Schwab didn’t ban agents. It zoned them: read-only MCP, money locked.
Rick Wurster’s “who’s liable?” is the real product spec.
MattKicks retweeted
An example of why automotive security is so fun: No CFI, No ASLR, MMU/MPU not configured, Everything RWX
0-click RCE on Tesla Model 3 through TPMS Sensors
cc @_p0ly_ @masthoon @vdehors
synacktiv.com/sites/default/…
MattKicks retweeted
CVE-2026-88771: Inside the Exploitation of a Critical NetScaler RCE
Vulnerability
zscaler.com/blogs/security-r…
According to the issue and all the tweets from the opencode providers, opencode..ai/console got pwned, mainly affecting users those who provided their api keys in opencode's provider list.
who even puts their API keys there bro ? The design is so bad. if you are using opencode coding agent you can just set up manually. never store API keys with any provider. Just keep them in local .json files and configure everything on your own machine. If you're feeling lazy just use an llm to do it.
Imagine getting charged $1500 for nothing.
MattKicks retweeted
Abliterated open-weight models could have backdoors. Possible to detect by diffing against the base model or implementing runtime controls: projectdiscovery.io/research…
ZKDragon explains how Zcash could scale from under 10 transactions per second to 50,000 TPS, targeting Visa and Mastercard-level capacity
“Let's just look at Visa and Mastercard, two credit card networks. They have about 50k TPS of capacity and use about 10k TPS on average. So today Zcash is like sub 10”
“So how do we get there? Well step one, Tachyon. Tachyon converts the scaling problem, at least at the chain level from being this hard thing with how to do state growth etc. To now just being scale extensive bandwidth and your mempools”
“Every transaction is going to be 2 kilobytes big. We need 50k TPS. So we need to be able to do consensus on 100 megabytes per second”
“This is the same level of what Solana needs and we have to do this in pure proof of work”
“We'll do things like faster block propagation and do recursive aggregation of ZKs in the mempool but we do this with the new node software Zakura”
MattKicks retweeted
Clear your queue. We just hit 150 LetsDefend Sherlocks in HTB Labs🛡️
Whether you’ve been grinding through them as they drop or you're looking for a fresh incident to dissect, your next investigation is ready.
🔗 Pick a case and start digging >>> okt.to/RjF6bn
#HackTheBox #LetsDefend #BlueTeam #DFIR #CyberSecurity
MattKicks retweeted
Over 300 downstreams tenants had successful signins per Huntress with over 1000 attempted.
Huntress has top notch responders. They provide great information. If your organization was not affected by this attack, this is a great opportunity to learn about what happens when a vendor application secret is compromised.
Please keep in mind anyone can be hacked and the victims are not to blame.
Replying to @HuntressLabs
UPDATE: ConnectWise has communicated that it has disabled the relevant applications. We’ve added this and several other developments to the blog: huntress.com/blog/vendor-cre…
MattKicks retweeted
🚫 Web Malware Scan Results
Website: sp18ct-torek-biz-nulvo-zelix[.]pages[.]dev
Security Verdict: CONFIRMED SCAM
Full analysis & details:
scanmalware.com/result/0514e…
#VulnerabilityManagement #WebMalware #SecOps
MattKicks retweeted
1/6 🧵
Threading the needle in SOC investigations reminds me of writing SQL.
Too broad? You're drowning in noise.
Too narrow? You might miss the signal entirely.
Here's what I'm learning about finding the balance.
MattKicks retweeted
BREAKING: The number of restaurants in New York dropped ~2,000 YoY in Q1 2026, posting its largest YoY decline in at least 36 years.
This surpasses even the worst contraction recorded in any quarter during the 2020 pandemic.
The number of eating and drinking places in New York State has now declined YoY for 4 consecutive quarters, its longest streak since 2021.
This comes as restaurants are facing surging operating expenses, including insurance premiums, wages, interest rates, utilities, and health coverage, with overall costs rising faster than national averages.
Last year, employee health insurance costs jumped +12.9% for New York-area service firms, business insurance rose +7.0%, while utility costs surged +8.5%, according to the Manhattan Chamber of Commerce.
Skyrocketing costs are crushing New York restaurants.
MattKicks retweeted
MattKicks retweeted
Blind SSRF to full read SSRF 👀
Found a PDF export API with no login required. Injected HTML to make the render server fetch internal URLs and got the control plane's debug page right in my downloaded PDF.
#BugBounty #SSRF #Cybersecurity
Ben Horowitz says Anthropic is one of the most negligent companies he’s ever seen on security
"The irony on these things is wild. Anthropic is one of the most negligent companies that we've ever seen in terms of their own security."
"They let Claude code, one of their crown jewels, just like walk out the door because they had such bad OPSEC."
"I'll tell you a funny story. So when we first got Opus 4.5, we were doing cybersecurity checks for the firm. So we had an agent basically set up a website for a pet store. And then we took another agent and said, 'Tell us if we can exploit that web store.' And it gave us all the exploits it could find. So Opus 4.5 wrote really buggy code. Great."
"And then we said, 'Oh, the SQL injection you found, is that actually exploitable?' And it goes, 'Let's pop it open.' And the agent using Opus 4.5 breaks into the website and steals all the [data], and we call Anthropic. And what they tell us is, 'You prompted it wrong.' That was their answer."
"So these guys are doing that on the one hand. And then on the other hand, they're coming up with theoretical scenarios about other people's software. That's bad. And so like, what the hell."
"On the distillation thing, you know, to build their model, they distilled the works of every author, every creative, every scientist for the last 2000 years. For them to be complaining about distillation, which, by the way, distilling a model is not even illegal. It's just a violation of the terms of service."
"It's just so much. And the fact that they get people to write things supporting these bananas, ridiculous, two-faced ideas. And the timing here is very suspicious."
MattKicks retweeted
The GDPR Blind Spot: Sensitive Data Is Protected Inside, Then Exposed in Communication - IssueWire issuewire.com/the-gdpr-blind…
Cc: @BillMew @robmay70 @NigelTozer @ChuckDBrooks @m49D4ch3lly @DT @archonsec @clarinette01 @JBarbosaPR @AshokNellikar @MHcommunicate @Khulood_Almani @Miriam_Brown979





































