Security, and Benchmarks, and Evals, and Agents.
Charlotte, NC
Joined January 2012
- Tweets1.9K
- Following1.1K
- Followers3.3K
- Likes7K
Max Rogers retweeted
With all the chaos going on right now, I'm here to remind you that LLM-aided/agentic attacks are still just... intrusions.
They may evolve at different rates, but they fundamentally boil down to the same observability and alerting requirements that a human intruder would for detection.
In the middle of "vulnpocalypse", the strongest takeaway shouldn't be that LLMs are getting more advanced, it should be that organizations should be investing in basic security fundamentals and posture management to help detect and defeat these threats.
Max Rogers retweeted
Talk spotlight: "How to Get Your AI Promoted — and When Not To" with Matt Anderson (@nosecurething).
What AI had to prove before getting detection work.
Oct 24 | 2 PM | Merkle
bsidespeoria.com/tickets
#BSidesPeoria
🗳️ In my free time I work on local political campaigns. In particular I put a lot of effort into North Carolina elections.
With the midterms in full swing, I've started diving into what the data is telling us... 🧵
competitivecampaigns.com/nc/… #ncpol #Midterms
The growth reaches well beyond a few big counties: 94 of NC’s 100 counties have more accepted ballots than at this point in 2022.
Wake and Mecklenburg have added 61,386 ballots between them, accounting for 30.2% of the statewide increase.
You can find the full analysis here: competitivecampaigns.com/nc/… 🗳️
Max Rogers retweeted
RAPID RESPONSE: Huntress has become aware of a widespread security incident involving ConnectWise Cloud Backup (formerly SkyKick).
We’ve confirmed that an unknown threat actor abused the access they obtained in SkyKick to pivot to access customers' Microsoft 365 environments. 🧵
Google’s Gemini 4 Argon absolutely cooked in this Agentic SOC benchmark 🍳🔥
We saw a significant leap with Astra in accurately linking evidence to the final verdict.
Gemini blew right past that. @Google @GeminiApp
Our first Gemini 4 Argon Benchmark and it performed incredibly well!
Agentic SOC investigation harness. Run the models against different cases. Track key performance.
If you're interested in Decision Models like Jev and Clef we have some of that too! secbenchmarks.com/blog/2026-…
Max Rogers retweeted
Analysts @HuntressLabs have been seeing an uptick of malicious MFA apps from the Microsoft Store the last few days. In some cases, they're being delivered via tech support scams through Teams, in others via malvertizing.
We've been digging into it, and hopefully we'll have more info soon.
Max Rogers retweeted
Update: 2 weeks ago, @JSemonSecurity and @the_MarkOH detailed a campaign that abused #ChatGPT's Custom GPT feature, luring victims in via the legit ChatGPT domain and then directing them to a ClickFix attack.
Attackers are now using new malicious domains: huntress.com/blog/chatgpt-cu…
Max Rogers retweeted
Agentic SOC investigations: Sonnet 5 vs 5.5
Basic verdict accuracy: 58.3% → 91.7%
Basic evidence-backed accuracy: 0% → 30.6%
48-case cost: $37.13 → $21.57 (41.9% lower)
secbenchmarks.com/blog/2026-…
🤖 Made with AI
ALT Sonnet 5 to Sonnet 5.5, both at High effort. On 36 basic cases per model, verdict accuracy rose from 58.3% to 91.7%, and evidence-backed accuracy from 0% to 30.6%. Full 48-case cost fell from $37.13 to $21.57, 41.9% lower.
Max Rogers retweeted
.@HuntressLabs analysts are seeing some *potential* exploitation of CVE-2026-82077, RCE in PaperCut. The detection doesn't appear to be related to the artifact generator that @watchtowrcyber put out the other day.
Only one case so far, but keep an eye out over the weekend!
Max Rogers retweeted
We tested 3 AI decision models on a DFIR task: finding other activity connected to a confirmed attack.
Cloudflare's Clef, Cloudflare's Clef Flash and Jev each ran 8 cases, 3 times.
Here's how they stacked up:
secbenchmarks.com/blog/2026-…
ALT Follow the Incident. A linocut lighthouse sends a yellow beam along a connected trail. Scope scores out of 100 (F1): Cloudflare's Clef 70.8, Cloudflare's Clef Flash 62.1, Jev 1.13 20.8. Eight cases, three runs each. Early pilot; no held-out set.
All this AI and it's still Coin Miners getting dropped that signal mass exploitation.
Starting Oct. 7, @HuntressLabs saw threat actors exploiting flaws in the AhsayCBS backup utility
Post-exploitation activity: deploying XMRig miners that masquerade as Microsoft Edge, running an AI-assisted PowerShell script, dropping webshells.
huntress.com/blog/ahsaycbs-f…
Max Rogers retweeted
Starting Oct. 7, @HuntressLabs saw threat actors exploiting flaws in the AhsayCBS backup utility
Post-exploitation activity: deploying XMRig miners that masquerade as Microsoft Edge, running an AI-assisted PowerShell script, dropping webshells.
huntress.com/blog/ahsaycbs-f…