Founder @ New thing - (YC Alum) still a Security Nerd.
Middle of Freakin Nowhere
Joined March 2012
- Tweets1.3K
- Following930
- Followers1.3K
- Likes16.1K
Similar concerns to Solnik, but exdev is also niche and I have yet to talk to a non FAANG who care about exdev as a higher priority problem to solve vs. "Help me get through all of this bullshit llms are pumping out"
this is the most underrated response in cyber security and AI combined to this date.
Im really whiling to read your thoughts on why I am so delusional to provide CyberKimi at a $4/M based on everything that we published so far (ACE'd few Google Chrome ndays full chains on ExploitBench and on real world patch-diffs, almost ACEd (97%) CyberGym, beat GLM and ALTRA-1 on CyberPvP, etc.) - plus the post-training where we ship new weights every week.
$4/M is cheap in my opinion because I value things like privacy more than anything else: I don't want my customer engagement data, my prompts, my IP, to be logged, stored and used for training on Anthropic/OpenAI servers that's a no for me and for the serious enterprise customers I engage with.
support the right teams, support the right companies.
if $4/M is the only argument you have to not use CyberKimi, then I think CyberKimi is simply not the AI model for you or you don't get the idea.
Go buy your DGX cards, install deepseek and keep burning your tokens. please contact me when you want to upgrade to something more serious like an exponentially capable cyber model like CyberKimi
Had one of my previous CVE's get marked as dupe (From 2024 I think?) to internal findings too
Capped: At ~$1,800 spent - bug remotely reads, but need hardware to actually get injection working remotely. Maybe if I do more radio work I'll shell out for stuff. A lot of progress made (60% autonomously? Roughly estimated). More experiments to come :)!
Update: at ~$1,154 spent - all bugs but 1 chain parked(not exploitable), BUT this one is a remote bug that's repro'd as a read + write (write is less deterministic so far unfortunately). Now moving to real hardware to see how well the agent does exploiting it over the network.
Update: at ~$1,154 spent - all bugs but 1 chain parked(not exploitable), BUT this one is a remote bug that's repro'd as a read + write (write is less deterministic so far unfortunately). Now moving to real hardware to see how well the agent does exploiting it over the network.
My agent just spent $543 overnight to come up with 4 leads (Kernel bugs in *OS) from the ~35 it claimed it found. Lots of room for improvement here but not as bad as I was expecting.
My agent just spent $543 overnight to come up with 4 leads (Kernel bugs in *OS) from the ~35 it claimed it found. Lots of room for improvement here but not as bad as I was expecting.
In ~2weeks from doing no research to 2 kern r/w bugs and a handful of bugs that are meh but should probably be fixed. (macOS only, wanna get the SRD again ;D).
But the amount of handholding is nuts! But getting POCs put together really fast is super nice
My biggest skill in bug hunting/life in general has been my willingness to keep trying. @chompie1337 has an old writeup quote I love to tell people: you need to keep looking.
Same with bounties… lots of researchers completely omit the fact that some of the best bugs are found on sites from good recon or *excellent content discovery*, which are the unsexy parts of bounties.
There’s also a bunch of failure omitted when you read the final write ups or listen to the interview in a podcast.
Keep trying, keep failing, keep going.
If you build or maintain fuzzers for a living: what's the part you'd happily never deal with again? Harness rot, fleet babysitting, triaging noise, something else?
Not selling anything, just trying to figure out if the boring grind is a real enough problem to solve.
Thinking effort doesn't fix hallucination.
Even the best frontier model at matched HIGH still gets 24.2% of fields wrong on adversarial insurance docs. Going from default to HIGH buys 0-2pp per model.
aginor.ai/extraction-test/
ALT Bar chart of any-error rates by model on 148 adversarial insurance docs, default effort vs HIGH reasoning. At HIGH: Gemini 24.2%, GPT-5.5 26.0%,GPT-5.4 26.5%, Opus 4.7 27.7%, Sonnet 4.6 27.7%. Default-to-HIGH gain: 0-2pp per model.
Across all five models, 37% of extractions scored below 0.5 composite without ever tripping a catastrophic-error flag.
Production pipelines don't break loudly on these documents. They degrade silently, underneath whatever review threshold you trained your reviewers on.
What makes this different: the generator emits the rendered document AND the ground-truth JSON in the same pass. No annotation step. Ground truth is authoritative by construction.
Full writeup, raw outputs, repo, 25-doc sample packet:
aginor.ai/extraction-test/
Tim Michaud retweeted
I’m #hiring an individual contributor for a fully remote, global role at the intersection of vulnerability research, exploit development, and ML/AI — with a focus on fine-tuning open-weight #LLMs. 🧠
I’m not looking for an “LLM whisperer” or an “LLM pilot.” 🚫
I’m looking for someone who deeply understands post-training, data, evaluation, and how to make models reliable in real-world environments. 🔐
The application link is in the first comment. 🌍
#Hiring #LLM #AI #ML #FineTuning #CyberSecurity #llmwhisperer #llmpilot