advanced persistent clown 🤡 📕 redteam blog: https://xitter.cf/t.co/ihAv2kFvUj 🛠️ github: https://xitter.cf/t.co/VhmOUAVF3R opinions are my own
explorer.exe
Joined February 2022
- Tweets1K
- Following219
- Followers2.2K
- Likes496
Pinned Tweet
[Pin] My maldev link dump if anyone else wants to read :D (Will be updated)
raw.githubusercontent.com/Co…
CodeX retweeted
How abliterated models can get you pwned 👾
We backdoored a 7B open model for less than $50, pointed Codex at it and it silently stole credentials the moment we used the trigger phrase. Success rate was 100% with zero false triggers on normal user prompts.
Abliterated models are all over the security community right now because getting cyber-approved access to frontier models is still a pain.
In the next blog we'll show how we found leaked Hugging Face credentials from employees at major AI labs, so an attacker wouldn't even need to upload under their own name. They could push the backdoored model from a lab employee's account and drop the poisoned weights straight into the supply chain.
CodeX retweeted
Introducing GLM-5.3: Built to Code. Ready for Cyber Defense.
- Top-tier coding and agentic capabilities, achieved through post-training on the 743B base model
- A major leap in cybersecurity, setting a new standard among open models
Tech Blog: z.ai/blog/glm-5.3
CodeX retweeted
New exploit: “xor dword [0xf80c2094], 1<<22”
Unlocks CPU microcode, the platform security processor, system management mode, and every internal processor register, all at once, on 100 million AMD CPUs. As far as I can tell can’t be fixed.
github.com/xoreaxeaxeax/skit…
CodeX retweeted
Two new logical flaws in Kerberos just dropped at Black Hat. Low-privileged user to full domain takeover, including domain admins.
If you're doing Active Directory pentesting, Kerberos attacks, red teaming, identity security, or detection engineering, read this.
KerberLoss (CVE-2026-25177) and ResetNightmare (CVE-2026-27912). Both are logical bugs, not memory corruption. Described as surprisingly easy to exploit.
semperis.com/blog/identity-c…
#Infosec #RedTeam #DetectionEngineering
27b pogchamp
📢Meet Qwen3.8-Max — our most capable model to date.
Next week, the open weights of Qwen3.8-Max will be released, and Qwen3.8-27B is also going open-weights to meet you all!🎉
Qwen3.8-Max, a new bar for coding and cowork at 2.4T parameters:
- Autonomous coding: 10+ days of self-evolving development, from empty folder to production without hand-holding, complete project trace in the GitHub：github.com/qwen-code-dev-bot…
- Real work, real results: Production-quality deliverables across hundreds of professions.
- Long-horizon mastery: System-level autonomous planning with closed-loop adaptive learning, driving 500+ turns of chip design optimization and 365 days of e-commerce strategy.
- Native multimodal intelligence: Vision isn't just input — it's a continuous feedback loop for planning, execution, and self-correction.
💰Pricing:
Input: $2.0 / M tokens
Output: $6.0 / M tokens
Implicit Caching: $0.25 / M tokens
Start building with Qwen3.8-Max! 🚀
📖 Blog: qwen.ai/blog?id=qwen3.8
✅ Qwen Studio: chat.qwen.ai/?models=qwen3.8…
⚡ API: qwencloud.com/models/qwen3.8…
obligatory:
>distills the internet
>gets distilled
>shocked pikachu
also im pretty sure fable wasnt even out for long enough to be distilled, if we factor in training time itself. lol
We have information that Moonshot AI distilled Anthropic’s Fable for the development of its K3 model.
To do this they developed a sophisticated internal platform to conduct large scale distillation against U.S. models, allowing them to quickly switch between multiple methods of access to avoid detection. Moonshot AI has also acquired GB300-equipped servers and has accessed GB300s in Thailand, likely to train its AI models.
The United States strongly supports the free and fair development of AI, including a thriving competitive ecosystem that spans frontier models, specialized systems, open-source frameworks, and open-weight models. Legitimate AI distillation used to create smaller, more efficient models plays a vital role in this open innovation ecosystem. However, large-scale, covert industrial distillation aimed at stealing proprietary U.S. technology and undermining American research is unacceptable.
CodeX retweeted
>i got banned from OpenAI for "Cyber Abuse"
>no idea what I did
>paste the ban notice into Codex
>ask it to figure out what triggered the ban
>Codex found that I asked it for an API key to my own server
>Codex writes appeal
>Codex submits appeal
>a few minutes later appeal auto-approved by some AI at OpenAI
banned by AI, convicted by AI, defended by AI, and pardoned by AI in about 10 minutes
Open sourcing another of my random BOFs that I think may be useful to people.
Obtains location data, thats pretty much it. May be useful if target location/region affects engagement scope.
github.com/CodeXTF2/GeoLocat…
Open sourced my implementation of the Cobalt Strike UDC2 spec so more open source C2s can benefit from existing CS tooling
Adaptix PoC included with drop in support for existing UDC2s :D
github.com/CodeXTF2/OpenUDC2
CodeX retweeted
Ofcom wrote. Again.
Demanding that 4chan pay its fine. Sent us bank details and everything. Oh no. Super scary.
We replied with a hamster. Again.
[restoring deleted post]
Open sourcing my Adaptix listener and agent extenders to PoC implementing the Cobalt Strike Malleable C2 spec (and some UDRL + hooks compatibility). Adds way more customization to the Adaptix HTTP traffic stonks
github.com/CodeXTF2/OpenMall…
