A technology executive, Computer scientist, Professor. A decade at Microsoft Research, executive roles at Brave, ZKSync, Eclipse.
Worldwide
Joined April 2015
- Tweets1.7K
- Following3.8K
- Followers8.8K
- Likes1.5K
Pinned Tweet
If you would like to pursue a PhD at Imperial College London and work with me on blockchain and systems security-related topics, please contact me via my web site.
1/ 19:34:36 UTC. An AI agent's backdoor admin login fails on a production server. A human would stop, swear, or ask a colleague. This one reads the error, guesses two causes and tests both. The login works at 19:35:18. From Sysdig's JADEPUFFER log.
🧵
9/ Gaps: I found no public dataset of agentic intrusions to fit any spread, forecasting or economics model. Key-release designs (RansomClave, zkRansomware) exist only as proofs of concept. Entropy detection weakens when only part of each file is encrypted.
10/ What holds never depends on catching the attacker's code: behavioral invariants plus other signals, rollback, immutable backups, pre-authorized containment. The attacker automated the intrusion and is now working on the invoice.
🔗 ben-livshits.org/blog/ransom…
1/ For about two decades bug bounties were a bargain: finding was slow, so a report meant real work. Models broke that. Discovery costs cents; judging a report still costs a human afternoon.
9/ The post argues for a sandbox-first intake stack, rewards for verified fixes and triage labor, and cost following benefit: platforms and vendors fund the verification volunteers carry for free.
10/ Full post, with the case studies, the intake design and the bounty-economics research: 🔗 ben-livshits.org/blog/bounti…
