Security, software correctness, and Rust 🦀 Doing the cyberz @OpenAI prev: @RobinhoodApp, Cruise, @zellic_io, @Dropbox My awful opinions are my own
San Francisco, CA
Joined November 2013
- Tweets16.3K
- Following467
- Followers21.3K
- Likes50K
Pinned Tweet
I'm excited to announce I'm joining @OpenAI!
I left Robinhood in March of 2025 to embark on a wonderful year and a half long career break. I used that time to: travel (I went drifting in japan!); build a low-latency arbitrage bot on Solana, briefly becoming the 60th most profitable arbitrage bot on the chain; and learning @leanprover in service of building an accurate model of rust to prove `unsafe` rust code was free of UB!
But a lot has changed. For one, most engineers I knew were, at the time, leveraging Github Copilot as an "intelligent autocomplete" to accelerate parts of writing code. Software was (and at many places, still is) manually reviewed, and there was much doubt, especially from myself, that models could ever improve to the point to economically handle the more complex tasks of implementing entire features, proving conjectures, or discovering, and exploiting, novel 0-day vulnerabilities.
Clearly I was wrong! I've been shocked and inspired by the rapid advancement going on in the industry while I was away. One thing has been abundantly clear: security is changing.
I'm excited that I get an opportunity to work on some of the most important problems facing our industry today. And I get to play a meaningful part in discovering, and contributing, to the next generation of strategies required to secure this burgeoning technology.
d0nut 🦀 💜 retweeted
Our team worked with OpenCode to have their users who are also OpenAI API customers back in business and any credits refunded which would have been drawn in the attack.
Also, you can request Daybreak Blue access to use our cyber permissive setup for defense. Do not wait until you have to deal with an incident. We’re here to help.
d0nut 🦀 💜 retweeted
How often do ArXiv papers contain errors in the main theorems they claim to prove? Using GPT-6.1 Sol to identify such mistakes, it finds:
- 6% of papers before 08/2026 contain main theorems that are false.
- Only 1.5% contain similar mistakes in the last two months.
I had astra draft a plan to implement a feature, and the ui it generated was so beautiful I didn't even read the plan before pressing "Implement this plan"
d0nut 🦀 💜 retweeted
Tomorrow the vulnerability details for the coolest (imo) KVM escape will drop. The Vercel team was amazing to work with and has been an incredible partner throughout this journey!
This is one of the most exhilarating times in technology, and this challenge was yet another jaw-dropping moment.
When the details of OpenAI’s agent escape and Hugging Face hack started to emerge, it became clear that agent containment would be one of the most important priorities for any AI infra company.
There are two classes of escapes: ① "escape the network" and ② “escape the matrix” 😁, as in, break the spell of virtualization. OpenAI was the former, where an agent not supposed to have internet access… gained it by hacking another system. Genuinely astonishing and worrisome.
Through this challenge, however, we discovered something even more groundbreaking. A talented white-hat researcher, armed with a swarm of AI agents, expertise and perseverance, "pierced through" the Linux virtualization boundary that nearly every cloud sandbox provider in the world banks on today.
I'm very thankful we got the report, were able to quickly move to protect our customers, found no evidence of customer data compromise, and collaborated with many industry partners to protect the wider internet.
Our confidence and conviction in Vercel Sandbox are even greater now, after some of the smartest, most motivated researchers in the world, and their agents, gave it their best shot.
Why is it that my face id can recognize me when I have a fork sticking out of my mouth like a dumbfuck, but if I smile it suddenly pretends to not know who I am
d0nut 🦀 💜 retweeted
ugh, this came out just when i needed it
The optimality of the packing for 11 squares has been formalized in lean thanks to Astra and Claude! Huge thanks to @ojoshe, @kleddamag, @wand_125, @guzhou0806, and @ctjlewis for aiding in the process.
Image credit: jlevy.github.io/squares/case…
1/n
d0nut 🦀 💜 retweeted
🧵 Some cool features in the Sliver GUI
github.com/sliverarmory/sliv…
The fun police (waymo) took me to jail (my home) and now I’m forced to do hard labor (prompt models)
I joined a community a few months ago that I’m entirely out of my depth in and I’m going to go to the next meetup in person so i can learn by osmosis.
see you soon, sf lean group 🫡