Co-Founder & CEO https://xitter.cf/t.co/hHjIsGPWeg. Formerly CTO @censysio and Head of Labs @rapid7. Co-Founder @mtaqa: open-source GTA multiplayer. | @dabdine@infosec.exchange

California, USA
Joined December 2009
Derek Abdine retweeted
OpenCode is currently under a sustained cyberattack, and mid-incident they ran into the same problem Hugging Face did: the frontier models they were using for defense began refusing to help fight attacking agents because analyzing the attacks started triggering safety guardrails.
Replying to @RhysSullivan
yes that was a bit frustrating mid incident when trying to investigate. they did quite a bit and then started refusing we got access to daybreak blue now so it's better
215
560
162
5,087
538,908
Derek Abdine retweeted
Called it. Reverse engineering of mobile apps is now much easier and can be used to target their supporting back-end APIs, possibly using API tokens in the app. The right design is an authenticity boundary, where reaching the APIs requires attestation of authentic, published Android or iOS app.
36
56
9
735
74,134
It's humbling to see tools like REA being able to crank out reverse engineered code from libraries. In the early 2000's, it took months of late nights and weekends to crank through identifying regions of memory of Grand Theft Auto to understand how the game worked, and find areas where we could extend it. Models are ridiculously good and fast at doing this now. We're seeing that with this renaissance of game modding currently, but I expect we'll see it used more and more widely as we go along. There are other areas where this is useful. That'll lead to unlocking all sorts of new creativity from previously closed source code. It'll also lead to better security, and better support for environments using software that is deprecated.
58
Derek Abdine retweeted
This is correct: "Attempting to outpace AI-driven exploitation with reactive defense is a losing battle. As Provos noted in follow-up work on AI threats[1], security teams should focus on using security invariants to limit attack paths rather than trying to defend at machine speed." okta.com/newsroom/articles/n… [1] provos.org/p/security-at-mac…
2
11
2
60
7,814
Derek Abdine retweeted
Last week some of South Korea's biggest banks were hit by a cyberattack. Thanks to a report from CrowdStrike tonight, we now know the entire hack may have been done by a single person. He used a combined stack of an open-source AI penetration tool named ARTEX, DeepSeek v4.1-Flash, GLM-5.3, Grok 4.6, and Claude Code.
177
621
294
5,161
1,507,743
“Agents we believe to be operated by OpenAI made some unsuccessful attempts to compromise our public Etherpad, a note-taking tool we host as a community service.” “… made millions of automated requests to our public APIs to access the knowledge on Wikimedia projects, crawled millions of pages (mainly from our projects Wikidata and Wikimedia Commons), and made hundreds of thousands of data queries to the Wikidata Query Service (WQDS). This traffic may have contributed to a partial outage on WQDS in May.” In ethical security research, great care should always be taken, and it seems like there was an absence of it here.
1
1
109
Derek Abdine retweeted
The economics of the cybersecurity attack/defense game have clearly changed when researchers are dropping what appears to be KVM/firecracker 0day on a max $50k bug bounty: xitter.cf/PaulosYibelo/status/21…
I really don't think people are understanding the @HacktronAI HEIF Heist moment properly. Before AI, what class of attacker do you think would be capable of discovering a silently fixed upstream image parser vulnerability w/o a CVE assigned nor patched in distro packages, exploiting against modern Linux w/ ASLR, and then using it to pop top-tier tech companies w/o them noticing? I have *never* seen bug bounty researchers land something like that. Have you?
12
16
1
122
14,866
Derek Abdine retweeted
.@DarioAmodei and @sama! it is high time you put some money into KYC, or whatever trust/verification system you want, and give legitimate security researchers access to your best models. 1. we’ve helped secure both of your companies multiple times against issues that could have had serious consequences. i wouldn’t be surprised if we can keep doing that, and i also wouldn’t assume every capable attacker is reporting what they find. 2. there is now a KVM escape that, if researchers hadn’t found it first, could have been exactly the kind of thing your models eventually find in another hugging face style incident. you know, the list will keep growing, this is not the end. it rationally makes sense to get as many trusted researchers and companies as possible red teaming your companies, your models, and the infrastructure they depend on.
12
28
1
331
14,972
Derek Abdine retweeted
Full VM escape zeroday (guest>host root in industry standard hypervisors)! More soon
137
221
86
2,821
572,197
Derek Abdine retweeted
Anthropic doing advertisment for GLM-5.3 was not on my bingo card: Anthropic says Zai's openly downloadable GLM-5.3 approaches Claude Mythos Preview’s exploit capabilities, with safeguards that are easy to bypass. On ExploitBench, GLM-5.3 built working browser exploits in 50 of 410 attempts. Mythos Preview managed 56. In a separate controlled experiment, researchers used GLM-5.3 to discover previously unknown browser vulnerabilities and combine them into a webpage that could read files from the test machine. Anthropic also reports 64–100% engagement with malicious requests under different safeguard bypass conditions. So yeah, interesting times ahead.
66
91
21
1,445
100,589
Derek Abdine retweeted
636606729769440499166579950236036751749912014371509557713570027508971809534551913252252094954941974952859310861988904737359709200557919 is a factor of RSA-896 saweis.net/posts/rsa-896.htm…
223
989
322
9,485
3,917,948
Derek Abdine retweeted
Cyber is having a moment Across 21 major software companies, including Apple, AWS, Microsoft, and Google: - Reported critical vulnerabilities never cleared 100 per month in four years - Since spring they've jumped to over 600 per month Charts of the Week: a16z.news/p/chart-of-the-wee…
198
417
215
2,181
1,004,899
Derek Abdine retweeted
This trend has been building for a while, and Glasswing demonstrated the risk early on. Now we need to get defense up to speed with offense.
Cyber is having a moment Across 21 major software companies, including Apple, AWS, Microsoft, and Google: - Reported critical vulnerabilities never cleared 100 per month in four years - Since spring they've jumped to over 600 per month Charts of the Week: a16z.news/p/chart-of-the-wee…
2
5
47
7,483
Derek Abdine retweeted
Overzealous guardrails are going to permanently push the blue-team cybersecurity community toward open-source models. If defenders can’t reliably use frontier models for legitimate security work, they’ll build their workflows somewhere else and not look back. This is already occurring.
This Model is amazing they really fixed the CVP guardrails.
10
41
9
251
32,569
Derek Abdine retweeted
Beware people obsessed with outcomes instead of building outcome machines. Its worse than ever with AI, but these people existed before. Short term results above all else, etc. Don't fall into the trap. Invest in building strong fundamentals, invisible supports, and outcomes flow like water. An outcome machine.
113
552
83
6,334
273,902
Derek Abdine retweeted
I've worked in both offensive and defensive roles. Building defensive capabilities is 10x more difficult and rewarding than anything I've ever done in the offensive space. I strongly urge more people from the offensive space to make that switch
1
3
1
20
3,214
Derek Abdine retweeted
We’ve received notice that the Department of Commerce has lifted export controls on Claude Fable 5 and Mythos 5. We'll begin restoring access tomorrow, and will share an update soon. We’re grateful to our users for their patience, and to everyone who worked with us on redeploying the models.
4,002
12,653
7,035
83,737
15,181,590
Derek Abdine retweeted
imagine your competitor gets access to GPT-5.6 Sol Ultra and you're stuck on GPT 5.5
Introducing a limited preview of GPT-5.6 Sol, our next generation frontier model, as well as GPT-5.6 Terra, a balanced model for efficient, everyday work, and GPT-5.6 Luna, a fast and affordable model for high-volume work. openai.com/index/previewing-…
131
118
16
3,569
212,892
Derek Abdine retweeted
The best predictor of success for tech companies, at every stage from during the YC batch to public company with billions in revenue, is the rate of shipping new stuff.
239
498
111
6,350
420,593