Pinned Tweet
Every morning,a Gazelle wakes up,it knows it must outrun d fastest lion or it will be killed.Also, a lion wakes up, It knows it must run faster than d slowest gazelle, or it will starve. It doesn't matter if you're the lion or a gazelle-when the sun rises, you'd better be running – at Victoria Island, Nigeria
DML retweeted
A guy built an AI that thinks it’s 1899, then tried to get it to beat Einstein to his most famous theories.
I got $90,000 for a RCE in Google.
simonkoeck.com/writeups/goog…
DML retweeted
Cloudflare open sourced a security audit skill that orchestrates coding agents through six phases of reconnaissance and validation to produce independently verified, machine-readable findings.
github.com/cloudflare/securi…
DML retweeted
I've decided to finally release my vulnerability hunting methodology that I've been using for several months now, both in testing as well as live engagements with great success.
I was inspired by (and huge congrats to) the @Blackfrost_AI team open-sourcing Cyber-Frost Harness, their reproducible security-agent runtime with procedural skills, an evidence ledger, and isolated Docker targets for red/blue/purple work. 🎉
If you like the Cyber Frost Harness, and want some out of the box vulnerabilty hunting and POC development kit to go along with it - check out my VulnHunter.
It's already loadable: their harness reads standard SKILL.md skills. Point skill_dir at VulnHunter's (or run its installer), and the hunting, falsification, and PoC disciplines load immediately.
Repo: github.com/nealbridges/VulnH…
CREDITS: This is fork of @CapitalOne original repo. I simply took it a step further on POC development and model agnostic. I'm also actively developing in my forked repo as I make more changes to it and welcome the contributions from the community as well.
I think I'm doing the whole "respect who you give credit to" drama, and I asked my model to double and triple check it. So i can blame the model if its wrong. Otherwise, dont put me on blast on X if i suck at credits. /s
Looking forward to developing on this further with the community.
DML retweeted
An alternative to the fellowships: consider designing your own adventure! (Especially if you're e.g. mid-career or otherwise have constraints that would make it hard to take 3 months off to do a thing. Or if you just hate slogging through applications.) Link in thread!
New post! I've done a few advising calls with people looking to get into AI safety fellowships and realised there's lots of concrete advice I kept on repeating.
There's lots of unusual advice that I haven't heard elsewhere, give it a read!
lesswrong.com/posts/PiP4JqQF…
DML retweeted
Google Mantis is a skills pack for security review with coding agents
Install:
npx skills add google/mantis
Key commands:
/mantis-threat-model: builds a threat model from your codebase
/mantis-researcher: scans for vulnerabilities
/mantis-review: filters false positives
/mantis-reproduce: writes a PoC and runs it in a sandbox
/mantis-patch: applies a fix and confirms it blocks the PoC
/mantis-report: generates the final security report
This is a good use case for running your agent in a sandbox, since the reproduce and patch steps execute generated code
github.com/google/mantis
DML retweeted
Zurp is now open source. 🧰
Meta Bug Bounty's research toolkit, inside the proxy you already have open. Meta context, CSRF token handling and FBDL access. Every capability is available to your AI agents too.
github.com/facebookincubator…
DML retweeted
Introducing PageBreak, an agentic vulnerability discovery tool using deterministic validation to achieve a near-zero false positive rate.
How it works: blog.google/security/agentic…
For real-world vulnerabilities PageBreak has discovered 👇
bughunters.google.com/blog/p…
DML retweeted
10 AWS Projects You Can Build in a Weekend
• Static Website → S3 + CloudFront
Learn: hosting, CDN & caching
• URL Shortener → Lambda + DynamoDB
Learn: serverless APIs & NoSQL
• Image Resizer → S3 + Lambda
Learn: event-driven architecture
• Serverless API → API Gateway + Lambda
Learn: REST APIs & serverless compute
• File Backup System → S3 + Lifecycle Rules
Learn: storage classes & automation
• Uptime Monitor → CloudWatch + SNS
Learn: monitoring & alerting
• Contact Form Backend → Lambda + SES
Learn: event handling & email workflows
• Expense Tracker API → Lambda + DynamoDB
Learn: CRUD operations & databases
• Log Analytics Setup → CloudWatch + S3
Learn: logging & observability
• 3-Tier App → EC2 + RDS
Learn: compute, databases & architecture
Don’t just build projects.
Know what each one teaches you.
DML retweeted
This is the neatest tool I've seen in the last 6 months.
I've tried a few: they either have a good user interface or a strong security/trust model.
github.com/trailofbits/coop
Amazing work by @trailofbits
Our craziest escape yet:
The @Accomplish_ai research team was able to exploit a vulnerability in Cloudflare Containers that let a sandbox read other customers' files - SQLite DBs, Chromium profiles, .env files etc,
Cloudflare Sandboxes and Browser Run run on the same disk implementation and were affected too.
We reported this to @Cloudflare, who super quickly fixed it.
Read @CloudflareDev post in collaboration with Accomplish researcher @orenyomtov on their official blog:
blog.cloudflare.com/containe…
DML retweeted
My new "awesome list" of SaaS replacements & tools you can host (for free/$5) on your own @CloudflareDev account has over 800⭐️ in just 1 week!
Can we make it to 1000 before birthday week?
github.com/theoephraim/aweso…
DML retweeted
This is a treasure trove of hard-earned lessons.
1/ Shortly after I joined Stripe in 2019, we all went to Convergence (Stripe's employee conference). My manager pulled me aside and said: "You have to talk to Shreyas. You'll learn a ton". He was so right. I was lucky to learn from Shreyas during our time together at Stripe.
2/ Shreyas's video on talking to executives is spot on. At Cloudflare I had the opportunity to present to the entire C-suite every month on a critical initiative. I had to learn how to communicate with executives through my own mistakes.
"CxO doesn't want to hear why X is impossible because of how card networks work. Work with Stripe, Treasury, and Finance to figure it out". → "Communicate at their level, not your level".
I wish I'd seen Shreyas’s video back then!
I’ve recently released a bunch of career-related videos on YT but haven’t shared any of them here on X. So here they are (sorted by views).
Super-candid and direct. I hope you find them useful.
1. How to talk to executives
youtu.be/WgFAKCEpEsE



























