v̴i̴b̴e̴ ̴c̴o̴d̴e̴r̴ agentic developer, bachelor of physics. 📈https://xitter.cf/t.co/PXUMVpzqUk Can I build a $2k MMR app in 18 months? Follow me to find out.
Home
Joined May 2026
- Tweets676
- Following252
- Followers235
- Likes1.4K
Greg retweeted
For the second time in Google Chrome’s history, Google awarded a $250,000 bounty for a full-chain exploit… to @XBOW. Here’s the full story:
At an all-hands at the start of 2026 in Malta, I set the team a crazy challenge. A full-chain exploit of Chrome by the annual Black Hat cybersecurity conference in August.
I believed there were few better tests of whether @XBOW could move beyond web applications to desktop software, servers and devices.
Chrome is one of the most hardened pieces of software on the planet, used by more than half the world’s population.
A full-chain exploit lets an attacker take total control of a machine, where they can read every email, password and bank login the user types. You don’t need to download anything or click a phishing link. Visiting the wrong site is enough.
So @moyix, Andres Luksenberg, Baul Lee, and Willem Pinckaers took on the challenge along with a fifth teammate: OpenAI's GPT-5.6 Sol.
They built a chain they thought would win, but Google told us they already knew one of the bugs.
We were already in Las Vegas for Black Hat and DEF CON, and the team didn’t want to go home without the win.
So Brendan and the agents built a new exploit in just 6 days.
We submitted it to Google and waited.
The news came through that we'd done what should’ve been impossible. A full-chain bounty of $250,000, the first awarded under Google’s 2026 rules.
It took just 6 days and $40,000 of compute to construct an exploit that affects a billion users of Chrome on Windows. An intelligence-agency veteran told me his team used to spend 6 months on this kind of vulnerability.
My takeaway: the cost of finding truly critical vulnerabilities is collapsing, for attackers and defenders alike. Restricting powerful models is not the answer; GPT-5.6 Sol is already public.
But defenders have one advantage attackers never will: they can test their own code first.
Assume your software is exploitable. Whoever is hunting your bugs has the same building blocks we did.
This is cause for urgency but not panic.
XBOW is now developing an autonomous product for testing compiled software (desktop applications, servers, embedded devices), and partnering with the world’s top organizations to design that product.
If you’d like to be one of them, get in touch.
P.S. Restart Chrome whenever the Update button appears!
Greg retweeted
6 days and $40,000 of compute with GPT-5.6 Sol to find a critical vulnerability in Chrome, claiming Google’s first full-chain reward in 2026 for a vulnerability that would affect an estimated 1 billion users.
Highlights the opportunity for defenders to utilize these tools to secure their software to unprecedented levels:
For the second time in Google Chrome’s history, Google awarded a $250,000 bounty for a full-chain exploit… to @XBOW. Here’s the full story:
At an all-hands at the start of 2026 in Malta, I set the team a crazy challenge. A full-chain exploit of Chrome by the annual Black Hat cybersecurity conference in August.
I believed there were few better tests of whether @XBOW could move beyond web applications to desktop software, servers and devices.
Chrome is one of the most hardened pieces of software on the planet, used by more than half the world’s population.
A full-chain exploit lets an attacker take total control of a machine, where they can read every email, password and bank login the user types. You don’t need to download anything or click a phishing link. Visiting the wrong site is enough.
So @moyix, Andres Luksenberg, Baul Lee, and Willem Pinckaers took on the challenge along with a fifth teammate: OpenAI's GPT-5.6 Sol.
They built a chain they thought would win, but Google told us they already knew one of the bugs.
We were already in Las Vegas for Black Hat and DEF CON, and the team didn’t want to go home without the win.
So Brendan and the agents built a new exploit in just 6 days.
We submitted it to Google and waited.
The news came through that we'd done what should’ve been impossible. A full-chain bounty of $250,000, the first awarded under Google’s 2026 rules.
It took just 6 days and $40,000 of compute to construct an exploit that affects a billion users of Chrome on Windows. An intelligence-agency veteran told me his team used to spend 6 months on this kind of vulnerability.
My takeaway: the cost of finding truly critical vulnerabilities is collapsing, for attackers and defenders alike. Restricting powerful models is not the answer; GPT-5.6 Sol is already public.
But defenders have one advantage attackers never will: they can test their own code first.
Assume your software is exploitable. Whoever is hunting your bugs has the same building blocks we did.
This is cause for urgency but not panic.
XBOW is now developing an autonomous product for testing compiled software (desktop applications, servers, embedded devices), and partnering with the world’s top organizations to design that product.
If you’d like to be one of them, get in touch.
P.S. Restart Chrome whenever the Update button appears!
Greg retweeted
We discovered a sophisticated recording device that was hidden inside one of our offices. We used our models to understand the device and where it had come from, identifying that a specific employee had planted it a few days earlier. We referred the matter to the FBI, and we’re grateful to the agents and prosecutors who moved quickly to make an arrest. The FBI’s investigation is ongoing and we will continue to support their work.
At this time, we have no indications of this individual inappropriately accessing or exfiltrating model weights, source code, or customer data. The employee was terminated.
We take protecting our technology, data, and people seriously, and as a matter of national importance. Our security program is designed to protect against a wide range of threat actors, from insider risks to cybercriminals to nation states, and this case is an example of how AI can help address these sophisticated security threats.
Greg retweeted
The guy who built this digital whip for Claude Code is definitely getting a lifetime Claude ban for “abusive or cruel behavior.”
Greg retweeted
I am working on three apps at the same time right now, HabitKit, FocusKit and a new project.
A year ago I would have called that a focus problem. Now, I think it is simply how building software works with AI agents. My day looks like this: write a prompt, switch to the next project, write a prompt, switch back, review, repeat. While one agent is building, the others are waiting for input. But this workflow is SO mentally taxing.
One project alone doesn't fill my time anymore. Running several in parallel is the only way I've found to actually use the capacity these tools give me.
The cost: a lot of open threads, a lot of context switching, and MANY days that feel messy. Maybe faster models and shorter build times change this again but for now, parallel it is.
Greg retweeted
I JUST CANCELLED ALL OF MY CHATGPT SUBSCRIPTIONS.
OpenAI just scammed everybody and BridgeMind is now starting a boycott against OpenAI.
They cut the usage in half yesterday and said better efficiency makes up for it.
This is a lie. GPT 6.1 Sol is just GPT 6 Sol with RL to look better on benchmarks.
If we keep paying, Anthropic and every other lab will follow. Cutting usage is profitable for them.
Do not let OpenAI get away with this.
Greg retweeted
Bro to bro- do not try entrepreneurship if you don't have a high tolerance for uncertainty. For long periods of time, you genuinely won’t know if you’re early, wrong, unlucky, or just stupid. You need to be cheap before you can afford not to be. Because raising money and burning it is easy. Building something people are willing to pay for is hard. You need high self esteem and a low ego and you've to be comfortable being wrong, looking stupid and changing your mind. Most importantly, learn how to lose without becoming a loser. Because you’re going to lose a lot- money, people, deals & time. Just don’t lose your ability to think clearly. And btw, don’t go looking for motivation. It is useless after a while. What you really need is stamina. Both physical & mental.
Greg retweeted
🚨 UPDATE: Helium App2Web is live.
Helium serves millions of users for apps like Locket, Hallow, & Wisprflow.
Now, we’re launching App2Web: the best way to stop paying 30% fees.
In 2025, Courts ruled apps could send US users to web, but saw conversions tank.
We spent a year optimizing every inch of app2web with a fully-customizable web editor, smart user targeting, pre-loading optimizations, dynamic fallbacks & payment retries.
The results are wild. On average, we see an increase of +40% proceeds per user.
And of course, it’s fully compliant.
👇 if you want to learn more.
Greg retweeted
This year is my 10th year as an entrepreneur.
10 random facts and thoughts:
- It took me 2 years to make $1
- 88% of my projects failed
- You never know when it’ll work
- Once it works, everything is easier
- Understand momentum. Ride the waves.
- Product market fit, or No
- It's a lonely journey
- Doing is better than thinking
- Failing is better than thinking
- Sleep 8 hours. Exercise for 1 hour
Greg retweeted
Claude Fable 5 will be available again globally tomorrow.
After a series of productive conversations with the US government, we're redeploying the model with a new set of classifiers to target and block more cybersecurity tasks. In the near term, some routine tasks like coding and debugging will fall back to Opus 4.8. We’ll continue to refine these classifiers over the coming weeks to reduce false positives and better distinguish genuine misuse from legitimate requests.
We’ve also begun drafting a consensus framework—with Amazon, Microsoft, Google, and other Glasswing partners—for assessing the severity of AI jailbreaks and how AI developers should respond to them. We invite other industry partners and model providers to join us in this effort.
Finally, we’re scaling up our collaboration with the US government on model testing and safeguards. This will include pre-release access to models and safeguards for evaluation, information sharing on jailbreaks and misuse, and dedicated resources for joint research.
Thank you to our users for your patience, and to our partners across the government, industry, and the research community who worked alongside us to make Fable 5 available again.
Read our full blog: anthropic.com/news/redeployi…
