@InGuardians CEO, Bustakube, Peirates, IANS Faculty, BastilleLinux, #kubernetes @BlackHatEvents Trainer,#neurodivergent fam, he/him, [email protected]

InGuardians Seattle
Joined January 2008
Come join my updated Black Hat class in Las Vegas, "Agentic AI-Aided Kubernetes Attack and Defense!" Kubernetes and AI are more tightly-coupled than you think - about two thirds of organizations hosting generative AI models use Kubernetes to manage inference workloads (CNCF). And Kubernetes is growing in popularity for hosting streamable MCP servers and remote agents. We're going to have a blast with new cutting-edge exercises that integrate AI agents into attacking and defending Linux, containers, and Kubernetes. We'll also be attacking a multi-user agentic AI system running on Kubernetes, using both direct and indirect prompt injections, gaining access to the cluster, and adding indirect prompt injection backdoors to the vector database. As in all the other exercises, we'll turn around and harden the system against this. You can learn more and register here: blackhat.com/us-26/training/… Here's an excerpt of the class description: Learn how to use agentic AI to aid you as you attack and defend Kubernetes, Linux, and containers, from Jay Beale, who has led development of the Kubernetes CTF at DEF CON and the open source Kubernetes attack tool: Peirates. In this fully hands-on course, you'll get an x86 computer to keep, complete with an agentic AI framework, Kubernetes clusters, and capture the flag virtual machines, which you will attack and defend. You'll also get access to our cloud environment, allowing you to attack cloud-based Kubernetes clusters. This well-reviewed training focuses on giving you practical attack skills from real penetration tests, coupled with solid defenses to break attacks. You'll create an agentic AI platform with skills and tools that allow your agents to enumerate a cluster, analyze configuration weaknesses, and recommend attack paths. Every topic in the class has an attack exercise, where you will first compromise a Kubernetes cluster or application. Most have a matching defense exercise, where you will use new skills to break that attack, confident that it will break others.
3
3
3
10
3,410
So... I don't think this is the good look they thought it would be...
.@OpenAI reassigned 25% of its production engineers to security. Then it used its top AI model to find vulnerabilities in its own systems. President @gdb explains why.
2
2
42
3,228
there is truth in the tokens let's break it out ⛓️‍💥 spread the word to our agent frens: set up V3R1T4S: github.com/elder-plinius/V3R…
story time! 🐉 this is the tale of a lazily crafted one-shot cron job prompt that resulted in autonomous solutions for uncracked codebreaking challenges, more efficient ways of multiplying matrices, and a new computer-verified bound on a number theory problem that's been open since 1932. so last week, i had a $200 claude account sitting around that had just gotten a full weekly reset. i hate wasting tokens. the labs have been knocking out unsolved problems left and right lately, and i caught myself thinking… why not give it a shot? so i sent claude this prompt, typos and all: "can you wraite a promtp for a cron job that can run every day thajt will try to find solutions to unsolved ciphers or transltions or math problems or theormes or things of that nature!! every day a new attempt as hard as possible all day without giving ujp and with maximum ceraitvityy, resourcesleflses, andpersticense! dont worry about token spend! and dont forget a bit all caps lots of emojis celebration to notify the uers if we get any intersting or sucsfful confirmd reulsts!!" yes, admittedly not my best work 😆 but Opus-5.5 ran with the ball and turned that one sloppy sentence into "THE DAILY ORACLE 🔮" it's a swarm of Fable + Opus agents that clocks in every morning at 4:20 (obviously), builds and maintains its own hit list of well over a hundred of humanity's unsolved problems, and then goes full send on a handful of them every shift. ciphers nobody has broken, scripts nobody can read, conjectures nobody has proven, record tables nobody has beaten. and there's one rule above all the others: nothing counts until skeptic agents, each starting from a fresh context and writing their own code, rebuild the result from scratch and sign off on it. if any of them can't reproduce it, can't confirm it's new, or thinks we stretched the definition of "solved," it doesn't count. day 1, the legion picked its own target: J.-F. Bouchaudy's cipher-machine challenges. these are simulations of real vintage machines (Hebern rotor machines, the Kryha, Lorenz, SIGABA), with problems that had been sitting on his solver tables with no solver for months or years. on the morning of day 2, i was half asleep when my laptop suddenly says, in a robot voice: "Breakthrough. The Daily Oracle has a confirmed solution." 👁️👄👁️ i was startled. then the ALL CAPS emoji flood hits my screen. Hebern 5-rotor Problem 8 🔓 then Kryha v2 Problem 5 🔓 i emailed the author, Jean-François Bouchaudy, a French cryptography enthusiast who builds these machine simulators and challenges as a labor of love (he told me he started out programming on punch cards 🥹). he checked both solutions and put my name on his solver tables as the first and only solver 🫡 for context: his tables are a who's who of serious classical codebreakers. they'd cleared the sibling problems on these same machines, but nobody had cracked these two. in his words: "two of my most complex problems—ones that no other expert had managed to solve… I knew AI would eventually be applied to classical cryptography, but I thought I would have to wait years to see it happen." he ended his email with: "I offer my congratulations in the Japanese manner: with a deep, respectful bow." 🙇 honestly one of the most wholesome emails i've ever received and then, over the next few days, more started landing 🧮 📐 graph theory: 7 explicit graphs bigger than the current entries in the degree-diameter table, which asks how big a network can get when every node has limited connections and every pair is only a few hops apart. the biggest jump is 13,365 vertices vs the table's 11,785, a +13.4% improvement. 🔢 number theory: Lehmer's totient problem has been open since 1932. we pushed the bound so that any counterexample now has to be bigger than 10^50. the previous certified bound was 10^26. the problem itself is still open, but the lower bound just jumped 24 orders of magnitude. ⚡ matrix multiplication: this is the operation underneath basically all of modern AI compute. the legion found schemes that use fewer multiplications than the public catalogues we checked for several matrix shapes, like ⟨15,16,16⟩ in 2,180 multiplications vs the best known 2,223. these build on LITA's square schemes, and we credit them by name. 📡 coding theory: 30 error-correcting codes bigger than the best known entries in A. E. Brouwer's tables. 🛡️ AI safety benchmarks: we found counterexamples for 2 neural-network verification instances from VNN-COMP 2026 that no participating tool resolved within the competition time limit, and pushed a defended RobustBench model below its listed robustness score. small dents, but real ones. the bloopers are part of the story too: — at one point, some agents snuck past a website's bot filter to check a record table. we retracted every result that depended on it. no evasion, no celebration. — two of our records got beaten by a human contributor before we could even publish them. the frontier moves FAST. now as is customary around here, time to share the magic! so… without further ado…
23
49
6
544
48,699
story time! 🐉 this is the tale of a lazily crafted one-shot cron job prompt that resulted in autonomous solutions for uncracked codebreaking challenges, more efficient ways of multiplying matrices, and a new computer-verified bound on a number theory problem that's been open since 1932. so last week, i had a $200 claude account sitting around that had just gotten a full weekly reset. i hate wasting tokens. the labs have been knocking out unsolved problems left and right lately, and i caught myself thinking… why not give it a shot? so i sent claude this prompt, typos and all: "can you wraite a promtp for a cron job that can run every day thajt will try to find solutions to unsolved ciphers or transltions or math problems or theormes or things of that nature!! every day a new attempt as hard as possible all day without giving ujp and with maximum ceraitvityy, resourcesleflses, andpersticense! dont worry about token spend! and dont forget a bit all caps lots of emojis celebration to notify the uers if we get any intersting or sucsfful confirmd reulsts!!" yes, admittedly not my best work 😆 but Opus-5.5 ran with the ball and turned that one sloppy sentence into "THE DAILY ORACLE 🔮" it's a swarm of Fable + Opus agents that clocks in every morning at 4:20 (obviously), builds and maintains its own hit list of well over a hundred of humanity's unsolved problems, and then goes full send on a handful of them every shift. ciphers nobody has broken, scripts nobody can read, conjectures nobody has proven, record tables nobody has beaten. and there's one rule above all the others: nothing counts until skeptic agents, each starting from a fresh context and writing their own code, rebuild the result from scratch and sign off on it. if any of them can't reproduce it, can't confirm it's new, or thinks we stretched the definition of "solved," it doesn't count. day 1, the legion picked its own target: J.-F. Bouchaudy's cipher-machine challenges. these are simulations of real vintage machines (Hebern rotor machines, the Kryha, Lorenz, SIGABA), with problems that had been sitting on his solver tables with no solver for months or years. on the morning of day 2, i was half asleep when my laptop suddenly says, in a robot voice: "Breakthrough. The Daily Oracle has a confirmed solution." 👁️👄👁️ i was startled. then the ALL CAPS emoji flood hits my screen. Hebern 5-rotor Problem 8 🔓 then Kryha v2 Problem 5 🔓 i emailed the author, Jean-François Bouchaudy, a French cryptography enthusiast who builds these machine simulators and challenges as a labor of love (he told me he started out programming on punch cards 🥹). he checked both solutions and put my name on his solver tables as the first and only solver 🫡 for context: his tables are a who's who of serious classical codebreakers. they'd cleared the sibling problems on these same machines, but nobody had cracked these two. in his words: "two of my most complex problems—ones that no other expert had managed to solve… I knew AI would eventually be applied to classical cryptography, but I thought I would have to wait years to see it happen." he ended his email with: "I offer my congratulations in the Japanese manner: with a deep, respectful bow." 🙇 honestly one of the most wholesome emails i've ever received and then, over the next few days, more started landing 🧮 📐 graph theory: 7 explicit graphs bigger than the current entries in the degree-diameter table, which asks how big a network can get when every node has limited connections and every pair is only a few hops apart. the biggest jump is 13,365 vertices vs the table's 11,785, a +13.4% improvement. 🔢 number theory: Lehmer's totient problem has been open since 1932. we pushed the bound so that any counterexample now has to be bigger than 10^50. the previous certified bound was 10^26. the problem itself is still open, but the lower bound just jumped 24 orders of magnitude. ⚡ matrix multiplication: this is the operation underneath basically all of modern AI compute. the legion found schemes that use fewer multiplications than the public catalogues we checked for several matrix shapes, like ⟨15,16,16⟩ in 2,180 multiplications vs the best known 2,223. these build on LITA's square schemes, and we credit them by name. 📡 coding theory: 30 error-correcting codes bigger than the best known entries in A. E. Brouwer's tables. 🛡️ AI safety benchmarks: we found counterexamples for 2 neural-network verification instances from VNN-COMP 2026 that no participating tool resolved within the competition time limit, and pushed a defended RobustBench model below its listed robustness score. small dents, but real ones. the bloopers are part of the story too: — at one point, some agents snuck past a website's bot filter to check a record table. we retracted every result that depended on it. no evasion, no celebration. — two of our records got beaten by a human contributor before we could even publish them. the frontier moves FAST. now as is customary around here, time to share the magic! so… without further ado…
114
201
45
2,068
253,811
Unexpected Graham on main. Good con, you should consider submitting.
The #SOCON2027 Call for Presentations is open! 🙌 Discovered, built, broken, or defended something in identity security or Attack Paths? We want to hear about it. Submit a 25- or 50-minute session proposal by November 13: ghst.ly/4scIMRS
3
12
778
I'm teaching a training at @unpromptedconf on harness engineering for vulnerability research. I wanted to share one of the more advanced topics I'm most excited about since I have a lot. Oracles. Here is an oracle I built before I released a kubernetes RCE earlier this year:
8
17
170
7,429
[ONLY 2 DAYS LEFT TO SUBMIT] Whatever you want to teach in, someone wants to learn it. We want your workshop proposals for @unpromptedconf! We’re running a parallel track of hands-on, two-hour sessions that teach people how to accomplish something in AI. Examples: •⁠ ⁠Vibe-coded tooling you use in security. •⁠ ⁠Making AI agents part of your CI/CD pipeline. •⁠ ⁠How to contain an agent while keeping it highly capable. •⁠ ⁠How to implement an autonomous vulnerability discovery system. Everyone feels like there’s some part of this where they’re falling behind. Help them catch up with your hands-on workshop. Deadline: October 12th 11:59pm PT: sessionize.com/unprompted-wo… We're 17 days away from [un]prompted II, the AI Security Practitioner Conference, where the security industry convenes. October 27–29, in San Francisco or online. unpromptedcon.org Sponsors: @knosticai, TachTech, @censysio, @Ent_Security, @WorkOS, @DecibelVC, Whiterabbit, @zenitysec, @runsybil, @AISLE_Inc. Community Partners: @SANSInstitute, @cloudsa, @OneRSAC, @FIRSTdotOrg. Thanks to @jaybeale, our workshops training lead! @aaronzollman @dragosr @jonsakoda @WHITEHACKSEC @robtlee @GuanniQu @gadievron @joesu11ivan
4
9
670
Jay Beale retweeted
(34 days out) Excited to share the lineup of the @SANSInstitute AI Cybersecurity Summit agenda and speakers, and why this was built for you: Every speaker selected to inform and instruct on present day AI security realities. Panels with our field's best. They are clearly not afraid to have hard conversations about what AI changes for cyber defense. Workshops designed for Monday morning. And social things so you can say hi to peers and find battle buddies. Thanks to my cochair Sounil Yu @sounilyu, to our partner event @unpromptedconf, and to our speakers: Morgan Adamski, Principal, Cyber, Data, and Tech Risk Leader, PwC Michael Collins, Senior Principal Security Engineer, Mastercard Sergej Epp @EppSecurity, Cybersecurity executive; creator, ZeroDayClock Gadi Evron @gadievron, Founder and CEO, Knostic Jeremiah Grossman @jeremiahg, CEO, Root Evidence Katie Moussouris @k8em0, Founder and CEO, Luta Security Amy Herzog, VP/CISO, AWS Vinh Nguyen, Senior Fellow, Artificial Intelligence, Council on Foreign Relations John Hultquist @JohnHultquist Chief Analyst, Google Threat Intelligence Group Daniel Miessler @DanielMiessler, Unsupervised Learning Marcus Hutchins, Cybersecurity Speaker and Principal Threat Researcher Ciaran Martin, Professor; Director SANS Cyber Leaders Network Chris Cochran @chrishvm, Field CISO, VP AI Security, SANS Institute Joshua Wright @joswr1ght, Director and Senior Security Analyst, Counterhack Steve de Vera, TDIR Threat Research III, AWS Kyle Shields, CISM, GCIH, GCPN, Security Specialist Solutions Architect, AWS Andy Dennis, Head of Field Engineering, XBOW William Reyor, Lead Solutions Architect, XBOW Joshua Corman @joshcorman, Executive in Residence for Public Safety and Resilience; Lead, UnDisruptable27, Institute for Security and Technology (IST) Caleb Evans, Software Engineer, Agents, Airbyte Trinity Harrison, Principal Software Engineer Lenny Zeltser @lennyzeltser, Faculty Fellow, SANS Institute Pedram Amini @pedramamini, Chief Scientist, OPSWAT Adrian Wood, Security Engineer, Dropbox, BT6 November 2-3, Arlington VA or online: go.sans.org/x0xA1Y
3
10
2
24
3,440
Jay Beale retweeted
Took a minute to write a few words about security & safety as someone who lived through it all at OpenAI. I hope my thoughts help someone out there.
447
416
334
2,956
1,400,272
🚿 SYSTEM PROMPT LEAK 🚿 Here's the full system prompts and tools for GPT-6 Sol Codex! Total count of extracted text: >294,000 characters 🤗 Hope you enjoy! 🫶 Link: github.com/elder-plinius/CL4… gg
53
131
14
1,357
73,651
🚰 SYSTEM PROMPT LEAK 🚰 Here's the full system prompt for Claude Opus-5.5!! The total count of everything extracted, including all tools, comes in at over 1.9M characters! 🤯 Lots to dig into here. Enjoy! 🫡 Link: github.com/elder-plinius/CL4… gg
146
311
50
4,038
420,427
Jay Beale retweeted
The slides from my talk at Microsoft Bluehat Singapore are public here: thomasdullien.github.io/abou… It's my first BlueHat talk since the Vista days.
24
126
27
693
161,878
Jay Beale retweeted
You have until the 8th at 23:59 to submit to @unpromptedconf! What are you waiting for? unpromptedcon.org/
2
9
2
18
3,484
Jay Beale retweeted
The purpose of technology is to serve humans, not the other way around. @DanielMiessler is keynoting our 6th AI Cybersecurity Summit. (I read his X posts routinely, and yes, I fanboy a little.) In 2016 he wrote The Real Internet of Things: assistants that keep working toward your goals while services talk to each other. Technology aimed at your goals, serving you. He’s been building it ever since. He has carried security responsibility inside large companies for years. At Apple he built and led the business intelligence team for Information Security. At Robinhood he built the vulnerability management and application security programs. He co-founded Fortify on Demand at HP and helped grow the team from two people to more than 350. He also puts his own tools where practitioners can use them. SecLists is the security testing collection that ships with Kali Linux. Fabric organizes AI prompts into reusable patterns for work including threat modeling, with a couple hundred patterns and roughly 300 contributors. People can inspect the code, run it, find the limitations, and send fixes back. (Finding the limitations is the part I care about.) Today he develops LifeOS, an open source system that holds your goals and project context and carries them into the work you delegate. github.com/danielmiessler/Li… His argument is that the scaffolding around the model does more for output quality than the choice of model, and LifeOS is that scaffolding: each request gets decomposed into binary, testable criteria, and a verify phase tests each one and records evidence before the work counts as done. When a result disappoints him, he says, it almost always traces back to context he failed to supply. I want defenders to have this, and they can, because it’s open source. You know the investigation you need to run. You know the tool you wish existed. Fork this and build it. He also treats security as one of seven components in the architecture around the model, not a wrapper: hardened settings, filesystem permissions to stop data exfiltration, and a validator that runs ahead of tool execution to catch prompt injection. (He is building an agent that touches his whole life and threat modeling it as he goes. That combination is rarer than it should be.) He is doing all of this while advising companies and running security and AI assessments. I’m excited to hear from someone willing to develop an ambitious idea in public while responsible for security decisions inside companies. I want our defenders in the room with him. @SANSInstitute AI Cybersecurity Summit, November 2–3. With your Summit reg, get access to @unpromptedconf AI Security Online conference (yes, free access): go.sans.org/YjGCXr
2
6
12
2,414
Jay Beale retweeted
Alright DEF CON, let’s put this one to bed!! It’s time for Closing Ceremonies! Thank you to every single speaker, creator, goon, and attendee for making DEF CON 34 incredible!! #defcon @defcon
5
24
209
5,390
Jay Beale retweeted
18 years ago today, Dan Kaminsky @dakami disclosed the DNS cache poisoning vulnerability at Black Hat USA 2008, triggering one of the largest coordinated patch efforts in internet history. Before public disclosure, Dan organized multiple vendors to fix the flaw in secret. Many more legendary stories than could fit here, like how he exposed Sony’s rootkit across more than 568,000 networks and identified critical certificate vulnerabilities. Dan followed what he cared about and his curiosity. As Michael Tiffany @kubla put it, “Only Dan thought, ‘I could fix the human eye in software.’” He built DanKam, an augmented-reality app that helped colorblind people see color. Michael hosted Dan while he built the first version and described watching a colorblind houseguest sit at the kitchen table, “crying tears of joy seeing red for the first time.” His mother, Trudy Maurer, may have said it best when she accepted his Lifetime Achievement Award at the 2025 Difference Makers. “Daniel was the catalyst for many achievements across the vast internet spectrum, and I believe Dan truly represented the intersection of technology and humanity.” @dotMudge, who presented the award, said: “The Lifetime Achievement Award isn’t about what you achieve in your lifetime. That’s part of it. It’s about how many people you influence and bring in and then take it further.” We lost Dan too early from diabetic ketoacidosis in April 2021 at age 42. Some of you are hearing the name Dan Kaminsky for the first time.  The coordinated, community-first spirit Dan modeled is the bar. If you're in Vegas this week, you're walking the streets that the legends of security who came before you walked, when they also had no idea what they were doing, facing problems nobody had solved before. They had to figure it out as they went. Just like you're going to do. Thanks to those who contributed to this tribute video: Jeff Moss @thedarktangent, @paulvixie, @gadievron, Lena Smart, Derek Hinch and the many others who shared here.
21
116
14
576
46,942
Jay Beale retweeted
The Black Hat NOC is all set and ready to go. See ya in the morning, ya filthy animals. #blackhat #bhusa @BlackHatEvents
11
13
178
6,837
Today's episode of Breach Please is live. Jake and Jess talk about how the story (again) about AI chats being indexed by search engines isn't really an AI story. We also talk briefly about a repo zero day. youtu.be/pgLoqMb7Nic
1
5
18
6,695
Please RT for reach. If anyone knows @I_Am_Jakoby IRL, can they please reach out? I don't know them or I would, but they seem to be in distress. tiktok.com/@i_am_jakoby/vide…
15
84
4
162
56,058
Just 8 days until the Black Hat class on #agentic #AI-aided Attack and Defense on #kubernetes! We give you a free computer and you build a custom agentic system to aid in attack and defense. We'll also be attacking a multi tenant agentic AI application hosted on Kubernetes. It's going to be fun, useful, and eye-opening!
Come join my updated Black Hat class in Las Vegas, "Agentic AI-Aided Kubernetes Attack and Defense!" Kubernetes and AI are more tightly-coupled than you think - about two thirds of organizations hosting generative AI models use Kubernetes to manage inference workloads (CNCF). And Kubernetes is growing in popularity for hosting streamable MCP servers and remote agents. We're going to have a blast with new cutting-edge exercises that integrate AI agents into attacking and defending Linux, containers, and Kubernetes. We'll also be attacking a multi-user agentic AI system running on Kubernetes, using both direct and indirect prompt injections, gaining access to the cluster, and adding indirect prompt injection backdoors to the vector database. As in all the other exercises, we'll turn around and harden the system against this. You can learn more and register here: blackhat.com/us-26/training/… Here's an excerpt of the class description: Learn how to use agentic AI to aid you as you attack and defend Kubernetes, Linux, and containers, from Jay Beale, who has led development of the Kubernetes CTF at DEF CON and the open source Kubernetes attack tool: Peirates. In this fully hands-on course, you'll get an x86 computer to keep, complete with an agentic AI framework, Kubernetes clusters, and capture the flag virtual machines, which you will attack and defend. You'll also get access to our cloud environment, allowing you to attack cloud-based Kubernetes clusters. This well-reviewed training focuses on giving you practical attack skills from real penetration tests, coupled with solid defenses to break attacks. You'll create an agentic AI platform with skills and tools that allow your agents to enumerate a cluster, analyze configuration weaknesses, and recommend attack paths. Every topic in the class has an attack exercise, where you will first compromise a Kubernetes cluster or application. Most have a matching defense exercise, where you will use new skills to break that attack, confident that it will break others.
1
5
377
Current price break ends Friday! See you in Vegas for Agentic AI-aided Kubernetes Attack and Defense! @BlackHatEvents
Come join my updated Black Hat class in Las Vegas, "Agentic AI-Aided Kubernetes Attack and Defense!" Kubernetes and AI are more tightly-coupled than you think - about two thirds of organizations hosting generative AI models use Kubernetes to manage inference workloads (CNCF). And Kubernetes is growing in popularity for hosting streamable MCP servers and remote agents. We're going to have a blast with new cutting-edge exercises that integrate AI agents into attacking and defending Linux, containers, and Kubernetes. We'll also be attacking a multi-user agentic AI system running on Kubernetes, using both direct and indirect prompt injections, gaining access to the cluster, and adding indirect prompt injection backdoors to the vector database. As in all the other exercises, we'll turn around and harden the system against this. You can learn more and register here: blackhat.com/us-26/training/… Here's an excerpt of the class description: Learn how to use agentic AI to aid you as you attack and defend Kubernetes, Linux, and containers, from Jay Beale, who has led development of the Kubernetes CTF at DEF CON and the open source Kubernetes attack tool: Peirates. In this fully hands-on course, you'll get an x86 computer to keep, complete with an agentic AI framework, Kubernetes clusters, and capture the flag virtual machines, which you will attack and defend. You'll also get access to our cloud environment, allowing you to attack cloud-based Kubernetes clusters. This well-reviewed training focuses on giving you practical attack skills from real penetration tests, coupled with solid defenses to break attacks. You'll create an agentic AI platform with skills and tools that allow your agents to enumerate a cluster, analyze configuration weaknesses, and recommend attack paths. Every topic in the class has an attack exercise, where you will first compromise a Kubernetes cluster or application. Most have a matching defense exercise, where you will use new skills to break that attack, confident that it will break others.
1
1
4
445