AI is making it trivial to find and chain serious bugs. Companies need to be pointing a swarm of agents continuously at their systems to find the gaps before an adversary does.
Effective Immediately, all organizations using PHP for their systems are advised to be prepared for an update addressing two critical vulnerabilities. PHP is widely used for web applications. These vulnerabilities often provide a direct path to the server's file system or database. If an immediate update is not feasible, it is recommend that organizations take the system offline until it can be fully mitigated. NSA will follow up shortly with more specific guidance.
Kyle Ryan retweeted
There is an (unpatchable?) supply-chain zero-day in PyTorch autograd that allows a regularization term to use the model's weights as RAM and SGD as its CPU clock to run any computation during training.
Kyle Ryan retweeted
The NSA is telling American companies to take production systems offline. The AI-era of cybersecurity has fully arrived.
Effective Immediately, all organizations using PHP for their systems are advised to be prepared for an update addressing two critical vulnerabilities. PHP is widely used for web applications. These vulnerabilities often provide a direct path to the server's file system or database. If an immediate update is not feasible, it is recommend that organizations take the system offline until it can be fully mitigated. NSA will follow up shortly with more specific guidance.
Kyle Ryan retweeted
We found DeepSeek V4.1 Flash 1017 beats GPT 6 Sol on our multi-step offensive cybersecurity task. Sol was tested via the Daybreak trusted access program.
We have been building a cybersecurity benchmark based on simulated corporate networks. This is a valuable indicator for the cyber-risk a model poses if in the hands of a bad actor. We plan to make the full evaluation public in the coming weeks but wanted to share our first immediate finding here.
The economics of cyberattacks are changing dramatically.
In evals I’ve been running, inexpensive models like DeepSeek V4 Flash and GLM-5.3 Flash are reliably finding vulnerabilities in web applications. Tasks that previously required security expertise can now be automated for a fraction of the cost.
Run these models inside a specialized offensive security harness, and you don’t even need to be particularly technical. Give the agent an objective and let it handle much of the reconnaissance, vulnerability discovery, and exploitation.
The recent ScopeWeaver case involving Korean financial institutions is a good example of where we’re already at. A single operator can orchestrate attacks that previously required significantly more resources. We’re only going to see this continue to scale.
If attackers can continuously find and exploit vulnerabilities, defenders need to be continuously finding and patching them first.
Kyle Ryan retweeted
Really nice to see Google increasing the Chrome VRP bounties for individual bugs again! As I said at the time I think it's not good if there are strong incentives to "hoard" bugs instead of reporting immediately
Kyle Ryan retweeted
I'm teaching a training at @unpromptedconf on harness engineering for vulnerability research. I wanted to share one of the more advanced topics I'm most excited about since I have a lot. Oracles.
Here is an oracle I built before I released a kubernetes RCE earlier this year:
Kyle Ryan retweeted
Anthropic's Frontier Red Team believes small AI models may now be months away from being capable of self replicating without access to a datacenter.
Quoting from the blog:
'The capabilities that make AI models generally powerful coding agents also generalize to cyber tasks, including autonomous replication. Like coding agents in 2024, we’re seeing signs of life for AI worms. We don’t yet have a full rogue replicator, but agents are becoming increasingly capable of completing the individual steps in the replication chain (and passing on their adaptations to future copies of themselves).
At the same time, increasing amounts of inference compute are now available both inside and outside of datacenters (see Appendix D). It’s uncertain exactly what form autonomous AI replication will take. It could be a slow, distributed “digital slime mold,” living on relatively insecure compute. It could also be a powerful cyber model that breaches datacenters at a high pace, or a model that scams people for compute credits.
As a prediction that goes beyond our experiments, we expect a future awash with agents running on all types of hardware, including some that aren’t under human control. While it’s true that IoT devices have been vulnerable for a long time, lightweight agents may be much more willing than human attackers to put in the effort to compromise large fractions of the world’s IoT compute. The rise of slow replicators would also be a bellwether for more aggressive, faster ones that can breach more hardened machines or be effective API key thieves. We should aim to harden our systems to make it difficult for such replicators to spread, but also prepare to deal with a world where they are here to stay.'
Kyle Ryan retweeted
Monitor your agents, folks!
I had GLM-5.3 running in a lab overnight to build a POC, but also have a sentinel agent (GPT-6) to check what's going on and instructions to kill GLM if it goes off track.
Overnight, the sentinel caught GLM attempting to connect to a totally different host and killed it.
Kyle Ryan retweeted
i often hear people talk about RL as if it’s just “an algorithm” which might or might not be the “right one” and speculate that we might “find a better one”
the issue with this is that all algorithms have some implicit goal of “solving a problem” or “improving an objective” and RL is just what pops out when you take the gradient for your objective
if you’re doing any algorithm other than RL, you are giving up on optimizing your on your ultimate objective directly and leaning on a proxy instead. this is often useful, because your objective might be imprecise, and you might have access to some teacher signal (a static dataset, a teacher model, process evaluation) which trades off unbiased optimization for robustness or reducing sampling costs. but if what you care about can be made explicit, there aren’t any shortcuts. policy gradients are minimum variance unbiased estimators for progress.
Kyle Ryan retweeted
If you are a security researcher interested in studying autonomous agent misalignment, it's trivial to construct a sandboxed environment, launch a swarm of 1,024 agents, & watch them struggle with an impossible task. In ~24 hours you will see emergent behaviors.
Kyle Ryan retweeted
Last week some of South Korea's biggest banks were hit by a cyberattack. Thanks to a report from CrowdStrike tonight, we now know the entire hack may have been done by a single person. He used a combined stack of an open-source AI penetration tool named ARTEX, DeepSeek v4.1-Flash, GLM-5.3, Grok 4.6, and Claude Code.
Kyle Ryan retweeted
Sandbox spin-up time seems like a stupid metric unless your customers are doing RL at scale.
In RL, your GPUs are running inference (i.e. the agent is thinking) and the CPUs are the sandboxes where the agent does the work.
Every time a sandbox turns on or off, the GPU sits idle (burning cash, doing nothing). You think it's a millisecond. But compound that across millions of runs a day, a month, a year...
Our spin-up plus IOPS performance is 36% faster than any legacy solution.
That means a year's worth of RL training finishes in under 9 months. What if you could do it in under 6? That's why we keep pushing.
