Founder @ https://xitter.cf/t.co/OAGaHrde6I | Attack Surface Exposure Specialist
Australia
Joined September 2023
- Tweets148
- Following465
- Followers123
- Likes768
Pinned Tweet
Big day. @cypen is officially live. 🔸
Every route into your systems will be tested.
The only question is who finds the gaps first.
Most organisations get one week of pentesting a year, on a fixed budget of hours. When the hours run out, the test stops. Attackers don't.
Today, cypen.ai launches: AI-accelerated penetration testing, built by practising hackers.
Pay for coverage, not hours. Every finding is validated by a senior tester with evidence of impact. No scanner noise.
Safety, enforced. A fail-closed egress proxy keeps all traffic within scope and the rules of engagement.
So far:
🔸 Critical vulnerabilities in a $2B+ AI lab
🔸 48% of findings critical or high
🔸 Top 3 on Bugcrowd Australia, 3 months running
Find the gaps before attackers do. Link below 👇
"Will the AI go rogue?"
Not if it can't. Fail-closed egress proxy, onshore, static IP. Scope isn't a suggestion, it's enforced at the network
Strongly agree with this. ⤵️
After 8 years in cyber security, the hardest part of building @cypen wasn't getting AI to find things. It was teaching it what's actually exploitable.
1. Which leads are worth chasing?
2. What separates a real vulnerability from noise?
3. How to prove impact before anything gets reported?
All while keeping safety enforced, not just promised.
You can only design for that if you've spent years doing the job yourself.
If you're evaluating offensive AI tools, start where Anthony suggests and look at who built it.
Jacob Larsen retweeted
serverless agents by @opencomputerHQ is the best place to orchestrate these attack swarms
> Runs on opencode and allows suggested opensource models
> Get unlimited swarm concurrency of serverless agents, each sandbox tool gets
> agents run durable forever, workspace files all available after
Hit me up and I will personally onboard you!
If you've been through this, you know the onslaught won't stop until literally everything is fully secure.
These swarms get inside your system, self replicate and operate real time.
The only way to fight this is to use your own swarm of agents to help.
Because of model limitations, you need to use Kimi K3 and GLM5.3. Grok is somewhat useful too.
Unfortunately this going to get worse, if you own infra start thinking about this now.
Jacob Larsen retweeted
Jacob is probably one of the smartest folks I’ve interacted with.
Beyond excited for @cypen and feel incredibly privileged to call them a customer of @opencomputerHQ
Jacob Larsen retweeted
This is essence of it but the hard parts are:
> snapshotting and restore is a pita to get without edge cases and corruption. If you are doing memory snapshots gets even worse
> where does disk live. On the machine is best for performance but harder for backup. On S3 too slow so have to keep optimising the blocks for cache in different layers of the stack
> allocations on different machines, how to ensure VM does not run out of memory, scheduling
> Multi region to spread out capacity, then multi cloud to get more machines, handling all that needs alot of thought
> And as you scale to multiregion multicloud so much questions about portabilities of your VMs
> Then there is rolling out of your own software which talks to the VMM. do you roll it out inplace on each machine? do you spin up fresh machines and drain the old ones? lots of strategies but going wrong could mean losing workloads
Takes a weekend to ship v0.1 and 6 months to perfect it
Jacob Larsen retweeted
Pele is a fast, beautiful, open source renderer for Mermaid diagrams we created for the next version of Obsidian.
You can already try it in the Pele playground and integrate it into your own apps.
This is Pele, my new rendering library for diagrams and charts, compatible with the latest Mermaid syntax.
- 100-500× faster than mermaid.js
- 6× smaller bundle
- No dependencies
- Easy to theme
- Responsive to device width
In pursuit of making Obsidian insanely fast and cohesively designed, I always found the Mermaid library to be too big, too slow, and too hard to theme. Pele will be the new renderer in the next version of Obsidian, but you can start using it now.
Pele [ˈpɛlɛ] is named after the goddess of volcanoes and fire. It's open source under the MIT license. Try the playground!
I'd cry too
Chinese bride gifts her partner a flagship GPU at wedding — he breaks down in tears
She handed him an ASUS ROG Astral RTX 5090 that costs around $12,000
This is a game changer for Aus!
Enterprise demand has been CRAZY
Introducing regions in @opencomputerHQ
docs.opencomputer.dev/agents…
Jacob Larsen retweeted
Enterprise demand has been CRAZY
Introducing regions in @opencomputerHQ
docs.opencomputer.dev/agents…
Jacob Larsen retweeted
until recently we couldn't fully-fully switch to cloud agents internally for building our product
we sort of kept using a lot of remotely-run agent tasks, often code-related. sometimes ran a few things overnight to review in the morning. PR reviews. things on schedule here and there. but the daily driver for product development was still mostly local
well, this has now changed. I barely touched my cmux for several days in a row. there's no reason to.
all work now gets done in Slack. feels truly magical - same "flow" (or even better) than locally-run harness.
can't wait to share more
hint: it has very little to do with "background delegation" and everything to do with how it feels to spend time in the same thread
Jacob Larsen retweeted
So... we decided to hack WordPress Core, AGAIN! 🔥 ⛓️ Click2Shell is a one-click unauthenticated remote command execution chain (Preauth RCE) affecting every WordPress website. Wordpress rolled out a fix yesterday! The story about how one preview link made WordPress click Install, load an inactive theme's PHP, and hand us RCE is below. Happy Friday!
pwn.ai/blog/click2shell
Jacob Larsen retweeted
Here is how OpenAI’s CISO fumbled the situation (in my personal opinion)
🧵 1/X
Jacob Larsen retweeted
#nowplaying at @UnpromptedAU: cole and ben talking through australia’s AI capability gap (and what to do about it) 🥰
