Offensive Security Researcher @XBOW | A.K.A. none_of_the_above
Buenos Aires, Argentina
Joined November 2016
- Tweets708
- Following397
- Followers3K
- Likes1.7K
Leandro Barragan retweeted
Woot! the @unpromptedau talks are starting to coming come online! đź‘€
This one by @moyix was probably my favorite: 15mins of unadulterated old-school “I’m hacking this because I think I can” followed by a one-shot live exploit demo involving a t-shirt with a cat on it worn by @mdowd. Seriously just go watch it
(and subscribe for the others… More on the way!)
Watch Brendan Dolan-Gavitt: Security Through Obscurity Is Dead and LLMs Killed It unprompted.au/videos/securit…
Leandro Barragan retweeted
I take the bugs from the clankers and bring them down to the bug bounty programs
Worth reading. I’ve had the privilege of watching private presentations by @v_metnew at LHEs and other private competitions. An incredibly talented researcher.
In an impressive GitHub write-up, @v_metnew documents a sandbox escape in Anthropic's Claude Code CLI (CVE-2026-55607). By using a prompt-injected repo with `.git` worktree gitdir confusion, they managed to overwrite `~/.zshenv` and bypass macOS seatbelt, achieving unsandboxed code execution.
Full PoC and details included👇
github.com/Metnew/write-ups/…
#BugBounty
Leandro Barragan retweeted
The write-up from @moyix is finally out! It covers how we discovered three Chrome vulnerabilities: a V8 memory corruption bug and two sandbox escapes (one from V8 and another from the renderer), and chained them together into a full Chrome exploit that earned a $250K bounty!
xbow.com/labs/research/zero-…
Leandro Barragan retweeted
Bueno @ekoparty, mañana con @GastonAznarez vamos a estar presentando nuestra investigación de Ubiquiti Airmax, una historia de antenas y obsesiones
Lo mejor es poner un espacio al final para complicarles el copypaste
Siempre pon una coma (,) en tus contraseñas. De esta manera, si alguna vez termina en una filtración, terminará rompiendo el CSV
SĂgueme para más consejos de ciberseguridad
Readers added context they thought people might want to know
Adding commas to passwords does not break CSV leaks from breaches. Services store passwords as salted hashes not plaintext, and standard CSV parsers quote fields with commas (RFC 4180).
rfc-editor.org/rfc/rfc4180
github.com/OWASP/CheatShe…
news.ycombinator.com/item?id=417354…
Leandro Barragan retweeted
I dunno man, it just doesn't sit right with me that there are public technical blog posts that Claude simply can't read or discuss because of "cyber risk". Who does this protect?
Leandro Barragan retweeted
¡Estamos en Buenos Aires para @Ekoparty! 💚
¿Vas a estar y querés encontrarte con nosotros en el booth? Avisanos a través del formulario de nuestra página.
¿Necesitás una entrada para vos o tu equipo? Tenemos algunas para compartir. ¡Completá el mismo formulario para pedirlas!
xbow.com/events/ekoparty-bue…
It’s so weird to me that we are not seeing many large scale worm-like compromises, esp involving IoT and consumer grade devices, considering how easy it’s to exploit these with any half decent modern model.. this is what terrifies me the most
The vulnpocalypse is turning out a lot like Y2K. InfoSec already had a 0day/Nday problem. The pitch was that everything on the internet would face a constant stream of 0days. Instead, Glasswing, other projects, and people collecting CVEs like Pokemon have resulted in a bunch of things getting patched.
We still haven’t seen a Log4j, Heartbleed, Shellshock, EternalBlue, etc equivalent out of all this. Even if one or two showed up today, based on the predictions, weren’t these supposed to be happening weekly or monthly?
Leandro Barragan retweeted
It's a little hard to internalize that the list of things one person can achieve is rapidly growing. You must think big to match what you're truly capable of now
When I first joined xbow, I thought that having to go though the general counsel when doing vuln disclosure was a bit too much, but I quickly understood that when dealing with a potential partner or customer the last thing you want to do is to burn bridges…
Se nos fue un tipazo. Ojala el cielo esté lleno de aparatos para desarmar asà te entrenés.. que descanses en paz, te vamos a extrañar
Tengo la triste noticia que AndrĂ©s Blanco @6e726d falleciĂł el dĂa de hoy. Se nos fue un gran hacker, amigo y mentor. Memento mori solĂa decirme, Memento Mori.
QEDP
Codex doesn’t have a “Monitor” tool like Claude code. And this bothers me so much. I burned tons of tokens and went through 4 context compactions because the model thought it was a great idea to keep polling a 20 min task and “thinking” while waiting.
The issue seems to be the Codex harness itself, not necessarily Astra.
When Codex is waiting for background work, the harness can keep making repeated model calls to poll for updates. The problem is that each of those calls can carry the existing conversation/context again (Even when nothing has actually changed.)
So while the agent is basically just waiting, it can still keep consuming input tokens.
The goal mechanism makes this even worse because it can automatically start another turn, creating more repeated context and more token usage.
Basically it's a loop.
I swear, it feels like some people spend more time looking at benchmarks than actually using the models
Leandro Barragan retweeted
Huge congrats to the Native team incredible result. really speaks to the value of strong harnesses and solid methodology.
even as more cyber-capable models ship, you're still dealing with sampling variance and reward optimization. raw capability helps, but reliable end-to-end outcomes take a lot more.
Leandro Barragan retweeted
This is how @0xLupin bypassed the supply chain security of major companies like Google, Salesforce, Netflix, and many others.
Here’s the clip:
Leandro Barragan retweeted
Introducing Speculative Programmatic Tool Calling (sPTC)!
A general class of technique for speculating on tool calls during code generation in a harness and queuing them early to overlap with token generation + REPL execution time.
Blog: alexzhang13.github.io/blog/2…
Am I the only one who feels relieved by the thought of this? I get bored pretty fast. If my job looks *exactly the same* 24 months from now, I’ll probably quit
