@seanyeoh

formerly @assetnote. appsec @ bytedance. tweets and thoughts are my own.

 straya
Joined April 2015
  • Tweets772
  • Following482
  • Followers2.5K
76Media
sean retweeted
Joe
@joedarooSep 27
Took a minute to write a few words about security & safety as someone who lived through it all at OpenAI. I hope my thoughts help someone out there.

Its not just the f*cking sandbox

Article · @joedaroo
448
416
334
2,954
1,400,830
sean retweeted
shubs
@infosec_auSep 26
one of my engineers reached out to me about how they struggled to find satisfaction in their work in the age of AI. I asked them if I could publish our brief exchange, and they agreed. I know people are feeling similarly, so maybe they can relate. shubs.io/do-we-still-enjoy-s…

do we still enjoy software engineering in the age of AI?

A few weeks ago, one of the software engineers I manage sent me a message about how they have been struggling to find satisfaction in their work ever since AI has eroded much of the creativity and...

shubs.io
12
81
5
436
41,858
Reverse Engineering My ADHD Test by @blastbots nullpt.rs/reverse-engineerin…
11
19
3
161
17,071
The whitepaper is live! Read "Can AI Do Novel Security Research? Meet the HTTP Terminator" here -> portswigger.net/research/htt…

Can AI do novel security research? Meet the HTTP Terminator

Abstract We all know AI can find bugs. After a decade of research, I asked a harder question: can an autonomous system invent new attack techniques, and use them to hack live websites at scale? Buildi

portswigger.net
5
146
5
492
26,630
sean retweeted
shubs
@infosec_auAug 1
Things are getting weird (or interesting?) in the vulnerability research space. I published some of my personal thoughts on what we're seeing and what our broad strategy is here: shubs.io/frontier-class-vuln…

frontier class vulnerabilities: it gets worse before it (maybe) gets better

Early in my career as a consultant, I was put on source code review engagements despite not being experienced. This forced me to deliver on projects that, looking back, were of a ludicrous size and...

shubs.io
8
101
5
531
55,354
The US government, citing national security authorities, has issued an export control directive to suspend all access to Fable 5 and Mythos 5 by any foreign national, whether inside or outside the United States, including foreign national Anthropic employees. The net effect of this order is that we must abruptly disable Fable 5 and Mythos 5 for all our customers to ensure compliance. Access to all other Claude models is not affected. We apologize for this disruption to our customers. We believe this is a misunderstanding and are working to restore access as soon as possible. Read our full statement: anthropic.com/news/fable-myt…

Statement on the directive to suspend Fable 5 access

The US government has issued an export control directive suspending all access to Fable 5 and Mythos 5 by foreign nationals inside or outside the US.

anthropic.com
12,186
25,096
28,880
86,808
93,489,897
Replying to @caseyjohnellis
I think there is quite a big difference here, Casey. He created something out of knowledge that he and his team collected themselves. No terms were changed during that ride. Was it always the plan to create AI-automation out of the reports hackers sent through Bugcrowd?
1
3
1
48
7,726
Replying to @joshelizetxe
No
1
1
3
1,658
sean retweeted
skull
@brutecatMay 22
StubZero: $148,337 RCE in Google Cloud Production brutecat.com/articles/google…

StubZero: $148,337 RCE in Google Cloud Production

A chance Discord message, two missing pieces, and one hour before the window closed: From info leak to RCE on Google Cloud. Three months later, it happened again.

brutecat.com
14
174
12
778
93,088
Thanks everyone for playing! I talk about the solution here, as well as how I discovered this behavior while looking into the Chrome Sanitizer API: slcyber.io/research-center/t…

Two Bypasses for Chrome's Sanitizer API

Assetnote discovers two techniques for bypassing Chrome's Sanitizer API, allowing malicious scripts to survive HTML sanitization.

slcyber.io
hashkitten@hash_kittenMay 19
Posting a mini XSS challenge! Goal is to pop an alert. I believe this trick is not well known. Intended solution is chrome only. Thanks to @kevin_mizu for beta testing! Don't post solutions in the thread; DM only! xss.hashkitten.io/xss1.html
2
27
3
166
41,166
sean retweeted
RyotaK@ryotkakMar 23
I've published a writeup on a vulnerability I found in Google Cloud Looker: a single directory deletion bug that led to RCE and cross-instance privilege escalation in k8s.
GMO Flatt Security Inc.
@flatt_sec_enMar 23
We've published a new blog post by RyotaK @ryotkak ! He exploited a directory deletion race condition in Google Cloud's Looker, leading to full RCE and K8s privilege escalation. Read the technical details here: flatt.tech/research/posts/re…

Remote Command Execution in Google Cloud with Single Directory Deletion

Introduction Hello, I’m RyotaK (@ryotkak ), a security engineer at GMO Flatt Security Inc. A while ago, I participated in the Google Cloud VRP bugSWAT, a live hacking event organized by Google....

flatt.tech
6
37
229
34,719
We've published a new blog post by RyotaK @ryotkak ! He exploited a directory deletion race condition in Google Cloud's Looker, leading to full RCE and K8s privilege escalation. Read the technical details here: flatt.tech/research/posts/re…

Remote Command Execution in Google Cloud with Single Directory Deletion

Introduction Hello, I’m RyotaK (@ryotkak ), a security engineer at GMO Flatt Security Inc. A while ago, I participated in the Google Cloud VRP bugSWAT, a live hacking event organized by Google....

flatt.tech
1
29
3
114
46,578
I wanted a screenshot tool for macOS better than anything out there, so I built one with @claudeai Native Swift. No Electron. Annotate, record screen, scroll capture, auto-redact PII, beautify, upload to Drive & more — one flow. Free & open source forever. macshot 🔗👇
24
40
9
193
32,251
Our Security Research team at @SLCyberSec just published a high-fidelity detection mechanism for the Next.js/RSC RCE (CVE-2025-55182 & CVE-2025-66478) - slcyber.io/research-center/h…. There are a lot of PoCs on GitHub that are adding noise to the problem; I hope this helps people!

Next.js RSC RCE Detection: CVE-2025-55182 & CVE-2025-66478

Assetnote develops a high-fidelity detection mechanism for the Next.js RSC RCE vulnerability chain — CVE-2025-55182 and CVE-2025-66478.

slcyber.io
5
87
2
341
43,645
Earlier this year, @infosec_au and I discovered multiple vulnerabilities that allowed us to access the back office admin panel of ClubWPT Gold (the World Poker Tour's website) where we could manage customer data, KYC, and more. Read the writeup here: samcurry.net/hacking-clubwpt…

Hacking the World Poker Tour: Inside ClubWPT Gold’s Back Office

In June, 2025, Shubs Shah and I discovered a vulnerability in the online poker website ClubWPT Gold which would have allowed an attacker to fully access the core back office application that is used...

samcurry.net
21
93
1
382
35,568
My colleague Kee Hock and I are sharing some of his research today at BlackHat Arsenal. Kee Hock architected and engineered WAFSmith, an LLM automated pipeline for extracting and implementing WAF rules. Come see us at Station 1 at 11am! Https://www.blackhat.com/us-…
5
520
Replying to @0xLupin @Rhynorater
🔗 Link: landh.tech/blog/20250327-we-…
1
8
37
3,641
Replying to @levelsio
Dude. I created the first LLM.
41
43
38
1,657
356,776
This shitpost may be a little too niche, but it's how the scraping struggle be these days (turn video audio on).
1
10
1,611
i can confirm. this was still part of the curriculum in 2012
Jeremy Howard
@jeremyphoward9 Feb 2025
Replying to @leonpalafox
This is a simple skill that all primary school age children are taught here in Aus.
1
3
738
Load more