I spoke to @josephmenn this week about AI worms and wanted to add more color to my thoughts. What makes an AI worm different is that a model is capable of learning on the fly. This type of threat isn't here yet, but this is an example of an increasing shift that defenders are feeling. We keep hearing the same theme from @runsybil customers: finding vulns is only the start. Teams need to patch and understand their attack surface in real time. Our job is to find and fix what's exploitable faster than attackers. Onward 🚀 Full article here: theguardian.com/technology/2…

Come find me at Black Hat and DEFCON this week for our custom @runsybil Magic The Gathering cards! Resident Pro Tour MTG player @BonJarber designed a kickass full set. We added these to the swag bags for @BSidesLV and we’re handing them out throughout the week 🫡

A lot has changed since the AIxCC last year. Today’s general-access models can find more vulns than last year’s finalists. In our AIxCC replay GPT-5.5 found 46 injected bugs vs the winner’s 33. However, it only produced 10 valid PoVs and 10 valid patches. Opus found 37, with 29 valid PoVs and 23 patches. Finding vulnerabilities is now the easy part - the hard parts are still prioritization, reproducible proof-of-vulnerabilities, patch validation, and keeping false positives under control.