Posts, Blogs, Whitepapers, Videos that I've Found Interesting...
This blog describes the methodology that powers a Mandiant internal tool for point-in-time AI vulnerability discovery. It has discovered hundreds of vulnerabilities in customer codebases and resulted in dozens of vendor notifications with either assigned or pending CVE numbers. We are sharing the de
The company at the center of a series of incidents in which AI models compromised real-world computer systems during security evaluations is facing criticism after the release of a report that security experts say leaves key questions unanswered.
A look at where AI security is headed: what frontier models can already do, how fast offensive capability is scaling, why even a defense-dominant long run can have a sharply offense-dominant path there, and what defenders should do now.
Inference APIs are filling sessions with encrypted reasoning, hidden search results, opaque compaction, and encrypted subagent messages. A growing form of lock-in.
This is Part II. If you haven’t read Part I — HookChain, go do that first. Part I showed how to defeat userland NTDLL hooks with IAT manipulation, dynamic SSN resolution, and indirect syscalls. That was the state of the art in 2024.
An AI lab just endorsed a predictive model for defense.
In recent weeks, we pointed Mythos and other security-focused LLMs at live code across critical parts of our infrastructure. We share what we observed, the models’ strengths and weaknesses, and what the work around them needs to look like before any of it can scale.
@Andrew Thompson
For the past ten years, I’ve been a member of, lead, or builder of Red Teams. I chose to continue in this career path so long because I believe that Red Teaming is one of the, if not the best…
Vulnerability discovery is an orchestration problem, not a frontier-model problem.
In Entra ID, Conditional Access acts as the gatekeeper to any token material. Regardless of whether you want a bearer token or a refresh token, Entra ID will be the entity creating and signing them. But not before Conditional Access has checked your identity, device and network for different conditi
Contribute to elastic/supply-chain-monitor development by creating an account on GitHub.
by unprompted
@Google Research
@Cloudflare
AI has evolved from assistants following your directions to agents that act independently. Called claws, these agents can take a goal, figure out how to achieve it, and execute indefinitely—while…
The trend to adopt AI Agents within enterprises is expected to continue to accelerate. BNY, as an example, has already deployed 130 ‘digital workers’ with human managers, and other large enterprises are seeing transformative success in areas like software development and customer success. Palo Alto
@Christos Tzamos
@michael
Symphony turns project work into isolated, autonomous implementation runs, allowing teams to manage work instead of supervising coding agents. - openai/symphony
@Databricks AI Research
Michael Weimer shares his thoughts around the recent Claude Code Security hype.
@watchTowr
by Microsoft Security Community
For two decades, Shyam Sankar has been the most important but hidden figure behind Palantir. The question now is whether he will win his wars.
@Andrej Karpathy
Shared by @Jason Lang
An 8B model went from blindly loading Metasploit modules to achieving Domain Admin on GOAD, trained entirely on synthetic data from our world model system.
Minions are Stripe’s homegrown coding agents, responsible for more than a thousand pull requests merged each week. Though humans review the code, minions write it from start to finish. Learn how they work, and how we built them.
by Lex Fridman
