Don't use structured output mode for reasoning tasks.
We’re open sourcing Osmosis-Structure-0.6B: an extremely small model that can turn any unstructured data into any format (e.g. JSON schema).
Use it with any model - download and blog below!
I was trying to make a goat (purposely vulnerable) web app in cursor - and it was actually difficult to get it to introduce vulns.
It’s easy to jokingly shit on LLM coding and say it’s insecure; but by default it’s quite impressive how it considers secure defaults and fights…
I wanted to end last year with a vm escape, took me a bit longer but I want to present you my latest public research:
A VM escape in Oracle VirtualBox using only one integer overflow bug!
This was fixed in April 15 and assigned CVE-2025-30712.
github.com/google/securit…
Me and the homies are dropping browser exploits on the red team engagement 😎. Find out how to bypass WDAC + execute native shellcode using this one weird trick -- exploiting the V8 engine of a vulnerable trusted application.
ibm.com/think/x-force/…
I’ve been a vocal critic of AI developments – in 2023 I still dismissed a lot of the hype.
Last year, I stayed mostly silent. Not because I agreed, but because I started seeing signs that impressed me.
This year, after what we’ve built and tested internally across several areas,…
“My wife complains that open office will never print on Tuesdays”
A bizarre sentence; which kicked off one of the most interesting bug hunts in Ubuntu’s history.
It all starts with some goofy pattern matching.
What the pentest readout looks like when the consultants and the blue team are arguing about the severity of the TLS weak cipher suites finding (meanwhile the out of scope Apache tomcat server has default creds)
9K Followers 17 Following501(c)3 Nonprofit providing Open Source and Open Access computer security training material. #OST2 re-launched July 2021! [email protected]
22K Followers 9 FollowingYour new async coding agent by @GoogleLabs. Built for devs, open to feedback, evolving with you. Dive in → https://t.co/iIzFEMmWgv
3K Followers 86 FollowingWe’re here to provide world-leading vulnerability research and research capabilities. From browsers, mobile, automotive and everything in between.
4K Followers 9 FollowingDoyensec works at the intersection of software development and offensive engineering. We discover vulnerabilities others cannot, and help mitigate the risk.
26K Followers 2 FollowingOffensiveCon Berlin is a technical international security conference focused on offensive security only. Organised by @Binary_Gecko. Stay tuned #OffensiveCon26.
101K Followers 2K FollowingFollow for posts about GitHub repos, DSPy, and agents
Subscribe for top posts
DM to share your AI project (Due to volume of DMs I'll prioritize subscribers)
41K Followers 1 FollowingTweeting news from the world of information security that occurred or was announced on today's date in a previous year. Managed by @stevewerby.
109K Followers 4K FollowingPresident of @signalapp, Chief Advisor to @ainowinstitute (Also on Mastodon @[email protected], also on bsky @meredithmeredith.bsky.social)
28K Followers 206 FollowingHacker at @OutsiderSec. Researches AD and Azure (AD) security. Likes to play around with Python and write tools that make work easier.
No recent Favorites. New Favorites will appear here.