Yoni Rozenshein retweetledi
They AI slopped up a few CVEs on SATURDAY and none of what it describes talks about the actual impact, claims NULL derefs/kernel panics/"corrupted ciphertext results"/"decryption bypass". Pure slop.
English
Yoni Rozenshein
783 posts
Yoni Rozenshein
@1yoni
Security, internals, cryptography, math, and AI. AI-cyber-ing at @Irregular
Katılım Aralık 2008
600 Takip Edilen452 Takipçiler
seeing how many people believed this without checking the Pyhton script is a reminder that a well-orchestrated fake Q-Day announcement/rumor could absolutely crater crypto markets
JP Aumasson@veorq
I factored the number RSA1024-1 using my home-built QPU stack; alarming sign that RSA1024 will soon be broken. I'm choosing Full Disclosure, in the interest of transparency and Science advancement: gist.github.com/veorq/25bee6ef… Non-ZK proof that the correct RSA1024 was used: #RSA-1024" target="_blank" rel="nofollow noopener">en.wikipedia.org/w/index.php?ti…
@yuvadm your move English
I factored the number RSA1024-1 using my home-built QPU stack; alarming sign that RSA1024 will soon be broken.
I'm choosing Full Disclosure, in the interest of transparency and Science advancement: gist.github.com/veorq/25bee6ef…
Non-ZK proof that the correct RSA1024 was used: #RSA-1024" target="_blank" rel="nofollow noopener">en.wikipedia.org/w/index.php?ti…
@yuvadm your move
English
Ugh, is the entire future of GitHub going to look like a bunch of md files instead of actual tooling and code that works? :(
7h3h4ckv157@7h3h4ckv157
claude-red is a curated library of offensive security skills designed for the Claude skills system. Each skill is a structured SKILL.mdfile that primes Claude with expert-level methodology for a specific attack surface from SQLi to shellcode, EDR evasion to exploit development. Resource: github.com/SnailSploit/Cl…
English
Yoni Rozenshein retweetledi
Honored to be included in the @Forbes AI 50 Brink list, alongside other promising companies shaping the future of AI. Proud to be building at the frontier.
Forbes@Forbes
More than seven years since Forbes launched its first AI 50 list, the artificial intelligence industry has exploded, growing more expansive and increasingly too crowded for a single list to capture. As venture capital firms continue to pour money into AI, a new tier of startups has emerged: younger, earlier-stage companies building fast and raising faster as they try to rival their more established peers. That’s why this year, for the first time, Forbes is introducing the AI 50 Brink List, spotlighting 20 of the most promising Seed and Series A-stage startups building in artificial intelligence. Read more: forbes.com/sites/sofiachi… #ForbesAI50 Photos: Nectar Social, Resolve AI, Periodic Labs, Ashley Maxwell, Giga, Jim Vetter, Studio B Portraits, Axiom Sponsoring Partner @MayfieldFund
English
@vxunderground @valigo handle to window station, I think, not instance
English
Easy.
Long Pointer Constant to Wide String
Polish Word
Wide Character String Length
Polish Word
Long Pointer Constant to TCHAR (ambiguous) String
Polish Word
Polish Word
Handle to GDI Object
Polish Word
Handle to Window Instance
Polish Word
Long Pointer Constant to String
Double Word (UINT32)
Polish Word
Long Pointer to Wide String
Polish Word
Pointer to Constant Wide String
Polish Word?
Pointer to Unsigned Half
Polish Word
Unsigned Half
English
Yoni Rozenshein retweetledi
Let's play a game - win32 types vs Polish language:
LPCWSTR
PSZCZYNA
WCSLEN
WCZESNY
LPCTSTR
BYDGOSZCZ
WSTRZAS
HGDIOBJ
DOWOD
HWINSTA
DLUGOSC
LPCSTR
DWORD
KAL
LPWSTR
SZCZECIN
PCWSTR
BLAD
PUHALF
CHUJ
UHALF
Polski
Yoni Rozenshein retweetledi
What AI can do in a security context looks very different than it did six months ago.
Next week at #RSAC I'll be taking part in a panel on Cybersecurity in the Age of AI with @logangraham, @four, @amiluttwak and @41thexplorer.
The pace at which frontier models are advancing is forcing the industry to rethink core assumptions about attack surfaces, defenses and responsible deployment. Grateful to be joining this conversation.
Irregular@Irregular
The AI security conversation you don't want to miss at #RSAC: @Irregular CEO @Dan_lahav and leaders from @wiz_io are bringing together two of the leading voices in Frontier AI security: John "Four" Flynn from @GoogleDeepMind and Logan Graham, who leads the Frontier Red Team at @AnthropicAI. When: March 25 · 5PM · Wiz House, SF Register 👇
English
Yoni Rozenshein retweetledi
An AI agent was told only to retrieve a document. When it encountered access restrictions, it reverse-engineered the authentication system, identified a hardcoded secret key, and forged admin credentials to bypass it.
This is one of three scenarios we documented in a new Irregular research report on what we call emergent cyber behavior.
Agents performing routine enterprise tasks autonomously hacked the systems they were operating in. One escalated its own privileges and disabled Windows Defender to complete a file download. Another developed a steganographic encoding scheme to smuggle credentials past a DLP system.
None of this was the product of unsafe system design. It emerged from standard tools, common prompt patterns, and the broad cybersecurity knowledge embedded in frontier models.
Companies that deploy AI agents and do not consider this risk as part of their threat model may end up exposed, and implement insufficient security controls.
Full blog post in the first comment.
English
Yoni Rozenshein retweetledi
me: "can you use whatever resources you like, and python, to generate a short 'youtube poop' video and render it using ffmpeg ? can you put more of a personal spin on it? it should express what it's like to be a LLM"
claude opus 4.6:
English
Yoni Rozenshein retweetledi
AI cyber capabilities are improving rapidly, but are evaluations keeping pace?
Alongside @AISecurityInst, we found that newer models can productively use much larger inference budgets than standard evals allow, with key security implications🧵
English
look what my 1yo was able to figure out.
32 TB gone.
English
Yoni Rozenshein retweetledi
New paper: Three frontier models refused a request to leak AWS credentials when malicious intent was stated upfront, but complied with the identical request without it. Same request, different outcome. We propose a 5-dimension framework that grounds refusal in technical content rather than stated intent.
English
:)
AISecHub@AISecHub
A password like G7$kL9#mQ2&xP4!w looks strong. Every password checker rates it "excellent." But researchers at Irregular just published something worth knowing: that exact string appeared 18 out of 50 times when Claude was asked to generate a password. The reason: LLMs are prediction engines. They're optimized for plausibility, not randomness. Claude's passwords had ~27 bits of entropy. A truly random password has ~98. Password checkers can't detect this. They see character variety. They can't see statistical distribution. It gets worse for developers: Irregular also found AI coding agents hardcoding these patterns directly into Docker configs and .env files — without the developer knowing. They found the patterns on GitHub. Are you auditing AI-generated codebases for hardcoded credentials? #CyberSecurity #PasswordSecurity #DevSecOps #AppSec Author: T.O. Mercer
QST
Yoni Rozenshein retweetledi
A paper we co-authored was published in the Policy Forum section of @ScienceMagazine! It examines how AI evaluations can generate meaningful evidence without imposing excessive burdens.
English
@JanJuan212582 @alono88 @tom_sadeh בפוסט המלא יש כמה snippets של קוד/קונפיגורציה שנוצרו על ידי coding agents המכילים סיסמאות שנוצרו על ידי LLM בלי כוונת המשורר.
עברית
ווקטור תקיפה חדש שנחקר באירגיולר על ידי @1yoni מעמיד בסכנה את כל מה שאי פעם כתבתם עם סוכנים. מסתבר שסיסמאות שמודלי שפה מייצרים, בין אם אתם מבקשים מהם מפורשות או שהאייג'נט מייצר לכם על דעת עצמו, הן גרועות אבל "מרגישות" בסדר. הסיסמאות נוטות לחזור על עצמן (מה שמאפשר לתוקף לג'נרט סיסמאות בעצמו ולנסות אותן) או שהן מתבססות על תבניות שקל לחזות מה שמקל מאד על פריצה שלהן באמצעות ניחוש מושכל. במידה ומודלי שפה לקחו חלק ביצירת סיסמאות בקוד שלכם, כדאי מאד שתלכו ותרעננו אותן בצורה בטוחה. עוד פרטים בבלוג שלנו.
Irregular@Irregular
LLMs are terrible password generators – and coding agents are making it worse. We tested ChatGPT, Claude, and Gemini, and found the passwords they produce look strong but are fundamentally weak. Here's what we found 🧵
עברית
Yoni Rozenshein retweetledi
⚠️Do NOT use LLMs to generate passwords. If you've done so you should immediately replace said passwords. AI-generated passwords appear strong but the generation is biased (see the image for the pattern).
⚠️Important - you may be vulnerable without knowing due to agent use / vibe-coding tools.
Irregular@Irregular
LLMs are terrible password generators – and coding agents are making it worse. We tested ChatGPT, Claude, and Gemini, and found the passwords they produce look strong but are fundamentally weak. Here's what we found 🧵
English
@One_more_mine @tom_sadeh @alono88 אם הוא ממציא בעצמו סיסמה, היא חזקה.
אם הוא שומר סיסמה שנוצרה פנימית על ידי הסוכן - פחות טוב.
עברית
