Patrik Grobshäuser

I finally let Claude do my pentest this week. Full 5-day engagement, zero human input. Here's what the client got: 😏 clawd.it/posts/10-repla… #bugbounty #pentesting #AI #cybersecurity #infosec #claudeai

Pre-Auth Remote Code Execution in ServiceNow! (CVE-2026-6875) New research from @hash_kitten of the @SLCyberSec security research team is out 👀 😏 👇 slcyber.io/research-cente… PS: this might not be the last one 👁️👁️ 😉

@nmatt0 walking on thin ice right now

The European mind can't handle Home Depot...

@bug_dutch @intigriti San Sebastian is the most beautiful city!

Last couple of days I had the pleasure to redeem the prize I won 🥇 during the last Live Hacking Event organised by @intigriti It was a nice culinairy trip to San Sebastián, bug bounty does bring you to some places😋 #1337UP1125

new research out! 🚢 We took apart CargoWise Webtracker, the customer portal in one of the most widely deployed logistics platforms in the world. Hardcoded keys, forged sessions, and a path all the way to pre-auth RCE. full writeup below. 👇🏻 slcyber.io/research-cente…

@kittoh_ nuphy Air75 V3!

@ITSecurityguard what keyboard is that boss? thanks!

He's using Mythos to breach NSA Systems btw.

@ZackKorman well you seem to be a bit sour because you haven't made it to this years cybersecurity-excellence-award.com ?

Easy way to be better at your cybersecurity job: Remove all vendors that have these stupid fake awards. They're showing that they're willing to lie to you, and you should believe them. Don't believe me? Screenshot taken from a Delve customer.

me getting gaslit by claude for the 17th time today

@0xdef1ant Absolutely my bad @0xdef1ant is the source!

@ITSecurityguard oh come on, if you're gonna repost, at least credit me

@ZackKorman It wouldn’t change a thing, instead of one disastrous Ivanti vulnerability per week we would get two

I feel everyone is talking about cyber risk with very little input from cybersecurity. For people in cyber, I want your take: How good or bad would it be for cyber if an open-weight no-guardrails Mythos-level model released tomorrow?

Was it always the plan to create AI-automation out of the reports hackers sent through Bugcrowd?

@lennaert89 @Jhaddix ah no I am talking about new accounts, first submission the chances of those striking gold

@ITSecurityguard @Jhaddix If I combine out of scope, non applicable and informative I get to about 60% of submissions The other 40% obviously still contain the duplicates, and those are valid findings. And of that 60% not everyone is "just throwing everything" some of them are new, still have to learn etc

bugcrowd.com/blog/introduci… Its happening! 🥳

@lennaert89 @Jhaddix What’s the number on intigriti?

@ITSecurityguard @Jhaddix Im pessimistic at times but 99.9% is quite the overstatement here 😂

@Jhaddix The "Mythos" of the miracle researcher that comes out of nowhere and miraculously pops a shell is exceptionally rare. 99,9% of submissions are of people throwing everything at you, don't read the scope, are ignorant of learning or just plain malicious trolls.

@ITSecurityguard This is not a shade question... just wondering... Let's say a new researcher finds a bug today and submits it. A priority researcher finds the same bug tomorrow, and it gets triaged immediately. Does the new researcher get duped off of someone who found the bug after them?

@mdisec there are items that can be shipped worldwide :)

I reported 4 critical 0-day to a vendor one of the leading companies in its sector. They paid me $500 amazon.com gift card, which turned out it can only be used at Amazon US 😂 Rewards have never been my motivation for reporting issues. When I started doing this work, bug bounties did not exist. Responsible disclosure was simply the right thing to do, and I still see it that way. But you never ever gonna get any high quality findings from a seasoned researchers. Never.

@DanielMiessler AI hallucination worked on you

There is a fundamental flaw to the argument that LLMs are "just" doing next token prediction. It's true that they are, but they're not predicting tokens of random text! They’re predicting the next token of THE ANSWER to what was asked. I created a demo to illustrate this.

Happy Pride month!

Some exciting changes @Hacker0x01 are coming!

Stop blaming AI slop for what bug bounty platforms did to themselves. 👇 wrote down some thoughts about the state of triage clawd.it/posts/14-to-ka…