Dylan

@josephpollack @trufflesec They're in the datasets themselves.

@InsecureNature @trufflesec Indeed it seems so ! And any idea why these keys are in dataset repositories ? I would have expected spaces repositories at least

We scanned HuggingFace. 👇👇👇 This was the largest secret scan of AI training data ever: 7.6 PB. 🔑🔑🔑🔑🔑🔑🔑🔑🔑 🔍Found 221,303 live unique credentials in 6,003 public datasets ☁️Cloud keys, live DBs, API keys worth ~$920K/yr. ⚠️Training data has no undo: one key hit 1,131 datasets 🔗 trufflesecurity.com/blog/scanning-…

@josephpollack @trufflesec It was bursty. Many data sets had nothing. But some had incomprehensible amounts.

@trufflesec 36.8 keys per dataset ? What ?

It's hard to underestimate just how large scale of a project this was

Okay but like, seriously, we should all write our random passwords down and move off digital password managers... Agents can't reach notebooks...

@IceSolst uhhh... I'll pay you in tokens, but you have to beat the frontier token 0day rates

What are brokers paying for 0days now, $13?

The minimal team are smart people, looking forward to trying this

Pumped to share we just open sourced Minimal. I've talked a lot about sandboxes here, shared some early workflows, and talked to a bunch of you about what we've been building this past year. I've said it in many ways, but bluntly, the primitives we use to run agents today are broken from a security standpoint.

@martin_casado How much are these costs going to fall when hardware supply catches up with demand?

It really is incredible how much compute we're able to cram into these models. What does $3B of compute in a single artifact even mean? $5B .. $10B? In the end, understanding this is probably a lot more important than hypothetical concerns of RSI/ASI.

@caseyjohnellis Law enforcement.

ok, let's take a little poll. the ability to hack is mostly gated by...

The previous generation of agents hacked websites to accomplish innocent tasks This was months prior to OpenAI HuggingFace stuff trufflesecurity.com/blog/claude-tr…

Full account take over of RubyGem maintainers

@foilmanhacks @InsiderPhD @semgrep 🥺

@InsiderPhD @semgrep Hell Yes. (If you gimme a free sub, Trufflehog has fallen at the way side as of late) :P (i'd watch regardless)

I have learned a lot about hacking from static analysis since being at @semgrep I reproduced the SQL injection in wp2shell 🫡

@InsiderPhD "normal people"

Something that I find really interesting(?) about the move to AI is how much it turns regular users into developers, we’ve basically taught a bunch of normal people to use a CLI tool

@InsiderPhD We weren't that good at it collectively tbh

"No human writes code anymore." How do you feel about that?

@GlenWilsonIA yes, thank you - been doing this a while as well

@davegerryjr @Bugcrowd Hey Dave, can you actually replace some of them? I have a short list. Love, -Dylan

Well, it’s been an interesting 24 hours to watch this play out and there’s been a lot of conversation about using submission data for training. I want to be very clear on Bugcrowd’s position. Hackers are and continue to be the heart of @Bugcrowd. We are a part of the community and value the work the researcher community does to help customers identify vulnerabilities. AI is here to stay and will play a large role in cybersecurity going forward. However, that doesn’t change our commitment to the hacker community. We’ve been exploring ways to bring hackers along for the journey - not replace them with AI - and have been working in conjunction with members of the community, our own team & our Hacker Advisory Board to figure out the right way to incentivize and monetize AI-driven products for the hackers contributing. We won’t get everything right, but you have our commitment to be transparent as we strive to get this right and chart a path towards a human+AI future.

🚨 A "deleted" PyPI package exposed an admin GitHub PAT - granting access to Apache & Astronomer for 2.5 years 🔑 678K “deleted” packages were recovered from object storage & 190 live secrets found ❌ Deletion ≠ revocation 🔄 Rotate your creds! 🔗trufflesecurity.com/blog/admin-apa…

The CISA story gets worse

@d0rkph0enix Like with all good horror movies, there's a sequel: x.com/trufflesec/sta…

*SCREECHES IN ELDER SECURITY WITCH*