Katie Paxton-Fear

20.8K posts

Katie Paxton-Fear banner
Katie Paxton-Fear

Katie Paxton-Fear

@InsiderPhD

Dr, apparently. Security Adovcate @semgrep & Hacker. #BugBounty hunter & #infosec YouTuber. APIs & Interlinked OffSec, PhD in AI+Sec @hacknotcrime. she/her

Manchester, UK Katılım Şubat 2018
1.7K Takip Edilen97K Takipçiler
Katie Paxton-Fear
Katie Paxton-Fear@InsiderPhD·
The official statement: Semgrep is aware of an unsubstantiated claim made by a ransomware actor regarding Semgrep data, and the resulting threat intelligence reports. We take all reports seriously and, while we have no reason to believe the claims or resulting reports are credible, we are nonetheless conducting a broad investigation. Semgrep’s Security and Engineering teams are continuing to investigate this report and we will be publishing updates updates via our Trust Portal at trust.semgrep.dev
English
0
0
4
628
Daniel Cuthbert
Daniel Cuthbert@dcuthbert·
Hoping for all my friends at Semgrep that this isn’t true
Ransom-DB@Ransom_DB

🚨 Ransom group "Qilin" publishes "SEMGREP" - United States 🇺🇸 📍 Location: San Francisco, California, USA 🏢 Industry: Cybersecurity / Application Security 🔗 Website: semgrep.dev Semgrep, Inc., founded in 2017, delivers the Semgrep AppSec Platform combining SAST, SCA, and secrets scanning. It also maintains the open-source Semgrep static analysis tool used across 30+ programming languages by developers and security teams.

English
1
5
38
23.3K
Katie Paxton-Fear
Katie Paxton-Fear@InsiderPhD·
@aitization Hahaha nearly right! But not quite my parents were never married and when I (and my brother) was born they both wanted us to have their last names so they double barrelled it (one of them is Paxton the other is Fear), so technically my parents made it up 😂
English
1
0
1
32
aitization 𝕏 
aitization 𝕏 @aitization·
@InsiderPhD Your last name is totally made up “Paxton-fear” you thought it’s cool for cybersecurity work lol 😂
English
1
0
1
47
Katie Paxton-Fear
Katie Paxton-Fear@InsiderPhD·
I reviewed these vulnerabilities they are legit 😎😎😎
Drew Dennison@drewdennison

Just finished an experiment using @claude Opus 4.7 xhigh on a popular open source C/C++ repo from a top tech company: - @cramforce's excellent deepsec: does not support C/C++ - A random gist with a code security prompt: 1 critical, 3 high vulnerabilities for $18.09 - Semgrep's new Mandoline tool in "hunt" mode: 3 critical unauthenticated RCE, 15 high, 20 medium, 11 low, a persistent threat model, and a full security report: $7.13 Responsibly reported to the repo owner. Will share details on the vulnerabilities when public

English
0
0
18
5.1K
Katie Paxton-Fear
Katie Paxton-Fear@InsiderPhD·
Hedgie@HedgieMarkets

🦔Microsoft canceled its internal Claude Code licenses this week after token-based billing made the cost untenable, even for a company with effectively infinite cloud resources. Uber's CTO sent an internal memo warning the company burned through its entire 2026 AI budget in just four months. American AI software prices have jumped 20% to 37%, and GitHub (owned by Microsoft) is dropping flat-rate plans for usage-based billing across its products. My Take The AI subsidy era is ending in real time. The same company that put $13 billion into OpenAI and built the Azure infrastructure powering most of Anthropic's compute just looked at the bill from a competitor's coding tool and decided it was not worth paying. That is not a productivity failure on Anthropic's end. Token-based pricing is forcing every enterprise customer to confront the actual cost of running these models at scale, and the number turns out to be far higher than the flat-rate experiments suggested. This ties directly to my Gemini Flash post yesterday. Anthropic, OpenAI, and Google all raised effective prices in the last six months. Enterprises that built workflows assuming AI costs would keep falling are now watching annual budgets evaporate in months. Two outcomes look likely from here. Either enterprises scale back AI usage to fit budgets, which slows the revenue ramp the labs need to justify their valuations ahead of IPOs, or the labs cut prices and absorb the losses, which makes the unit economics worse at exactly the wrong moment. Both paths land in the same place, the numbers stop working, and somebody has to take the writedown. Hedgie🤗

ZXX
0
0
0
1.3K
Katie Paxton-Fear
Katie Paxton-Fear@InsiderPhD·
If you’re making layoffs now because you want to save $$$ sorry I mean reward outstanding engineers who use AI, just wait until you are properly fucked over a barrel because Claude put up their API pricing 20%
English
2
0
19
1.6K
Katie Paxton-Fear
Katie Paxton-Fear@InsiderPhD·
Mark my words 1 year from now people will get laid off because they weren’t able to reduce their AI spend, and the economic conditions will force harsh cuts
Katie Paxton-Fear tweet media
English
4
2
33
2.3K
TracketPacer
TracketPacer@TracketPacer·
the field of cybersecurity is hilarious bc a hacker will be known by a name like siD3w4ys_d4rKst4r or some shit & it’s just a middle aged dude w glasses who coaches his kids’ soccer team
English
53
60
940
26.7K
Katie Paxton-Fear
Katie Paxton-Fear@InsiderPhD·
@irsdl I’m sorry :( Microsoft doesn’t really run a bug bounty program they run a pls-don’t-sell-exploits-to-foreign-government program so they only really care about a small amount of bugs
English
1
0
6
952
Soroush Dalili
Soroush Dalili@irsdl·
Reported an important .NET Framework bug to MS but it is outside of bug bounty scope. I guess .NET Framework apps won't receive much love anymore. Not sure how I feel about reporting similar issues in the future. I guess many people do keep them to themselves now.
English
1
0
12
2.3K
Katie Paxton-Fear
Katie Paxton-Fear@InsiderPhD·
@CharlieEriksen @ZackKorman Agreeeeeee especially now with Shai-Hulud using C2s it’s much harder to know exactly how many downstream devs were affected when compared to the ecosystem (it looks like there’s been less community spread every attack wave? But we have no idea what that means for regular devs)
English
0
0
0
77
Charlie Eriksen
Charlie Eriksen@CharlieEriksen·
@ZackKorman I would never trust a machine that was infected personally, even if you try to clean it 🤷
English
6
0
8
1.6K
Zack Korman
Zack Korman@ZackKorman·
Might be a dumb question, but how are devs on personal machines supposed to catch this? Or do a lot of them just stay pwned and never know it?
Zack Korman tweet media
English
50
17
281
41.5K
Katie Paxton-Fear
Katie Paxton-Fear@InsiderPhD·
AI trains their models on copyrighted content and argues that it’s fair use yet I can’t get it to generate a Shai-Hulud sticker because of copyright 🤨🤨🤨🤨🤨
Katie Paxton-Fear tweet media
English
0
1
14
937
Katie Paxton-Fear
Katie Paxton-Fear@InsiderPhD·
Nothing grinds my gears more than a piece of software replacing a completely fine search bar with results in the ms to the world's slowest AI agent spending seconds typing out "sorry I don't know what that means" I'M LOOKING AT YOU NOTION
English
0
3
20
1.2K
Katie Paxton-Fear
Katie Paxton-Fear@InsiderPhD·
npm could stop Shai-Hulud but they choose not to
English
1
0
11
1.3K
Katie Paxton-Fear
Katie Paxton-Fear@InsiderPhD·
My fork is very much how I like to use the device but if you're interested then here is my firmware. I STRONGLY recommend BookFusion, great app, great devs, I pay $$$ not because I need the storage but because I just really want to support them. github.com/InsiderPhD/cro…
Katie Paxton-Fear tweet media
English
0
0
0
687
Katie Paxton-Fear
Katie Paxton-Fear@InsiderPhD·
Very niche post, but if you have an xteink and you use BookFusion, thanks to the new Koreader plugin for BookFusion I now have cross-platform reading between my Mac, iPad, Boox and now xteink too 😂
English
1
1
22
4.8K
Katie Paxton-Fear
Katie Paxton-Fear@InsiderPhD·
It sounds kinda insane, the future AppSec engineer doesn't need to learn AppSec, but there's a whole new set of skills we need to teach the next generation of AppSec professionals, ANYWAY I'll leave that for the actual livestream... But you should check it out
Semgrep@semgrep

Should AppSec engineers still learn how to code in the age of AI? 👀 And how do leaders mentor junior engineers when AI can already write large portions of code? In this Security Rulez session, Dr. Katie Paxton-Fear (@InsiderPhd) and Lyft Tech Lead Anshuman Bhartiya share practical insights and strong opinions on how AppSec teams should adapt. 📆 May 20 | 8:00 AM PT / 4:00 PM UTC Register now👉 semgrep.dev/events/securit… #CyberSecurity #AppSec #AI #EngineeringLeadership

English
1
1
50
6K
Katie Paxton-Fear
Katie Paxton-Fear@InsiderPhD·
them: to be really cracked with your AI coding you need a harness me, who wasn't really paying attention: uhh yeah of course a harness
Katie Paxton-Fear tweet media
English
1
0
19
3.1K