Sabitlenmiş Tweet
Atomic Habits by @JamesClear should be part of the syllabus at school.
English
Keval
384 posts
Keval
@KevalJagani1
CoFounder - @trynoscope by @tryhackme - Building AI Agents for Cybersecurity
🇨🇦 Katılım Mart 2017
1.4K Takip Edilen550 Takipçiler
Last week we hosted webinar on, "AI is Accelerating Attacks: How to Evolve Your Pentest Methodology" with 1,400 people signed up. Thank you to everyone who joined!
If you missed it (or want to rewatch), the full recording is up now: noscope.com/webinars/pente…
We covered how attackers are using AI to move faster than traditional security teams can respond, and why you should be evolving your pentest methodology in 2026.
English
We built an AI that can draw on your screen.
It's a true personal tutor.
Using Claude Opus we're able to draw polygons, point with pixel perfect accuracy, and walk users through complex steps directly on their screen.
Here's me learning Pythagorean Theorem + FL Studio.
Demo:
English
it’s kinda surprising how quickly xbow became a corporate slug.
their blogs rarely have anything novel, their twitter reads like generated marketing slop, and for the amount of capital they’ve raised, i would’ve expected way more ambitious research, experiments, and weird ideas.
English
@KevalJagani1 harnesses converging just means the moat moves down a layer. once the scaffolding is identical for everyone, the edge is whatever you point it at: the eval set, the live environment, the exploit data nobody else has logged. that's the layer noscope is quietly compounding.
English
I am always surprised by what our agent finds every time it's fired at something.
This time, it found an RCE in Alf (a ticketing platform).
Full technical breakdown of how it found it is linked below.
NoScope@trynoscope
NoScope found CVE-2026-35482 an RCE in Alf, a self-hosted ticketing platform used for conferences, trade shows, and festivals worldwide Full technical breakdown in comments 🧵
English
every agent platform needs to offer:
1. sandbox
2. model router
3. observability
4. ???
what am i missing?
English
🚨 Critical vulnerability alert: CVE-2026-27771
Your private container images might not be so private.
CVE-2026-27771 lets anyone pull private Gitea images with zero credentials. Source code, API keys, database passwords... all exposed.
How to fix: orca.security/resources/blog…
English
We're the team behind this. The vulnerability was discovered by our AI pentesting agent. Happy to answer any questions here.
We've intentionally held back the deeper technical details for now to prevent abuse and give teams time to patch.Full technical writeup coming soon.
More about the vulnerability: noscope.com/blog/gitea-ins…
English
We're the team behind this. The vulnerability was discovered by our AI pentesting agent. Happy to answer any questions here.
We've intentionally held back the deeper technical details for now to prevent abuse and give teams time to patch. Full technical writeup coming soon.
More about the vulnerability: noscope.com/blog/gitea-ins…
English
Keval retweetledi
🚨 Gitea flaw exposes private container images without authentication.
thehackernews.com/2026/05/gitea-…
CVE-2026-27771 affects all Gitea versions before 1.26.2 and likely impacts 30,000+ deployments worldwide. Attackers can pull private images without an account or password.
Update now or enable REQUIRE_SIGNIN_VIEW as a temporary workaround.
English
A good AI agent can find more vulnerabilities than what many well-known security companies do with a full team.
I am talking about VALID, severe findings - not Infos/Lows. It's reality today. My team has a duty to deliver the best security, so we are building a lot with AI🫡
English
The kind of finding that makes you realize how much can go undetected for years.
NoScope@trynoscope
For 4 years, any person on the internet could pull private container images from 30,000+ Gitea deployments. No account. No password. No credentials of any kind. NoScope discovered it. CVE-2026-27771. Here's the full story. 🧵
English
Keval retweetledi
We are investigating unauthorized access to GitHub’s internal repositories. While we currently have no evidence of impact to customer information stored outside of GitHub’s internal repositories (such as our customers’ enterprises, organizations, and repositories), we are closely monitoring our infrastructure for follow-on activity.
English
@_jensec @rez0__ @TakSec I wrote a piece a while ago. Feel free to check it out @kevaljagani1/multi-layered-approach-for-context-summarization-in-long-running-ai-agents-2a7826fc3a5f" target="_blank" rel="nofollow noopener">medium.com/@kevaljagani1/…
English
Here’s the sauce:
- agent md file with lots of disclaimers about how it’s approved testing
- a bunch of hacking skills
- /goal find a crit on target . com
That’s literally 90% of the way there and enough to blow anyone’s mind who hasn’t been convinced yet.
Joseph Thacker@rez0__
okay im calling it officially. codex is cracked. if you're a bb hunter and you dont have a hackbot set up yet, i recommend codex with gpt5.5 over claude code.
English
Keval retweetledi
tokens are rapidly becoming the universal input for solving problems
English
Keval retweetledi
We found a critical vulnerability affecting 30,000+ production deployments worldwide.
Not in a lab. Not in a CTF. In live infrastructure running at aerospace companies, healthcare providers, logistics companies, ISPs, and retail chains.
It touches every industry. Directly or indirectly.
Responsible disclosure is underway. More soon.
English