Stephen Sims

The Challenges of Building an AI-driven Security Testing Platform and How We Solved Them x.com/i/broadcasts/1…

This is pretty impressive. Apple Memory Integrity Enforcement (MIE) bypass. Well done! An interesting combination using AI deterministic bug hunting with novel human expertise to bypass MIE. blog.calif.io/p/first-public…

@chompie1337 Amazing as always!

not a bad return on a 1 month Claude code max sub 😏

I'm looking forward to sitting the alpha run of the new SEC536 course on Adversarial AI this coming Monday and Tuesday! Congratulations to the authors @bettersafetynet and @OSTact13! sans.org/cyber-security…

Please join us on the next @offby1security stream this Friday at 11AM PT with @htejeda for a session on "The Challenges of Building an AI-driven Security Testing Platform and How We Solved Them." We will be announcing more streams shortly! youtube.com/watch?v=3s1fXV…

I'm very much looking forward to teaching my SANS course SEC660: Advanced Penetration Testing & Exploit Writing in DC this July and in Las Vegas this September! Lot's of cool AI content to share. Hope to see some of you there sans.org/cyber-security… sans.org/cyber-security…

@offby1security facebook.com/MississippiDep…

Happy to share that we sponsored a K9 Officer's Bullet Proof Protective vest for Axel who works for the Mississippi Department of Corrections!

This should change the opinion of the last person who doubted AI

@stalmico red.anthropic.com/2026/mythos-pr…

@Steph3nSims wait what's claude mythos?

Question for those in the know… With “for example” Claude Mythos being 5x more expensive than Opus 4.5/6/X regarding tokens: e.g. Mythos $25 p/m input $125 p/m output vs. Opus 4.5/6/X $5 p/m input $25 p/m output And the fact that these are massively VC-funded companies who are subsidizing tokens and providing $1M free spend to select companies… How long before the tokenomics adjustment to make them profitable reaches or exceeds the cost of humans and products in the roles or services potentially disrupted? Or will that threshold not be met? It’s an honest question as I have no idea what the answer is and how much consumption will continue to climb in cost, though it will certainly continue to climb. It has to… I’m of course not picking at any one company as I think Anthropic and OpenAI are doing amazing work, but rather just curious as to where things are going as more powerful models are released. Why? Because I keep getting asked this question by directors at many companies and my answer has been “yes.” Haha I’d love to hear thoughts from those of you who have perspective, or even an opinion.

Five years from now the state of the AI-era cybersecurity industry will have resulted in:

Warning: Long Tweet! I've been thinking a lot about the forthcoming knowledge gap in hacking and vulnerability research, though it applies far beyond just that. One part that makes me a bit sad is that those coming into the field in the future will never know what it was like during the early days of going to DEF CON, sitting at tables or in hotel rooms with like-minded individuals to work through solving problems both together and individually, and being forced to use your brains and your knowledge... Never giving up! I'm sure that for many of us that the amount of time spent on manually reversing, debugging, coding, etc... could be quantified in literal years of our time spent on this planet. But it was always worth it... Or at least always a learning opportunity! At the same time it's incredibly exciting to be alive having that same knowledge in the AI-era! I don't know that I've been this "energized" about the industry in a long time. I needed to write a Python app today to work with Ollama, a model, and Streamlit that would have taken me days on my own. Instead, I created it far faster than I could have on my own, and after only a couple iterations I had something solid and working well using AI. My point however, is that I've been struggling with trying to answer a couple of questions: 1) How will those coming into the field gain the necessary knowledge in coding, reversing, debugging, etc... to be effective, to identify hallucinations, to understand the who, what, where, when, and why, and to identify new classes of vulnerabilities if AI is performing all of the work and everything is handed up on a silver platter? 2) How important is it for those coming into the field to need to understand those things? ...and if still important now, for how long? I have more questions of course but those are two of the big ones... A lot of the things that I'm able to automate now are of course due to AI first and foremost, but there's the big secondary piece. It's the fact that I've been doing vulnerability research for a very long time and I know a lot of the who, what, where, when, and why... I've decided that on the @offby1security channel I'm going to start a new set of pre-recorded videos, separate from the weekly streams, where I simply cover foundational things that you cannot easily learn without having the practical experience. I need to put more thought into it but will figure it out through experimentation. Even if it only helps a small number of up and comers it's worth it to me. I'm a firm believer that even with all of the AI and automation options that paying your dues in understanding how things work "under the hood" remains crucial. If ever there was a time to not be complacent... it's now! I think that with this gap, and the decline in junior positions and apprenticeships, that Universities are going to need to figure out new ways to help prepare students for this new era. Sorry if I'm coming across all "philosophical" but this has been nagging me for some time now. If you agree or disagree I'd love to hear your thoughts on the matter as I'm still trying to land on an answer.

Watch this video with Elias (@allthingsida)!! It will save you a TON of time when reversing software. Amazing cutting-edge techniques!

Among other things, here I show how to use ghidrasql and Claude Code @claudeai to do automated reverse engineering. Overnight, I let Claude reverse engineer (with ghidrasql) and recover the (compilable and clean) source code of 85 windows drivers and also write user mode client code libraries for each driver.

Automated Reverse Engineering with LibGhidra, GhidraSQL, and AI Agents x.com/i/broadcasts/1…

The stream below with @allthingsida is tomorrow (Friday) at 11AM PT!

I say this with no ego. I made this comment based on many conversations with development teams of both OSS and commercial software struggling to prioritize patching. Being someone who has sold many PoC's, the proof is in the pudding. I never liked that saying. haha

With the low barrier to entry for vulnerability research due to AI, that used to require advanced and niche skills, I'm seeing that exploit mitigation bypasses are still difficult for AI. Weaponizing vulnerabilities still requires advanced knowledge. Disclosure != Skill...

I’m almost done assembling the author team for the 7th edition of Gray Hat Hacking through McGraw-Hill. I can’t wait to share with the amazing team of authors with you!