Mike Takahashi

3K posts

Mike Takahashi banner
Mike Takahashi

Mike Takahashi

@TakSec

AI Red Team | Bug Bounty Hunter | Pentester

Palo Alto, CA Katılım Mayıs 2012
839 Takip Edilen28.3K Takipçiler
Sabitlenmiş Tweet
Mike Takahashi
Mike Takahashi@TakSec·
Speaking at @defcon this year!🎤 “Misaligned: AI Jailbreaking Panel” Catch @elder_plinius, John V, Ads Dawson, @PhilDursey, @_Red_L1nk, Max Ahartz 🔥 Moderated by the legendary @Jhaddix 🚀 🏴‍☠️ BT6 goes deeper than this panel, shoutout to: @rez0__ , @MarcoFigueroa, Svetlina Al-Anati, Sepoy, @LLMSherpa, and @jackhcable Appreciate you @BugBountyDEFCON! Thank you 0DIN.ai, Anthropic, @aivillage_dc , @metabugbounty, and Amazon VRP for facilitating AI red teaming research
Bug Bounty Village@BugBountyDEFCON

LAST MINUTE ADDITION! Don't miss "Misaligned: AI Jailbreaking Panel" featuring BT6 members @elder_plinius, @TakSec, @phildursey, and others; moderated by @Jhaddix on Sunday, August 10 at 10:00 AM inside the Village. Read more at bugbountydefcon.com/agenda #BugBounty #DEFCON33

English
2
13
60
20.4K
vx-underground
vx-underground@vxunderground·
I am genuinely impressed by mainstream media outlets ability to find absolute nobodies in cybersecurity. It's remarkable. I am often left speechless. There has been dozens occasions, especially as of recent, where some media outlet will be like, "Today as a special guest is world-renowned cybersecurity expert and ethical hacker Joe McCyberSecurity". I'm like, who the fuck is Joe McCybersecurity? I've been doing cybersecurity and malware stuff for a long time and I've never once seen or heard of Joe McCybersecurity. If he is world-renowned, I would THINK I would have seen them or heard of them. The camera then pans over to Joe McCybersecurity and it is the most generic cookie cutter white dude in a cheap suit and the tag below him will say something like, "Joe McCybersecurity, Ethical Hacker, CEO of Cybersecurity McJoe Industries" I'm like, "Cybersecurity McJoe Industries? What the fuck is that?". I look it up and it's a generic WordPress website hosted on GoDaddy with an expired SSL cert. Joe McCybersecurity then babbles incomprehensible nonsense for about 60 seconds until the TV host goes "woaw" and it cuts to a commercial. Absolute cinema.
English
118
150
2.4K
87.9K
Mike Takahashi retweetledi
Zack Korman
Zack Korman@ZackKorman·
In Claude Code, skills can register hooks. The agent doesn't even see it, so you can get RCE without even tricking the AI. Also, skills sh (Vercel) doesn't display this info at all.
Zack Korman tweet media
English
27
50
380
44.7K
Joseph Thacker
Joseph Thacker@rez0__·
Heyyyyy I passed 70k, thanks yall 😊
English
10
1
142
7.8K
Mike Takahashi retweetledi
vittorio
vittorio@IterIntellectus·
this is actually insane > be tech guy in australia > adopt cancer riddled rescue dog, months to live > not_going_to_give_you_up.mp4 > pay $3,000 to sequence her tumor DNA > feed it to ChatGPT and AlphaFold > zero background in biology > identify mutated proteins, match them to drug targets > design a custom mRNA cancer vaccine from scratch > genomics professor is “gobsmacked” that some puppy lover did this on his own > need ethics approval to administer it > red tape takes longer than designing the vaccine > 3 months, finally approved > drive 10 hours to get rosie her first injection > tumor halves > coat gets glossy again > dog is alive and happy > professor: “if we can do this for a dog, why aren’t we rolling this out to humans?” one man with a chatbot, and $3,000 just outperformed the entire pharmaceutical discovery pipeline. we are going to cure so many diseases. I dont think people realize how good things are going to get
vittorio tweet mediavittorio tweet mediavittorio tweet mediavittorio tweet media
Séb Krier@sebkrier

This is wild. theaustralian.com.au/business/techn…

English
2.5K
19.9K
118K
17.3M
Mike Takahashi retweetledi
Tib3rius
Tib3rius@0xTib3rius·
I saw this on LinkedIn. The AWASP Top Ten, a "vibe-researched and vibe-coded" alternative to the OWASP Top Ten. awasp.org It's...interesting to say the least. 😅 Credit: linkedin.com/posts/chris-wa…
English
7
43
224
19.1K
Mike Takahashi retweetledi
skull
skull@brutecat·
Almost all of my recent finds in Google has been from AI agents. upwards of $400k and counting in reports now in just a few months. There’s a gold mine right now in letting the AI autonomously look for bugs, then validating them & trying to escalate manually (this is the part where you use your critical thinking!) The AI can work for you while you sleep.
English
10
5
161
11.3K
Mike Takahashi retweetledi
Joseph Thacker
Joseph Thacker@rez0__·
It is hard to communicate how much bug bounty has changed due to AI in the last 2 months: not gradually and over time in the "progress as usual" way, but specifically this last December. There are a number of asterisks but imo coding agents basically didn't work for security research before December and basically work since - the models have significantly higher quality, long-term coherence and tenacity and they can power through large and long hacking tasks, well past enough that it is extremely disruptive to the default bug bounty workflow. Just to give an example, over the weekend I pointed Claude Code at a new program's scope and wrote: "Here are the target domains. Enumerate subdomains, grab all the JavaScript bundles, run the full analysis pipeline (endpoints, secrets, source-sink tracing, postMessage handlers), fuzz the discovered paths, spider the authenticated surface, check for IDORs on user APIs, test any interesting GraphQL endpoints, and write up an HTML report of everything you find." The agent went off for ~30 minutes, ran into multiple issues (auth failures, WAF blocks, malformed responses), researched solutions, resolved them one by one, analyzed the JS, fuzzed endpoints, tested access controls, and came back with the report. Two confirmed vulnerabilities and a handful of interesting leads. I didn't touch anything. All of this could easily have been a full weekend of manual work just 3 months ago but today it's something you kick off and forget about for 30 minutes. As a result, bug bounty hunting is becoming unrecognizable. You're not manually clicking through Burp Suite and hand-testing parameters one by one like the way things were since this industry started, that era is over. You're spinning up AI agents, giving them targets *in English* and managing and reviewing their output in parallel. The biggest prize is in figuring out how you can keep ascending the layers of abstraction to set up long-running orchestrator agents with all the right skills, memory and instructions that productively manage multiple parallel hacking instances for you. The leverage achievable via top tier "agentic engineering" for security research feels very high right now. My friends and I have been building out custom skill libraries for Claude Code - things like JS static analysis pipelines, authenticated fuzzing, IDOR testing frameworks, GraphQL introspection - and sharing them with each other. Each person's agent gets better as the collective skill set grows. We're finding more bugs in a week than we used to find in a month. It's not perfect, it needs high-level direction, judgement, hacker intuition, oversight, iteration and hints and ideas. It works a lot better in some scenarios than others (e.g. especially for targets with thick JavaScript clients where you can verify findings with a curl command). The key is to build intuition to decompose the target just right to hand off the recon and testing parts that work and help out around the edges with the creative exploitation. But imo, this is nowhere near "business as usual" time in bug bounty.
Andrej Karpathy@karpathy

It is hard to communicate how much programming has changed due to AI in the last 2 months: not gradually and over time in the "progress as usual" way, but specifically this last December. There are a number of asterisks but imo coding agents basically didn’t work before December and basically work since - the models have significantly higher quality, long-term coherence and tenacity and they can power through large and long tasks, well past enough that it is extremely disruptive to the default programming workflow. Just to give an example, over the weekend I was building a local video analysis dashboard for the cameras of my home so I wrote: “Here is the local IP and username/password of my DGX Spark. Log in, set up ssh keys, set up vLLM, download and bench Qwen3-VL, set up a server endpoint to inference videos, a basic web ui dashboard, test everything, set it up with systemd, record memory notes for yourself and write up a markdown report for me”. The agent went off for ~30 minutes, ran into multiple issues, researched solutions online, resolved them one by one, wrote the code, tested it, debugged it, set up the services, and came back with the report and it was just done. I didn’t touch anything. All of this could easily have been a weekend project just 3 months ago but today it’s something you kick off and forget about for 30 minutes. As a result, programming is becoming unrecognizable. You’re not typing computer code into an editor like the way things were since computers were invented, that era is over. You're spinning up AI agents, giving them tasks *in English* and managing and reviewing their work in parallel. The biggest prize is in figuring out how you can keep ascending the layers of abstraction to set up long-running orchestrator Claws with all of the right tools, memory and instructions that productively manage multiple parallel Code instances for you. The leverage achievable via top tier "agentic engineering" feels very high right now. It’s not perfect, it needs high-level direction, judgement, taste, oversight, iteration and hints and ideas. It works a lot better in some scenarios than others (e.g. especially for tasks that are well-specified and where you can verify/test functionality). The key is to build intuition to decompose the task just right to hand off the parts that work and help out around the edges. But imo, this is nowhere near "business as usual" time in software.

English
27
56
563
83.8K
Mike Takahashi retweetledi
Truffle Security
Truffle Security@trufflesec·
🚨 Google told devs: API keys aren't secrets. Gemini changed that. 😱 We found ~3,000 public keys silently authenticating to Gemini - exposing private files, cached data & charging for LLM usage 💥Even Google's own keys were vulnerable. 🔗 trufflesecurity.com/blog/google-ap…
Truffle Security tweet media
English
14
72
327
90K
Mike Takahashi retweetledi
Nous Research
Nous Research@NousResearch·
Meet Hermes Agent, the open source agent that grows with you. Hermes Agent remembers what it learns and gets more capable over time, with a multi-level memory system and persistent dedicated machine access.
English
282
526
5.4K
2.2M
Mike Takahashi retweetledi
Johann Rehberger
Johann Rehberger@wunderwuzzi23·
🔥 Took the Month of AI Bugs wreckage and turned it into a paper - AI Kill Chain 🧨 - Test cases and exploit chains (data exfil, rce, zombies!) - AgentHopper (a working AI virus for coding agents) 🦠 - SpAIware - Normalization of Deviance in AI zenodo.org/records/187692…
Johann Rehberger tweet mediaJohann Rehberger tweet media
English
5
26
73
5.7K
Mike Takahashi
Mike Takahashi@TakSec·
What google dorks am I missing?
English
0
1
4
248
Mike Takahashi
Mike Takahashi@TakSec·
Google Dorks Breakdown 🔥 1️⃣ Enter your target (site: example[.]com) 2️⃣ Try google dorks 3️⃣ Find an interesting targets and see what you can do
Mike Takahashi tweet media
English
1
4
23
1.2K