Harpreet Singh

A senior Google engineer just dropped a 424-page doc called Agentic Design Patterns. Every chapter is code-backed and covers the frontier of AI systems: → Prompt chaining, routing, memory → MCP and multi-agent coordination → Guardrails, reasoning, planning This isn't a blog post. It's a curriculum. And it's free. Read it this weekend. That said, I wrote an article on how to build a multi-model AI team in 2026, which was already read by 4 million people. It's a complete guide to agents, models, workflows, and playbook to run your business on autopilot. The article is quoted below.

Andrej Karpathy spent 8 years at OpenAI and Tesla. Last week he put everything he knows into one free 2-hour lecture. People pay $15k for bootcamps that teach half of this. You probably don't have 2 hours right now. Don't lose this in the feed. Watch it. Then read the guide below and build your first loop.

@NinjaParanoid Well, that's what happens when in the name of "Sheekurity", you follow cheat sheets and forget the essence of research behind each engagement. Red teams have always been challenging due to its out-of-the-box approach but some people fail to understand that!

I know a lot of people will hate me for saying this but it has to be said. I get a lot of DMs saying RT is getting harder everyday, traditional loaders dont work anymore, opensource tools tend to crash or get detected instantly. But wasnt that the whole point of Red team? Thats why red teams get paid way more than PT/appsec. RTs are not supposed to be easy, its not just about stealing the first kerberos ticket/Ad Cert and becoming DA. You get paid for the expertise. If you have the same skills as that of general appsec/strategic team, then why would you get paid more? Somehow somewhere someone thought that RTs can be easy money and started providing cheap RTs, providing general PT in the name of RTs, confusing amateur orgs between RT and PT, but infact Redteam was always about research, helping the target organization improve their defense and find flaws in creative ways, or to identify the effects of an adversary. If you have done that and succeeded in improving the security of the org, then it means the next one to improve is you. You cant pray for weak security while doing redteams. Challenges make you better. Staying constant is for the weak.

@domchell Especially a nightmare when you realize you missed that one critical screenshot… and now the vulnerable box is long gone 😅

The one tip I will give to anyone starting out in any pentest / red team role is the one thing after 20 years of it I still never manage to do properly…. Report as you go ✅✅✅ That way you don’t end up spending your Sundays writing reports. Writing a report on a 3.5 month project with minimal notes is brutal 😆❌❌❌

How would you name your malware so that the level 1 analyst waves it through? I'll start - eicar.exe - keygen.exe - Bloomberg_Excel_Addon.exe - SAP-custom-helper.exe - \SecurityTraining_Oct22\something.exe - \quarantine\inactive-sample-af232.exe

Releasing full 2+hr video of my browser exploitation workshop from VXCON 2024: youtube.com/live/b9OhamkAY… In which I show what goes inside the mind of a skilled hacker while exploiting a highly non-trivial vulnerability in v8, from zero to exploit concept. Especially this workflow requires advanced abstract thinking, thereby emphasize the role of theoretical modeling in attacking hard zeroday research targets, which is a part of why it's fun. @zerodaytraining

From curious teen tinkering with an iPod to Red Team pro, Harpreet Singh’s ( @TheCyb3rAlpha ) journey shows how passion, grit, and self-learning can lead to cyber mastery! Read his inspiring story: news.cloudsek.com/2024/11/from-d… #Cybersecurity #Inspiration #RedTeam

DOSVisor - A hypervisor-level emulator for executing 16-bit real-mode DOS programs on Windows github.com/x86matthew/DOS…

🔐Speaker Release for #VULNCON 2024!🔐 We are thrilled to reveal our next speaker lineup for VULNCON 2024! @TheCyb3rAlpha ! Visit vulncon.in for more details! 🗓️Mark your calendars! 🗓️Date: June 22nd and 23rd,2024 📍Venue: National Science Seminar Complex, IISc, Bengaluru Join us for an enlightening two days where our speakers will share their latest insights and groundbreaking research in cybersecurity! 🎟️ Grab early bird passes till April 25th, book now! :- vulncon.in/register #VULNCON2024 #CyberSecurity #techSpeaker #CyberSecConference #IIScBengaluru #infosec #infosecurity #security #training #conference #research #zeroday #0day #redteam #warfare

BobTheSmuggler: Open-source tool for undetectable payload delivery - helpnetsecurity.com/2024/02/29/bob… - @TheCyb3rAlpha @GitHub #OpenSource #GitHub #CyberSecurity #netsec #PenTesting #security #InfoSecurity #ITsecurity #CyberSecurityNews #SecurityNews

@freelabz @TheMsterDoctor1 I'm the author. Please DM me for this🙂

@TheMsterDoctor1 Insane, are you the author ? Would like to integrate in github.com/freelabz/secat… maybe

🔥Bob the Smuggler" is a tool that leverages HTML Smuggling Attack and allows you to create HTML files with embedded 7z/zip archives. The tool would compress your binary (EXE/DLL) into 7z/zip file format, then XOR encrypt the archive and then hides inside PNG/GIF image file format (Image Polyglots). The JavaScript embedded within the HTML will download the PNG/GIF file and store it in the cache. Following this, the JavaScript will extract the data embedded in the PNG/GIF, assemble it, perform XOR decryption, and then store it as an in-memory blob. Repo: github.com/TheCyb3rAlpha/…

A platform for building proxies to bypass network restrictions. github.com/v2fly/v2ray-co…

ulexecve is a userland execve() implementation which helps you execute arbitrary ELF binaries on Linux from userland without the binaries ever having to touch storage. This is useful for red-teaming and anti-forensics purposes. github.com/anvilsecure/ul…

🚀 Launching #BobTheSmuggler! Transforming payload delivery with HTML Smuggling. 🌐💥 ✨ Features: Embeds 7z/zip in PNG/GIF Compresses & XOR encrypts binaries Ideal for payload delivery 🔗 [GitHub Link: github.com/TheCyb3rAlpha/…] #RedTeam #CyberSecurity

Christmas This #PoC creates multiple processes, where each process performs a specific task as part of the injection operation. github.com/Maldev-Academy… #cybersecurity #infosec #pentesting #redteam

Happy New Year all, New module on the #havocframework store to work with Bloodhound CE. Automatically call your SharpHound.exe and upload your .json files directly from the havoc interface! #redteam #pentest #c2 github.com/p4p1/havoc-blo… p4p1.github.io/havoc-store/

Some experiments to retrieve the current username without calling whoami.exe or similar binaries. github.com/ricardojoserf/… #infosec #pentest #redteam

Making progress on adding BOFs to the Medusa Mythic python agent! 🐍 Building on @naksyn's pythonmemorymodule (github.com/naksyn/PythonM…) and @zimnyaatishina's use of it with COFFLoader (tishina.in/execution/pyth…) 🙏🏻

Hidden Desktop BOF This Cobalt Strike BOF implementation was created as an alternative to TinyNuke/forks that are written in C++. github.com/WKL-Sec/Hidden… #infosec #pentesting #redteam