Paul Seekamp

Big news! I started @CoastlineCyber, a boutique cyber security consulting firm dedicated to strengthening your organization's security posture. 💪

CVE-2026-28609 Have one more from the same timeframe. I guess I'll submit it. Just sick of fighting triagers.

I don’t know if this condition has a name, but every time I make a sandwich on a sub roll, I have to speak to everyone around me in a thick New York accent. Regular sandwiches? No issue at all. Only sub rolls trigger it.

@evilsocket @0xInuarashi We are just in another matrix.

@0xInuarashi it depends which side of the echo chamber you are at I guess! for some, it's realizing there's an entire planet of people who don't care about AI

escape the matrix

@ClaudeDevs I still burned through my weeks' worth of tokens about 3 days. Have never done that before with the Max plan.

We've raised Claude Platform API rate limits for all users and simplified the tiers, which are no longer based on API spend. The latest Sonnet and Haiku models now provide 5x higher rate limits at the highest tier.

@thedawgyg 2k here and there for webkit 😑

Oo all of my reports fixed this week just got moved from Bounty under review to Bounty: Reviewing and its green now... maybe some bounties coming from Apple?! xD 🤞🤞

The @OWASP_AISVS 1.0 is now released and live! github.com/OWASP/AISVS/bl… cc @ottosulin @ricokomenda Russ Memisyazici and Raza Sharif

@vysecurity @Random_Robbie I was using GLM 5.1 in my pipeline. But onboarding people caused issues. 1) The price to give free test scans was getting expensive. 2) It caused some rate limiting issues that I didn't expect. I moved to open weight model with existing harness and the triager thrashed. Fixing.

@nullenc0de @Random_Robbie Bruv can we check out your agent work you did

Qwen3.7-Max and Qwen3.7-Plus is solid when used for vulnerability pipeline and validation tasks. Found vulnerabilities in a bug bounty program and managed to self-validate and identify false positives. Managed to one shot a "Provide a recon overview of target company". Can also use Qwen3.7-Plus' vision model to self iterate and review slide deck design and diagrams and re-iterate and perfect any imperfections! Managed to also take a photo of a business card while at a conference, ask the agent using Qwen3.7-Plus to lookup and research the person and company for insights.

@Random_Robbie @vysecurity I think the old models are open weight. These are subscription based.

@vysecurity What sort of vram we need or is this API wise?

@GooijerLiam I can bake in more to the methodology. What am I missing?

@nullenc0de I would love to try it in my metholodgy

I've onboarded a small group of users so far, and the response has been incredible, over 400 DMs and 200 comments! While I’d love to grant access to everyone immediately, my current LLM can't handle that volume just yet, so my next step is scaling up.

@julie_bush Haha. The didnt find vulns. Some people have historically been "aggressive" with their subdomain enumeration. Mine didn't quite live up to their expectations so we met in the middle.

@nullenc0de so you’re saying the bug hunter has bugs of its own huh? quite the irony

@Iam__Patrick__ I sent you a DM.

@nullenc0de Hello I would like to try this.

I am at the point where my bug bounty findings are 100% agentic. I am just pasting in the scope and letting the agent run. It can do full external tests for all kinds of environments. A few people already have access, but if you want to try it, comment/DM. ​How does it work? 👇

@tburakdirlik I sent you a DM

I also wired in asynchronous out-of-band polling to catch blind vulns (SSRF/RCE), strict route-aware guardrails to prevent unsafe credential spraying, and a dual-model "Skeptic" pipeline that cross-validates every finding to kill false positives before they ever reach the report.

What really makes it interesting is the cognitive loop. The agent scores its own confidence after every action, forcing itself to mutate payloads or pivot to new attack classes to avoid infinite loops.