Off By One Security

I woke up to 2 vulnerability submissions that were duplicates, 1 critical and 1 high in Grafana and Flowise. Dups are frustrating after hours of triage but is part of the game. However, they are far more common due to AI. Teams are flooded with submissions but it will likely die down as fewer vulnerabilities remain due to AI code scanning.

I just posted a video on the @offby1security YouTube channel titled, "Human Expertise Still Matters: AI Vulnerability Discovery, Triage, and Patching." I hope you find it useful. I put in some real world examples around the challenges with validation. youtu.be/ayaINQn7K08

Just a quick note to let folks know that we are moving the videos from the "Live" link/page on the YouTube channel over to "Videos," and so you may see alerts. YouTube punishes with the algorithm for videos that are Live vs. uploaded. Plenty of new streams coming up! Thanks!

Coming up at 11AM PT today!

Join me this Friday at 11AM PT on the next @offby1security stream with guests @jon__reiter, @kevin0x90, & @karimlalji1 for a session on "Building the Kill Chain: From Initial Access to Kernel Research!" youtube.com/watch?v=naTlEv…

I'm looking forward to speaking at @CypherCon in March 2027! Shout out to @Goetzman. I'll show transparency around the state of AI in relation to autonomous offensive testing, Human-in-the-Loop considerations, limitations, automation, and cost! cyphercon.com/speaker/no-tho…

Join me for the next @offby1security stream at 11AM PT Thursday, June 11th (Today) with @Alh4zr3d for a session on offensive tooling, tradecraft, research, and perhaps a little black magick! youtube.com/watch?v=4Es2Sc…

Please join us for the next @offby1security stream at 11AM PT this Friday, May 29th with @Ni_Aimable for a session on "AI Agents as Confused Deputies!" youtube.com/watch?v=y_Gvg2…

Confused Deputies and Stolen Tokens: Breaking and Rebuilding MCP Auth with Brooks McMillin x.com/i/broadcasts/1…

Today's stream at 11AM PT / 2PM ET!

ACID, the offensive AI security testing platform is now available to enterprises. It solves a lot of the challenges seen out there such as using a connector agent that runs on your prem allowing for control & internal testing. Reach out for a demo below: #contact" target="_blank" rel="nofollow noopener">acidapp.ai/#contact

Join us this Friday (May 22nd) at 11AM PT on the next @offby1security stream with guest Brooks McMillin for a session on "Confused Deputies & Stolen Tokens: Breaking and Rebuilding MCP Auth!" youtube.com/watch?v=Wp8U1C…

The video from @htejeda & I "The Challenges of Building an AI-driven Security Testing Platform & How We Solved Them" is up on YouTube! We discuss challenges like transparency, validation, authentication, access limitations, ... youtube.com/live/3s1fXVqzn… acidapp.ai

Please join us on the next @offby1security stream this Friday at 11AM PT with @htejeda for a session on "The Challenges of Building an AI-driven Security Testing Platform and How We Solved Them." We will be announcing more streams shortly! youtube.com/watch?v=3s1fXV…

Happy to share that we sponsored a K9 Officer's Bullet Proof Protective vest for Axel who works for the Mississippi Department of Corrections!

Five years from now the state of the AI-era cybersecurity industry will have resulted in:

Automated Reverse Engineering with LibGhidra, GhidraSQL, and AI Agents x.com/i/broadcasts/1…

The stream below with @allthingsida is tomorrow (Friday) at 11AM PT!

With the low barrier to entry for vulnerability research due to AI, that used to require advanced and niche skills, I'm seeing that exploit mitigation bypasses are still difficult for AI. Weaponizing vulnerabilities still requires advanced knowledge. Disclosure != Skill...

Join us next Friday, May 8th at 11AM with Elias Bachaalany (@allthingsida) for the next @offby1security stream on, "Automated Reverse Engineering with LibGhidra, GhidraSQL, and AI Agents! youtube.com/watch?v=9avSjD…