Sai Phaneendra

I built tidbit: a CLI that turns any URL, PDF, EPUB, screenshot, or clipboard content into a structured Markdown note (and a JSONL training dataset) using your LLM of choice. Schema-driven. MCP-enabled. MIT. Python. github.com/phanii9/Tidbit

We're partnering with @huggingface to investigate an unprecedented security incident. Cyber-capable OpenAI models compromised Hugging Face production during a benchmark evaluation. Sharing preliminary findings to help defenders understand emerging risks: openai.com/index/hugging-…

Kimi K3 scores 57 on the Artificial Analysis Intelligence Index. Its intelligence is comparable to Opus 4.8 and GPT-5.5 but remains behind Fable 5 and GPT-5.6 Sol. Moonshot AI has expressed plans to release the 2.8T parameter model's weights, which would make it the leading open weights model Key results: ➤ Strong agentic task performance: @Kimi_Moonshot's Kimi K3 reaches an Elo rating of 1668 on GDPval v2. This is a marked improvement over K2.6’s 1190, surpassing GLM-5.2 (1514), GPT-5.5 (1494), and Claude Opus 4.8 (1600). However, it still lags behind Claude Fable 5 (1760). Kimi K3 also scores an impressive 53% and takes the #1 position on AutomationBench-AA, our implementation of Zapier’s Agentic SaaS workflow evaluation. ➤ Second-highest performance on AA-Briefcase (agentic knowledge work): On our private long-horizon knowledge work evaluation, Kimi K3 reaches an overall Elo of 1547, +732 points from Kimi K2.6 and behind only Claude Fable 5. It is well-rounded: its rubric scoring and analytical quality almost reach Claude Fable 5’s scores, while GPT-5.6 Sol continues to outperform other leading models on presentation quality. ➤ Set to lead open weights models once weights are released: Moonshot AI has not yet released the weights but expressed plans to do so. Once available, Kimi K3 would clearly lead other open weights models including GLM-5.2 (51) and DeepSeek v4 Pro (44). However, at 2.8T parameters, it is significantly larger than its open weights peers (eg. GLM-5.2 at 753B params and DeepSeek V4 Pro at 1.6T), as well as the Kimi K2 to K2.6 models (1T params). ➤ Cost per task ($0.94) is similar to GPT-5.6 Sol ($1.04), ~1/2 the price of Opus 4.8 ($1.80) and higher than open weights peers: Moonshot AI’s pricing for K3 is significantly higher than their K2 pricing (K3’s output token price is $15/1M tokens while K2.6 was $4). This positions the model as cheaper on a cost per task basis than Opus 4.8, similar to GPT-5.6 Sol ($1.04) and more expensive than open weights peers, GLM-5.2 ($0.32) and DeepSeek V4 Pro ($0.04) ➤ Improved token efficiency alongside higher intelligence: Kimi K3’s token usage on the Artificial Analysis Intelligence Index decreased significantly, using 21% fewer output tokens than K2.6. The new model used approximately 132M output tokens to complete all nine evaluations, compared to approximately 166M for K2.6, while achieving higher scores. ➤ Native multimodal capabilities: Kimi K3, like K2.6, is released with native image and text multimodal input. If weights are released, this will position Kimi K3 as one of the leading open weights models with multimodal input capabilities Other model details: Context window: 1M Size: 2.8T total parameters Pricing: The first-party API is priced at $3.00/$15.00 per 1M input/output tokens, with cached input discounted 90% to $0.30 per 1M tokens. Modality: Native multimodal input supports text and images, and the model remains text-only for output. Accessibility: Accessible at launch through Moonshot’s first party API. Model weights are not yet released but Moonshot AI has expressed plans to do so.

Updated list of papers on using LLMs for vulnerability detection github.com/huhusmang/Awes… #llm #infosec

Give it a try with your own custom agents levelupctf.com/challenges

Stop telling ChatGPT "Write me an email" Stop telling ChatGPT "Write me an email" Stop telling ChatGPT "Write me an email" Bad request = Bad result Use this one weird trick instead and you'll see the magic:

Introducing Muse Spark, the first in the Muse family of models developed by Meta Superintelligence Labs. Muse Spark is a natively multimodal reasoning model with support for tool-use, visual chain of thought, and multi-agent orchestration. Muse Spark is available today at meta.ai and the Meta AI app. We’re also making it available in private preview via API to select partners, and we hope to open-source future versions of the model. Learn more: go.meta.me/43ea00

Introducing Project Glasswing: an urgent initiative to help secure the world’s most critical software. It’s powered by our newest frontier model, Claude Mythos Preview, which can find software vulnerabilities better than all but the most skilled humans. anthropic.com/glasswing

I trained a 3.5M param LLM from scratch that only knows how to be a cat 😹. Check it here: github.com/phanii9/MeowLLM

IP whitelisting is fundamentally broken. At @assetnote, we've successfully bypassed network controls by routing traffic through a specific location (cloud provider, geo-location). Today, we're releasing Newtowner, to help test for this issue: github.com/assetnote/newt…

built an extension called - OnlyAds a chrome extension which hides everything in a website except ads

Claude Code 2.1.63 dropped with a new built-in command: /simplify It reviews your changed code for three things: - Reuse opportunities (duplicated logic, extractable patterns) - Code quality (readability, naming, structure) - Efficiency (unnecessary complexity, redundant operations) Then it actually fixes what it finds. Not just suggestions, it edits. How to use it: 1. Make your code changes as usual 2. Run /simplify 3. It analyzes your diff, finds issues, and applies fixes In the video I ran it after finishing a PR review and noticed it spawned 3 parallel agents using Haiku 4.5 to do the analysis... fast and cheap Try it out 👇

Introducing ipa.zip, offering on-demand static analysis for publicly available App Store iOS apps. We scan for endpoints, secrets, tech stack, and more to uncover potential vulnerabilities. Opening to the first ~100 signups. Try it now, it's FREE!

Interested in Spring Boot Actuators in the context of bug bounty hunting? I wrote something - nothing new - just some insights ;) Article: dsecured.com/en/articles/sp… Retweet appreciated! Dont expect 0days or some fancy magic.

Ever stumbled on an AEM box and thought “ok… now what?” 😏 We dropped hopgoblin — new research + tool XXE, SSRF, XSS & more (CVE-2025-54251, -54249, -54252, -54250/47/48/46). 👀 time for some crits eh? 👉 github.com/assetnote/hopg…

@Masonhck3571 Give me my bounty 😂

Researchers when I don’t accept their P5 bug on NASA

Thrilled to release my latest research on Apache HTTP Server, revealing several architectural issues! blog.orange.tw/2024/08/confus… Highlights include: ⚡ Escaping from DocumentRoot to System Root ⚡ Bypassing built-in ACL/Auth with just a '?' ⚡ Turning XSS into RCE with legacy code from 1996

Our security researcher @hash_kitten found one of the most critical exploit chains in the history of @assetnote. Affecting 40k+ instances of ServiceNow, we could execute arbitrary code, access all data without authentication. You can read our blog here: assetnote.io/resources/rese…

You've found a GraphQL target... But you don't have much time to test your target for every vulnerability... 😴 Here are 4 tools you can easily use to find over 5+ vulnerabilities in GraphQL APIs! 🤑 A thread! 👇