Trail of Bits

We launched Patch the Planet with OpenAI, factored hundreds of weak RSA keys with a new polynomial technique, and bypassed every AI skill scanner we tested. Plus 10 new public reviews, gosentry, and more. June Tribune: mailchi.mp/trailofbits/ju…

NEW: rust-review — a security review plug-in for Rust, built by @zi0Black of Aptos Labs' Security Team with Paweł Płatek of @trailofbits. Rust's compiler gives you memory safety. It won't flag misused unsafe code, silent overflows, or nondeterminism. rust-review does.

@AptosLabs Inside, you'll find what Rust's guarantees don't cover, how to catch undefined behavior with Miri, property testing with proptest, our favorite Clippy lints, memory zeroization, model checking with Kani, and more. appsec.guide/docs/languages…

What we’ve learned about testing Rust for security, now available as a Testing Handbook chapter. We also released rust-review, a plugin for automated Rust security reviews, co-built with @AptosLabs. blog.trailofbits.com/2026/07/13/rus…

Later today at @SummerC0n, Asritha Bodepudi will show how to build a Windows n-day exploit chain for RasMan, the Remote Access Connection Manager service. 11:15AM ET, Main Stage, Littlefield in Brooklyn. summercon.org/schedule/

I've really been impressed with the framework for enterprise AI adoption and compounding value that Dan Guido talked about at the recent (un)prompted conference. He is the CEO of security company Trail of Bits, and he gives a detailed methodology for overcoming resistance and encouraging organization-wide adoption. I liked his talk so much (it's only 20 minutes) that I asked him to deliver it again on the O'Reilly platform and then take questions from the online audience. It's tomorrow at 8 am Pacific. Attendance is free. learning.oreilly.com/live-events/a-…

@CantonNetwork We tried Mewt on OpenZeppelin's canton-stablecoin reference implementation. All tests were green and coverage was 100%, but four surviving mutants exposed missing test cases. blog.trailofbits.com/2026/07/08/mut…

Mewt grades your test suite by sabotaging your code. Each change that doesn't get flagged by your tests is a potential bug. Today we're expanding it to support DAML, @CantonNetwork's native language, with two new mutant classes for DAML's authorization rules.

Fantastic AI Security Summit today! Diving into how building software and attack surface is changing. Always energizing to be around security leaders wrestling with the same hard questions we see every day at @trailofbits. Onward to RAISE 🚀 @FactoryAI @snyksec @NLilichenko

We gave GPT-5.5-Cyber a single /goal: find a specific class of bugs in zlib, the compression library used by Linux, macOS, iOS, and Git. It built a fuzzing lab in less than a day, a task that takes a skilled researcher weeks. Patch the Planet field report by Benjamin Samuels: blog.trailofbits.com/2026/07/02/fie…

cargo-audit flags Rust dependencies with known vulnerabilities, but it doesn't tell you whether your code calls the vulnerable function. We added a feature that checks your binary for vulnerable functions and labels any matches as "Affected," separating real exposure from advisories that don't apply. It's live in cargo-audit 0.22.2+. If you're behind, update with `cargo install -f cargo-audit`. crates.io/crates/cargo-a…

@OpenAI Each project gets a dedicated team of engineers to review their code, find vulnerabilities, and write patches. If you maintain critical open-source software, apply here: trailofbits.com/patch-the-plan…

.@OpenAI handed us their most cyber-capable models and asked us to work directly with open-source maintainers to Patch the Planet. We started with 19 projects: cURL, Python, Sigstore, NATS, and more. 50 projects have now joined the initiative. openai.com/index/patch-th…

We helped add ML-DSA and ML-KEM, NIST's post-quantum standards for signatures and key exchange, to the library. Install and migration details in the blog. blog.trailofbits.com/2026/06/30/shi…

1.2 billion downloads ran through pyca/cryptography last month. Nearly every Python app that touches crypto depends on it. If it doesn't ship post-quantum primitives, the Python ecosystem can't migrate. 🧵

New blog: the inside story on how and why Patch the Planet exists illusivedan.com/writing/patch-…

We redesigned trailofbits.com. Everything we publish is now in one place.

@Stanford We recently built 4 skills that bypassed every scanner we tested. He'll elaborate on our conclusion that the tools to catch malicious skills don't work. blog.trailofbits.com/2026/06/03/the…

We're a sponsor of @Stanford's Real World AI Security conference, where Sam Judson will present later today on why AI skill scanners fail. seclab.stanford.edu/RealWorldAIsec/

"For one of the vulnerabilities we developed an exploit to demonstrate its impact internally." Read more about our latest @trailofbits audit and the security findings that shaped our defenses: zoo.dev/blog/security-…

OpenAI Refocuses Cybersecurity Efforts on Patching Over Discovery securityweek.com/openai-refocus…