Auditware

Small tip on avoiding cyber blocks on Fable/Mythos 👇 > The guardrail is way more sensitive at the first couple of prompts > If your repo is auto-flagged on "hello", start a session outside the repo > Start with a UI request rather than a cyber task > Gradually have the UI be filled with the actual task, but the UI testing being the driving force (this sometimes actually works)

Playing around with @HopscotchAI for a cheaper OpenRouter (model router) alternative to access uncensored models (a must today for any security reseracher) Reasons I'm looking for an alternative: - OR has hidden defaults like "Allow free endpoints that train on request data" which annoy me - The routing fee is wild, unless you switch to price-sort, which in return sends your prompts to the entire world - Going to a direct provider (e.g. digital ocean) may be predicted, but again not ideal routing fee @HopscotchAI wins I found so far: - beautiful fine-grained controls over daily caps - 1 click zero data retention guardrails and data leakage blockers - Chaining providers (!!) - instead of relying on "cheap" as a decision chain, you can create an ordered provider preferences to have complete control on where your data is going I use hermes as a harness to plug to this, you can set it up in anthropic if you enable developer tools but hermes is more native to that kind of work

This can't be happening again.. (oct 14) At this point its just worth vibe-coding your own next.js alternative

I got to play the bug triager side for once, here are my thoughts Spoiler alert: this bounty program we hosted is now over, with no one managing to break the boundary and compromise the underlying hetzner box. 1. Not a single competitor hid the fact they used AI completely 2. I've seen the difference between competitors that are silently working with sending agents cleverly and with dedication, and ones that just let the AI submit whatever. Only 2 talented individuals studied the surface enough to realize they can request labs that are otherwise turned off, that will definitely open more grounds for their testing 3. Most submissions sounded like the bug worked, pocs looked like a total win, but upon replication were actually not even the scope requested, and severities unnecessarily exaggerated. this point is what makes triage fail nowadays IMO as this is frustrating to try to justify AI hallucinations all day 4. $1,000 is not a large bounty, I engaged with competitors that had spent $100 on tokens just for the competition, yet gained nothing - AI bug bounty has become like gambling in a sense. 5. If you take a security researcher, and let it vibe-code a dangerous app (e.g. ones that lets any user from the internet run as a root in a cluster you host for them) - with enough dedication can still produce highly resilient app architectures that stand against hacks (at least for how much $1,000 bounty proves). 6. Open sourcing an app you are also hosting is the scariest thing right now, threat-wise Fun experiment, we might open source this thing! (that would definitely help the agents go further)