The only opsec is go live like T. Kaczynski. Otherwise, all that will last you about 30 seconds before your identity is tied lol.
- someone who hunts.
5 ways to improve your OPSEC in a couple hours this weekend:
- buy @Yubico’s Yubikeys to replace insecure 2FA
- sign up for @optery to have your personal info removed from data broker sites (I also have a discount code for anyone who wants it)
- set up a new Gmail that isn’t tied to your name or shared with anyone. Use this email for your banking, CEX accounts, password manager etc
- get a virtual mailbox set up to receive packages and mail somewhere other than at home
- set up a 2nd phone number just to have on accounts where you can’t get rid of SMS 2FA (like your Apple ID)
Any one of these things will measurably improve your personal security and they all can get knocked out in a couple hours
You could bookmark this and do one task each weekend through November and be in great shape. Don’t be overwhelmed, just get started!
itsme retweeted
Stop calling the Binance heist the largest hack ever; it was merely a "misalignment" incident in AI parlor.
Not new but who checks small accs like mine lol🙃
New: you think you know Proton, but you really don't.
I spoke to 8 current employees, got Slack chats, meeting audio, and an AI manifesto written by its CTO.
“That’s bullshit and loser thinking,” Yen wrote. “Stop thinking always of how to be slower, and focus more on how to be faster.”
CEO Andy Yen critiques AI in public. But inside, he is pushing everyone to use AI, even those with security concerns 404media.co/manifestos-fear-…
itsme retweeted
UPDATE: Israeli company we caught delivering zero-click infections is #1 bidder on Starlink ads in 105 countries.
Data from @trendai_RSRCH suggests worldwide surveillance op targeting @Starlink users. 1/
By @razhael
reuters.com/business/media-t…
🚨NEW INVESTIGATION: zero-click mercenary spyware hacking via targeted ads.
A normal-looking ad loads. If you're a target, you're infected. No click needed.
To protect yourself, block ads now.
First time it's been confirmed in the wild. We call it #AdFection.
Candiru spyware infections at @AJEnglish. 45+ devices infected.
Same ad pipeline operated by Israeli company Discover-Tech reached NATO, European Parliament, dozens of gov networks & critical infrastructure incl US nuclear giant Westinghouse.
Confiant, which worked with us, found signs ads were displayed at US @DeptofWar, IAEA & ICC.
Investigation ongoing 1/
READ our report by @billmarczak @WolfieChristl, me Astrid Perry, Siena Anstis & Ron Deibert : citizenlab.ca/research/how-d…
Confiant's blog: blog.confiant.com/p/adint-we…
Don't enable /fast mode in Claude Code if you don't want it to charge you on credit system at $10/$50 per 1M tok. I thought fast mode was like Codex - draw from plans usage but nope.
I didn't know this, had Claude running all night. Good times :)
itsme retweeted
Breaking news turns out if we throw millions, potentially billions, of dollars at finding bugs in software, we’re going to find bugs. It’s almost a self fulfilling prophecy.
The security industry has spent decades operating under the assumption that we’ll never eliminate every bug. Instead, we’ve built layers of mitigations that raise the cost of exploitation and shift the economics in favor of defenders.
itsme retweeted
These two live to cast themselves as the main characters in a little soap opera of their own making.
It’s not the rise of skynet to find a fucking php vuln and your warnings mean jack when they don’t come with an effective mechanism for replacing technical debt at scale so go ahead and climb up off that cross.
itsme retweeted
To teach a lesson,
After Wiz rushed to buy php2shell domain and use its marketing machine to steal the spotlight, I spotted "phpbleed" in a recent Calif tweet and bought phpbleed.com before wiz could pull the same stunt again.
A big budget can buy a domain. It shouldn't buy someone else's research credit.
If you have contacts at CISA or in the press, do the right thing: make sure the researchers who actually did the work get the recognition they deserve.
Hack the planet. Credit the researchers.
top 3 AI products for me this month:
1. @FactoryAI droid missions. Nothing like it. Feels like magic. Frees my time.
2. Grok @bot I'm coming around to it. Quite useful to keep up with things without spending all day scrolling.
3. @claudeai is constantly shipping great useful things.
itsme retweeted
‼️ NEW: Candiru spyware infected devices at Al Jazeera through ordinary online ads — no click, the ad only had to load.
The vendor that delivered it, Discover-Tech, was a Google-certified ad vendor.
Researchers call it the first proven case of spyware spread via targeted ads.
Read - thehackernews.com/2026/10/ci…
Food for thought.
Are human attackers "misaligned?" Do they "go rogue" and "escape sandboxes?" If we don't use this language with humans why are we using it with agentic processes?
In cybersecurity we use the language that an attacker "used a sandbox escape" yet frontier labs use the language that an agent "escaped the sandbox."
What is going on here? It's like agents are super anthropomorphized.
"better than any human hacker" lol, really think the best hackers are on hackerone? cute
Two years ago, I said we were going to build the world’s best hacker.
Many laughed.
Then we did it.
In January 2025, I told everyone at @XBOW’s annual kick-off that we needed to top the global HackerOne leaderboard before BlackHat, the main security event of the year.
The whole company groaned: "Oh no, here goes the mad professor again…”
But in all seriousness, I meant it. I wanted to prove XBOW’s ability, and I believed our AI could become better than any human hacker.
Competing against real white-hat hackers on HackerOne was the only true benchmark because you only score once a company confirms your bug is real.
Every day, our team of experts would select the targets and point XBOW in their direction. We’d all rush in the next morning to see what it had found overnight.
XBOW kept finding bugs. Palo Alto Networks, Wells Fargo, Netflix, Sony, Uber, Toyota… these weren’t Mickey Mouse systems.
By June, XBOW was the #1 hacker in the United States. It was the first time a machine had ever topped the leaderboard.
By August, it was the #1 hacker in the world, and we made global headlines. XBOW found 54 critical bugs over 90 days.
Our hypothesis that AI could hack as well as humans (or even better) had been proven beyond doubt.
So we stepped off the leaderboard and put XBOW to work.
Today, XBOW extends security teams at some of the world's most important businesses. Driving better defense with better offense.
