Co-founder @getfailsafe. Ex-CISO/eng leader @Grab, @Google. Writing on AI security, building companies, and lessons at 40.
Keeping the world safe
Joined April 2022
- Tweets2.4K
- Following7K
- Followers34K
- Likes5.3K
Pinned Tweet
Doing our part -
If you’re a company or project and need to know if your code or app or users are safe, we’re giving $999 scans using our frontier cyber models.
Stay safu
Excited to announce our new agentic cybersecurity company, @getfailsafe!!
😫
Black October - everything compiled to date on hacks and exploits
getfailsafe.com/october-2026…
Wui | FailSafe retweeted
Quick write up for those following the incident
getfailsafe.com/binance-susp…
Binance's initial investigation suggests that the security incident may involve a compromised DevOps engineer’s laptop, which allowed an attacker to gain access to a service container and submit unauthorized withdrawal transactions. We have found no evidence of any wallet private key leak. We will share a detailed technical post-mortem once the investigation is complete and the facts are fully verified.
The estimated total impact sits at around $6.3B. We have worked with blockchain partners to freeze affected assets, with ~$3 billion frozen on-chain so far.
Binance will cover all losses from the SAFU fund and the company’s funds. User funds are safe. We will also publish an updated Proof of Reserves once the remediation is complete.
As an immediate precaution, Binance has:
- temporarily suspended deposits and withdrawals while security checks are completed;
- revoked the affected address authorisation;
- engaged law enforcement and blockchain intelligence partners to trace and recover funds.
Our teams are working around the clock to resolve this issue safely and thoroughly. We are working closely with our law enforcement partners to confirm the identity of these criminals and bring them to justice.
Please rely only on official Binance channels for updates. Please feel free to contact Binance Customer Support if you have any further questions.
binance.com/en/support/annou…
3 words. Continuous offensive security.
It’s called @getfailsafe - check it out.
Security testing is moving from a yearly checkup to always on
18% of CISOs run most of their offensive testing continuously today, 52% expect to within a year
They also want AI to close the loop, 70% would use it to retest and confirm their fixes actually worked
From a16z's @OwenColby and @steph_zhang, breaking down a survey of 100 CISOs at companies with 1,000+ employees: a16z.news/p/the-new-security…
Security through obscurity is not security.
despite the unfortunate timing, we take disclosures seriously at @typesafeai
at approximately 6:49PM this Friday evening, we became aware of a massive unauthorized leak of ALL customer noul outputs
in effort to maximize transparency, here is the link: gist.github.com/diogo149/810…
Advice to CISOs for 2027 - ask for budget for agentic tooling.
My biggest takeaway?
1 school kid with a flash subscription hacked the largest banks in South Korea in his dorm room, with no professional training.
Enterprises need to wake up and stop thinking security through obscurity (and some traditional security tools) will protect them in today’s world.
Last week some of South Korea's biggest banks were hit by a cyberattack. Thanks to a report from CrowdStrike tonight, we now know the entire hack may have been done by a single person. He used a combined stack of an open-source AI penetration tool named ARTEX, DeepSeek v4.1-Flash, GLM-5.3, Grok 4.6, and Claude Code.
Wui | FailSafe retweeted
If you're in Singapore for @F1 Week, Singapore @GovWare and @token2049, we're lining up a stellar set of events for our partners, clients, and friends:
👇🧵
That's why the good people at @getfailsafe put together a plan -
The CISO's 100-Day Guide to 2027. A scorecard, a Master Budget Map (increase, decrease, justify, named vendors), and a 100-day plan to land a costed ask.
getfailsafe.com/cisobudget20…
In 100 days, your board will expect a response to agentic threats.
In 100 days, you're gonna be facing roughly 10x the number of agents probing your attack surface.
Are you ready?
Our @getfailsafe agent created this with one prompt and $6.80 in credits.
gg marketing agencies.
Wui | FailSafe retweeted
Announcing FailSafe's listing as a solution provider on the @MAS_sg Pathfinder Programme (PathFin.ai).
PathFin.ai is a collaborative initiative between the Monetary Authority of Singapore and the financial industry that fosters knowledge exchange in Artificial Intelligence (AI) implementations.
For financial institutions in Singapore, this means FailSafe’s agentic offensive security platform is now among the solutions available for consideration through the programme.
FailSafe SWARM continuously pentests applications, APIs, cloud and AI systems the way a real attacker would. Confirmed findings include proof-of-concept evidence, remediation guidance and audit-ready reporting, supported by traces showing how vulnerabilities were identified and validated.
The practical difference is cadence. Offensive testing that keeps pace with release cycles rather than arriving once a year. SWARM achieved the highest publicly reported score on CVE-Bench v2.1.0, an autonomous black-box exploitation benchmark, scoring 62.5% in the zero-day setting on a single run per target.
Let's chat about a new security model for the age of AI.
