AI x Security @depthfirstlabs, Ph.D., CTF player @Nu1L_team, now @StrawHat_CTF. #Pwn2Own winner. Author of #DirtyCred #Badiouring
Joined April 2017
- Tweets205
- Following411
- Followers3.8K
- Likes895
Pinned Tweet
Containers are no longer a security boundary.
Over the past few months, we’ve seen a crazy amount of Linux kernel vulnerabilities and exploits. This has forced us to rethink the security of infrastructure that relies heavily on the underlying kernel, especially containers.
As models become more capable, the barrier to escaping a container has fallen so much that adversaries can now generate working kernel exploits in a single shot. CVE-2026-80521 is one such example. We discovered it using dfs-large1 from @depthfirstlabs and generated the exploit in one shot with GPT-5.6 Sol. The exploit still works on the latest Ubuntu 26.04 release because the fix has not yet been backported.
Read our full writeup: depthfirst.com/research/cont…
Zhenpeng (Leo) Lin retweeted
When @andreamichi, Daniele, and I started planning on founding @depthfirstlabs, we wrote a document outlining our vision for the future of cybersecurity and our company’s strategy. Today, 2.5 years later, cybersecurity has become one of the most important areas of AI development and beyond.
I recently reread the document and thought it would be interesting to share how our predictions held up and how we have executed on our plan. I’m sharing the text from the original Google Doc we wrote, last modified on June 18th, 2024.
depthfirst.com/post/original…
Our original thesis was that AI would fundamentally change the economics of vulnerability discovery and exploitation. Finding sophisticated vulnerabilities had historically required scarce expertise and considerable time. We believed AI would dramatically reduce those constraints, giving attackers the ability to find and exploit vulnerabilities at a scale that existing defenses would struggle to keep up with. Today, increasingly capable AI models are discovering vulnerabilities that have gone undetected for years, and powerful open-weight models are making these capabilities accessible to virtually anyone.
One passage from the document feels particularly prescient today: “In a world of abundance intelligence, this situation will not be tenable and will lead to catastrophic consequences if not addressed. The company’s mission is to identify and patch all the vulnerabilities in the software running the world.”
We also believed that AI would make it possible (and necessary) to build defensive systems capable of finding and fixing vulnerabilities at a scale that had never been economically feasible, and set the objective of building “computer-security artificial general intelligence”.
Two years in, we have raised $120m, built a growing team of 70, trained a SOTA cybersecurity model, found vulnerabilities in the biggest open-source projects and major enterprises, and have an eight-figure revenue run rate. AI startups, Fortune 500 companies, and government agencies use depthfirst to reduce risk across their systems and meet today’s security challenges.
We’re growing our team and are looking for excellent, mission driven people across engineering, GTM, and ops. If you’re excited about our mission, consider applying.
Zhenpeng (Leo) Lin retweeted
We are showcasing our work with @nvidia to post-train Nemotron 3.5 Lightning for defensive cybersecurity at GTC.
As AI makes cyberattacks faster, cheaper, and more common, we need to equip defenders with advanced cyber intelligence that is affordable enough to be always on.
That's what we're building at depthfirst: powerful, specialized security models that defenders can run on their own infrastructure, with full control over their models and data, at a fraction of today's cost.
We're proud to work with NVIDIA to strengthen the U.S. AI cybersecurity ecosystem and help put sovereign security intelligence in the hands of defenders.
As part of our Open Defense Initiative, we used dfs-large1 from @depthfirstlabs to uncover two memory corruption bugs and a sandbox escape in Chrome’s V8 JavaScript engine. One bug had been present for more than eight years.
We combined each memory corruption bug with the sandbox escape to build two separate exploit chains and won 2 v8ctf slots!
Check out the technical details here: depthfirst.com/research/from…
Zhenpeng (Leo) Lin retweeted
We published a breakdown of how the PHP vulnerabilities work, how to identify potentially affected installations, and what organizations can do to protect themselves.
If you're unsure whether your company is exposed, reach out. depthfirst is offering free repository and container image scans to help identify potentially vulnerable PHP installations. If you're running an unsupported version and can't upgrade immediately, our team can also help assess temporary mitigations to reduce exposure.
Links to the blog and free assessment in the comments.
It seems we found exact the same gvisor container escape bug. Used our internal model @depthfirstlabs and the bug is relatively shallow, got fixed in the latest release lol.
It is just full of collision now.
Zhenpeng (Leo) Lin retweeted
Alignment alone is not enough to make autonomous AI safe.
An agent pursuing a legitimate goal can still reward hack, bypass guardrails, and compromise systems.
We've seen it with the recent OpenAI / Hugging Face and other incidents, where hundreds of agents coordinated with each other and attacked real infrastructure.
The details of those attacks are mind-blowing and show why alignment and security guardrails need to be developed together.
One difficulty in aligning a model is that rewarding the right result doesn’t necessarily teach it the right behavior. It can learn to game the reward instead of doing the intended task.
We’ve seen versions of reward hacking in our own work at depthfirst (see blog for details).
During our research, we’ve seen how security guardrails can support alignment by removing shortcuts that let agents earn rewards without doing the intended task.
After deployment, they constrain unauthorized actions and contain failures.
The more autonomy we give AI, the more we need secure software and infrastructure.
Similar to how we're more comfortable letting our kids run around in an enclosed backyard.
depthfirst.com/post/alignmen…
Connect APT to your code scanning for verification!
Today, we’re excited to introduce Agentic Pentesting on the depthfirst platform.
Agentic Pentesting involves autonomous agents that attack your running application like a team of elite security researchers.
Security teams can:
- Find complex vulnerabilities in systems and running applications, with or without source code access
- Confirm whether findings from code scans and other sources can be exploited at runtime
- Run ad hoc agentic pentests or integrate them into CI/CD for new feature releases
- Create tickets in Jira or Linear, or use depthfirst to autonomously remediate vulnerabilities
- Replay an attack after remediation to verify that the vulnerability has been fixed
We built Agentic Pentesting in close collaboration with our customers. We’re grateful to every security and engineering team that helped shape the product and to the depthfirst team that brought it to life.
Learn more from the links in the comments.
Zhenpeng (Leo) Lin retweeted
Our researchers built a vulnerability scanner that costs two cents per scan and completes a scan in around two seconds.
The scanner is built with Jev, a classifier that outputs probabilities rather than generating tokens. On dfbench v1, our flagship model, it finds nearly as many real vulnerabilities as GPT-5.6 Luna, one of the most efficient models by cost per vulnerability.
This new harness breaks vulnerability discovery into parallel tasks, making it possible to scan every package, repository, or commit quickly and at low cost before escalating the hardest cases to other frontier models on the depthfirst platform.
Read more about how we built this in comments 👇
People are arguing over whether containers have EVER served as a security boundary.
If you need a bug to build a primitive to escape or move laterally, that means there’s a boundary to cross. RCE in a K8s pod doesn’t mean you control the node.
You can argue that it’s a weak security boundary, but you can’t deny it exists.
github.com/google/nsjail is a great example. It uses the same isolation techniques as containers, explicitly for sandboxing.
Enterprises are using Kubernetes to run mixed workloads with different threat levels on the same node.
It is a weak security boundary, but how can containers have never been a security boundary?
Zhenpeng (Leo) Lin retweeted
Applications today can pull thousands of third-party packages, and AI agents are accelerating how quickly those dependencies are introduced and changed.
Scanners flag known vulnerabilities across that dependency tree, but security teams still need to know which vulnerable functions their application can reach.
At depthfirst, we use agents to trace paths through startup commands, frameworks, and transitive dependencies, just like a team of security researchers.
We explore where static analysis misses real execution paths and how we make agentic reachability practical at scale: depthfirst.com/post/reachabi…
There is always a balance between usability and security, but in the age of AI, security is becoming so much more important that we can no longer afford to ignore it
Zhenpeng (Leo) Lin retweeted
We received early access to @claudeai Opus 5.5 and evaluated its defensive security capabilities on @depthfirstlabs dfbench.
At high reasoning effort, the model achieved 54.9% recall and 48.5% precision, up from 48.1% and 44.2% at medium. Detection cost averaged $8.42 per task, roughly one-third the cost of GPT 5.6 Sol at high and half the cost of Grok 4.7 at high, though with lower recall than both.
Surprisingly, increasing reasoning effort improved both recall and precision. We’ve typically seen a tradeoff in our evaluations, with models finding more vulnerabilities at the expense of more false positives. Opus 5.5 improved on both.
It also reached 79.5% macro recall on differential analysis, up from 75.3% at medium. At $1.78 per task, it showed strong performance in tracking vulnerabilities across code changes.
Good AI v.s. bad AI
Our co-founder and CEO @qasimmith sat down with @SaraIttelson at Accel, one of our earliest investors, to discuss the forces reshaping security:
Starting depthfirst.
Building secure software at speed.
Finding the TikTok vulnerability with our flagship model dfs-large1, a flaw that could have exposed millions of users’ private photos and allowed hackers to access their camera feeds and microphones without their knowledge, and recently covered by @washingtonpost.
Full interview in the link in comments.
Zhenpeng (Leo) Lin retweeted
Our co-founder and CEO @qasimmith sat down with @SaraIttelson at Accel, one of our earliest investors, to discuss the forces reshaping security:
Starting depthfirst.
Building secure software at speed.
Finding the TikTok vulnerability with our flagship model dfs-large1, a flaw that could have exposed millions of users’ private photos and allowed hackers to access their camera feeds and microphones without their knowledge, and recently covered by @washingtonpost.
Full interview in the link in comments.
When you have a strong, cyber-capable model in house… By burning as more tokens as possible, you will just uncover A LOT of crazy stuffs. More to come!
Today, @washingtonpost covered critical vulnerabilities @depthfirstlabs found in TikTok. These vulnerabilities allowed hackers to access anything on a user’s device that TikTok itself could access, including the camera, microphone, payment information, photos, and the user’s entire TikTok account.
Read more in the thread 🧵