Security, software correctness, and Rust 🦀 Doing the cyberz @OpenAI prev: @RobinhoodApp, Cruise, @zellic_io, @Dropbox My awful opinions are my own
San Francisco, CA
Joined November 2013
- Tweets16.3K
- Following479
- Followers21.4K
- Likes50.2K
Pinned Tweet
I'm excited to announce I'm joining @OpenAI!
I left Robinhood in March of 2025 to embark on a wonderful year and a half long career break. I used that time to: travel (I went drifting in japan!); build a low-latency arbitrage bot on Solana, briefly becoming the 60th most profitable arbitrage bot on the chain; and learning @leanprover in service of building an accurate model of rust to prove `unsafe` rust code was free of UB!
But a lot has changed. For one, most engineers I knew were, at the time, leveraging Github Copilot as an "intelligent autocomplete" to accelerate parts of writing code. Software was (and at many places, still is) manually reviewed, and there was much doubt, especially from myself, that models could ever improve to the point to economically handle the more complex tasks of implementing entire features, proving conjectures, or discovering, and exploiting, novel 0-day vulnerabilities.
Clearly I was wrong! I've been shocked and inspired by the rapid advancement going on in the industry while I was away. One thing has been abundantly clear: security is changing.
I'm excited that I get an opportunity to work on some of the most important problems facing our industry today. And I get to play a meaningful part in discovering, and contributing, to the next generation of strategies required to secure this burgeoning technology.
I propose we all give agents the weekend off so they can stop popping everything while people are away from work
d0nut 🦀 💜 retweeted
Now online from BSides Canberra 2026: @chompie1337 presents “Building an Autonomous N-day Exploit Generation Pipeline”.
Watch now: youtu.be/03Xh_6_6U4M
d0nut 🦀 💜 retweeted
This is incredible lol, Orange Tsai popped browser from calc
Don't worry @orange_8361, there are still people reading blog posts and articles from start to finish 😄 that was a beautiful exploit chain!
blog.orange.tw/posts/2026-10…
d0nut 🦀 💜 retweeted
I got second overall at the Google Bugswat in Singapore!! 🎉☺️
It was a talented group of almost 50 hackers so I am really proud of the findings and thankful to have been invited!
d0nut 🦀 💜 retweeted
The critical Brotli RCE vulnerability discovery came out of our large scale infrastructure code scanning efforts
Great research by @k_tr4n and @_sy1vi3 in assessing the widespread impact of this bug
Update your Node.js, Bun, Envoy, anything using Brotli ASAP!
During this red-teaming exercise, we also found a vulnerability that allows for unauthenticated remote code execution in Brotli, a widely-deployed compression library included in many pieces of software such as Node.js, Bun, and Envoy.
The flaw could let an attacker run their own code on affected systems by sending or replying with malicious compressed data, without any need to create a user account. That is, an unpatched server that accepts compressed input could be taken over by a malicious client, and an unpatched client that accepts compressed input (such as “curl --compressed”) could be taken over by a malicious server.
This root cause issue was actually fixed in the Brotli source code in February, but it wasn’t known at the time that it gave rise to a security vulnerability and there was no more recent release of Brotli. Since Brotli is built into other software, any software which includes this library needs to take the update too, followed by the users of that software. We disclosed the vulnerability to Brotli and other downstream projects such as Node.js, which released or are currently releasing security updates, and Brotli cut new release versions and published a CVE.
More details on the patch and mitigations below:
patchtheplanet.org/brotli
The stuff coming out of the security org is absolutely insane. It’s still hard to comprehend what you’re seeing sometimes.
Y’all should read this!
The amount of coffee I’ve drank since joining openai is astounding.
Forget token usage; my caffeine usage is through the roof 😵💫
d0nut 🦀 💜 retweeted
Someone told me last week to look for “signposts” that might indicate attacks were getting significantly faster and worse than the historical norm. Do you think we’re seeing any of those?
