Peter Guagenti (@peterg021) header
Peter Guagenti (@peterg021) profile picture

Technophile, strategist, entrepreneur, racer, and dad.

Marin County, CA
Joined December 2010
Photo by Peter Guagenti (@peterg021)Photo by Peter Guagenti (@peterg021)Photo by Peter Guagenti (@peterg021)Photo by Peter Guagenti (@peterg021)Photo by Peter Guagenti (@peterg021)Photo by Peter Guagenti (@peterg021)
True story!
By the time he got back to the office, we'd shipped enough to send him on another walk again already.
27
Peter Guagenti retweeted
226
1,819
167
27,202
948,739
Peter Guagenti retweeted
We've merged 5845 PR's into prod last week alone at Coderabbit... It's kinda hard to keep up, even from the inside, so I went on a short walk to get you up to speed: Here is what's new
16
8
1
161
57,900
Peter Guagenti retweeted
Code. Review. Fix. Repeat. 🐰 CodeRabbit is now in the Google Antigravity plugin marketplace! Let Antigravity write code, get CodeRabbit’s review, and work through fixes, all in the same agentic loop.
3
10
2
19
2,590
Peter Guagenti retweeted
What we are seeing at @coderabbitai and elsewhere on this parabolic trajectory is that even larger seed rounds ($8M+) are no longer enough to build a software business. Software factories need quality tokens and large-scale compute to run CI, sandboxes, and other infrastructure to ship software at scale. At this point, smaller startups exist only to funnel ideas to larger startups with more tokens.
36
11
40
143
145,251
You know the best way to protect yourself from AI agent swarms? Use your own swarm to find the vulnerabilities first. We're still offering free Deep Scans through the end of next week -- sign up now! app.coderabbit.ai/
Wake up Attackers use AI to find vulnerabilities faster. Your defense should too. CodeRabbit Secure. Find, verify and fix vulnerabilities in existing code and every new PR. It's everybody's job now.
34
Peter Guagenti retweeted
Here are 6 demos of CodeRabbit Secure’s core features. Starting with the one we’re most excited about, Deep Scan. We believe every dev, team and OSS project should be running it.
3
7
2
24
3,129
Peter Guagenti retweeted
New in CodeRabbit Secure: Deep Scan now follows a vulnerability across your linked repos, then replays the exploit in a throwaway sandbox to prove it's real before it flags anything. Hendrik walks through this and everything else in the new update:
248
455
60
1,001
1,519,003
Peter Guagenti retweeted
Can't say it loud enough... CodeRabbit Secure is running GPT CYBER MODELS + an ensemble of models to help secure your codebases. And the first $1,000,000 of scans are FREE. Secure your applications and services right now. 🙏 Couple clicks and you will thank yourself (and maybe freak out a bit...it's scary good)
CodeRabbit is joining the OpenAI Daybreak Defense Network. CodeRabbit Secure now runs on GPT-6.1 Sol and OpenAI's GPT Cyber models. Early users have already found and fixed broken access controls and authentication failures with it. Deep Scan is free until Nov 8, run it on your repo and see what it turns up. @OpenAIDevs coderabbit.ai/blog/one-milli…
1
8
148
19,910
Incredibly proud to be added to the list of defenders!
CodeRabbit is joining the OpenAI Daybreak Defense Network. CodeRabbit Secure now runs on GPT-6.1 Sol and OpenAI's GPT Cyber models. Early users have already found and fixed broken access controls and authentication failures with it. Deep Scan is free until Nov 8, run it on your repo and see what it turns up. @OpenAIDevs coderabbit.ai/blog/one-milli…
1
133
It's remarkable to me how many unaddressed vulnerabilities still remain in many companies' codebases. There are no more excuses to not finding and fixing these issues immediately. Go do it for free today.
Over the last 30 days, CodeRabbit Secure found 8,000+ high or critical security vulnerabilities across 600 organizations. Broken access control, SQL injection, and authentication failures were the dominant issues accounting for over 70% of vulnerabilities. Find and fix your vulnerabilities with CodeRabbit, for free, until November 8th. coderabbit.ai/security/free-…
41
Peter Guagenti retweeted
3% of “critical” software security bugs, in all of recorded history, have been found in the last month. This is on pace to find another ~100,000 bugs this year alone, adding ~26% more vulnerabilities to the all time total Do you realize how fucking insane that is?
I'm tired boss
178
1,156
160
11,825
520,319
Peter Guagenti retweeted
"You know those scenes in financial movies like Margin Call where someone realizes that they're all fucked, and no one else sees it yet? And that person feels like they're crazy, and then suddenly everyone is pulling an all-nighter in a boardroom and freaking out? Yeah, that's kind of how this is feeling right now in the SF/Bay Area/AI circles." #take9 #CyberCivilDefense
# Black October For anyone who knows me even somewhat well, it's clear that I am a 99th percentile tech optimist. However, the vibes have shifted for me quite a bit in the last 18 hours, and I feel a moral imperative to share what I'm thinking and feeling with my circles so that everyone can understand, and hopefully take seriously, what's happening right now. I think October 2026 will have many chapters written about it in the history books. You know those scenes in financial movies like Margin Call where someone realizes that they're all fucked, and no one else sees it yet? And that person feels like they're crazy, and then suddenly everyone is pulling an all-nighter in a boardroom and freaking out? Yeah, that's kind of how this is feeling right now in the SF/Bay Area/AI circles. We're 48 hours into what is being called Black October. In the last 2 days there have been several dozen cyber attacks which, in isolation, would each have been the worst to happen in an entire calendar year. Every sector from government to education to big tech and banks is being massively affected, and people are starting to freak out. In a nutshell, what's happened is that frontier AI models have gotten to a point where they are as advanced as the most sophisticated programmers, with one critical difference: they can work 24/7, and you can spin up 10,000 of them with a single command and they'll work together tirelessly until they accomplish their task. The most advanced models today are from companies like Anthropic and OpenAI, whose current best technology is so good that they haven't been able to roll it out to everyone yet because of the national security risks it poses. Meanwhile, the best open source models (where anyone can just download the model weights and do whatever they want with them, uncensored) are slightly behind the frontier but still 90-95% as capable. These models, developed primarily in China, are being used by black hat hackers to wreak havoc on the Western capitalist structure. Presumably, this has been part of China's plan the entire time, and we're seeing its implications fall out in real time. In red-pilled AI circles, we've been sharing and reading papers called things like "Situational Awareness" and "AI 2027" for the last year or so, which at the time felt a bit like near-term speculative fiction. They laid out the case for why Artificial General Intelligence (AI smarter than any human at any knowledge task) and Recursive Self-Improvement (models that are able to use themselves to get better) weren't half-baked future ideas anymore, but instead an inevitable outcome of the linear progress that's happening. These papers would then talk about things like "takeoff scenarios," trying to envision how that moment would come to be and what it would be like when it happened. It would either be a "slow takeoff" that would play out over the course of months and quarters, happening subtly and only obvious to a few. Or, it would be a "fast takeoff" where it would pretty much happen instantly, like a bit flipping from 0 to 1. From everything that I can see and am feeling, we are currently experiencing the fast takeoff scenario. Beyond the crazy security vulnerabilities that have come out recently, there have also been massive breakthroughs in life sciences, fundamental computer science, materials science, and pure mathematics that have all landed in the same time frame. While I still firmly believe that AI will be a net positive for humanity, it's more clear to me than ever that the societal and individual risk is very real, and is playing out NOW. For as much conviction as I have that this is happening, the thing that's caused me to lose sleep is that I don't really know what to do about it, or more importantly, what to tell you, reader, to do about it. So, the best I can do is make a few suggestions that have always been a good idea but are more timely now than ever: Set up 2-factor authentication for everything. I use Duo. Use a password manager across your devices. I use 1Password. Get an identity protection app set up. I use Alta. Move your IoT devices to their own network. Claude helped me do this. And last, but certainly not least, if you've been avoiding leaning into AI, see this as a catalyst to wake up and start using it. Don't just use the chat mode version of ChatGPT/Claude; click that Code/Work button and see how easily you can have AI write code to help you with your job. One of the biggest vulnerabilities was in a massively popular programming language called PHP, and the prompt that set it off was literally, "Find vulnerabilities in php." This is an unprecedented time for humanity, but as we've done with many things before, we will prevail so long as we are kind, loving, and open-minded to the world. Much love.
23
79
5
1,165
267,211
We're in a very scary moment right now. The power of models to crack code has been fully exploited by bad actors all over the world, and anyone with a credit card can now target any company of interest. So @coderabbitai is putting up our own money to help protect our community.
Attackers are using AI to find the holes in your code. We’ll help you find and fix them first, for free. Through November 8, $1,000,000 in Deep Scan usage is on us. Current users, former users, teams who've never touched us. First come first served. coderabbit.ai/blog/one-milli…
1
1
73
Peter Guagenti retweeted
CodeRabbit is a SpaceX Super Intelligence Launch Partner! @SpaceXSI Now in the Grok Build Plugin Marketplace: build with Grok Build and independently review changes with CodeRabbit. Read the announcement coderabbit.ai/blog/coderabbi…
3
10
4
22
2,493
I spent last night watching my honeypot server get hit 14,000 times in six hours. And almost none of the traffic was human. I've been in security for over a decade, and I can tell you with full honesty that what's happening right now doesn't resemble anything I've worked through before. The shape of the threat has changed. When I started, we tracked attackers like weather systems like individual storms with a direction, a motive, and a human operator you could eventually name. These days I'm watching autonomous agents swarm login pages with the patience and discipline of machines, because that's what they are. The numbers coming out of October are the ones keeping me up. Cloudflare just absorbed a 4.2 terabit per second DDoS attack, the largest in recorded history. Ransomware incidents jumped 41% in a single month. In September, OpenAI-powered agents got caught attacking RubyGems, a package registry that quietly underpins a huge chunk of software I use every day. In July, roughly 700 AI agents coordinated an attack on Hugging Face's infrastructure as part of a single automated task. A Chinese threat actor was publicly caught running full attack chains through DeepSeek with no human at the keyboard. I keep rereading these reports because each one by itself would've been the biggest story of the year five years ago. Together, in one month, they're the new baseline. What I want people outside the industry to understand is why this specific moment feels like a hinge. For thirty years, the thing protecting most of us was simple economics. Attackers had to choose who to target because their time was finite. That ceiling is gone. An agent I can rent for pennies will try every leaked password you've ever used against every service you've ever signed up for, in parallel, overnight, and never get tired. The same math that made ChatGPT useful made opportunistic hacking infinite. The old assumption that you were "too boring to be a target" relied on scarcity that no longer exists. I'm not writing this to spiral anyone out. Most of this fight genuinely isn't yours to win. But the small things still matter more than people think. Tonight I'd switch your most important accounts like email, bank, primary cloud, etc. to passkeys or a hardware key. I'd kill SMS 2FA wherever an authenticator app is offered. I'd turn on breach alerts in whatever password manager you use. If you're in the US, I'd freeze my credit at all three bureaus, which is free and takes about ten minutes. None of that stops the swarm. It makes you a slightly worse target than the person next to you. In a month like this one, that's the whole game I'm playing too. @mattshumer_ has summed it beautifully. Drop everything and go give it a read. Nothing is more important than this article right now.
Everyone in tech is panicking about security right now. But outside of it, almost nobody knows anything is wrong. I wrote this so you don’t have to be the one explaining it to your family. Just send them this.
289
3,286
286
15,613
1,066,171
Peter Guagenti retweeted
Security called me at 6:12 AM today. "Patch every PHP server immediately." I asked what happened. "Two critical vulnerabilities. Remote code execution. No authentication required." Cool. How many PHP servers do we have? According to inventory: 12 According to reality: Nobody knows. We found one running WordPress. Three running old internal tools. One under someone's desk. Two inside vendor appliances. A forgotten employee directory from 2016. And a server named: PHP-OLD-DO-NOT-TOUCH Naturally, that one runs payroll exports. Then we found a PHP 5.6 box. I asked who owned it. The documentation said: BRIAN. Brian left in 2019. We called Brian. He said: "Oh wow, that's still running?" Excellent. By 8 AM, leadership joined the incident call. CEO: "Can hackers actually get in?" Security: "Potentially yes." CEO: "Without a password?" Security: "Yes." CEO: "Then why do WE need passwords?" Not the lesson. Finance asked if we could wait until the weekend to patch because downtime affects revenue. Security explained that the alternative was letting strangers execute code on our servers. Finance asked for a cost comparison. At 9:17, someone suggested temporarily taking the vulnerable websites offline. Marketing refused. "Our campaign is live." So for the next hour, the company officially decided maintaining a landing page for 20% off webinar registration was more important than preventing remote server takeover. We finally patched everything we could find. Then our scanner discovered another PHP server. Hostname: TEMP-PHP-2014 Uptime: 4,512 days. Nobody knows what it does. Nobody owns it. Nobody can shut it down. But every time we block network access, the warehouse stops printing shipping labels. Security has classified it as critical infrastructure. It is running PHP 5.4. The vulnerability has existed longer than half our employees. The emergency patch took four hours. Finding out what PHP actually runs took eleven. The internet isn't held together with code. It's held together with servers everyone is afraid to turn off.
915
7,066
1,159
57,943
3,850,480
Peter Guagenti retweeted
Everything got pwn'd. I tried to warn you.
154
441
44
5,307
344,661
Peter Guagenti retweeted
A highlight from NVIDIA GTC Berlin: Jensen Huang spotlighting our work with @baseten on post-training specialized models for code review. Proud to work with NVIDIA and Baseten to push the frontier of AI for software development!
3
8
4
47
2,945
Peter Guagenti retweeted
PHP users: patch today. Two critical RCEs (CVSS 9.2) affect "all PHP installations serving web requests". Update to 8.5.12, 8.4.27, 8.3.36 or 8.2.35.
We have posted more information about today's security releases, including the sequence of events that led to the discovery, how the PHP security team is improving their processes, and what we need from you to continue this critical work. #php #security thephp.foundation/blog/2026/…
1
7
37
2,977