danieltk76

thankfully I already had frontier airlines marked as spam email, so this changes nothing for me.

Back in August we found this cool bypass of developer restrictions in Atlantis, leading to an unreviewed terraform apply & RCE! The vulnerable Gitea approval path dates back to the integration's introduction in v0.28.0 (May 2024), so the bypass was most likely present for roughly two and a half years before the patch shipped in October 2026. Enjoy!

happened to me too!

I think air gapping will be a necessity soon.

Be sure to check your bean validation! If your authorization check lives inside the handler, anything validation does runs before it, under the caller's identity.

Pretty Sweet vuln we found in OneDev @ Vulnetic! A year ago models struggled to do more than read response codes, its really cool to see how far the technology has come to where our AI Sable can reason past a 403.

My goal with this blog post is to help others keep their AIs in scope. It seems like recently people are happy to just trust that models will follow your prompts, and that just isn't reliable for production systems.

Why was this not a thing BEFORE continuing to develop AI? Makes me think that if they actually believed in AI causing extinction, they would have already had a kill switch.

I was working on some soc2 audit materials for my startup, and claude refused to edit a document because it would "tamper with the record". I suppose claude noticed I started the doc a few months previously and was worried I was tampering with evidence. No matter what I did it wouldn't help me. I suspect there will be more situations like this in the future.

We tested whether prompt canaries and honeypots could detect AI attackers.

Prompt canaries were surprisingly unreliable. I suspect the defenses model providers have added against prompt injection also make models less susceptible to prompt canaries.

Honeypots worked much better, having roastable accounts that are otherwise useless seems to be a good catcher.

reachout at danielk@vulnetic.ai and Ill give you some free credits to try us out!

I could see the value of using burp as a way to have a GUI look at what your agent is doing, but I know at Vulnetic and other ai security vendors we use our own proxies or custom scripting rather than burp.

yea but part of this is the consolidation of funding too. Standards to raise seed capital are soooo lofty now compared to 3 years ago. If you are in your in, if not good luck.

great, but nobody can use it for another 100 days right?

hahaha i still have access

this might be dated. the tech moves very fast in this space and architecture from 6 months ago is dated.

We have posted some articles on it (blog.vulnetic.ai), Im also happy to chat!

Daybreak blue is definitely a good model (I think a further post trained GPT 5.6 sol). Alot of the capabilities they talk about Astra having though have been available with good harness engineering for a year now.

The guardrails are horrendous for cybersecurity. you will get booted quickly down to Opus 4.8

is there just a GC where people go sign these things?

tbh I wasnt that impressed by it. initial benchmarks were trying to say it was AGI but i told it to re-build Palantir in 1 pass and it gave me a non working prototype

to be honest I found it underwhelming.

they could yea...

I have been using daybreak blue for a few days now. Its fine, slightly better than gpt 5.6 sol. The harness really really matters as does validation.

this guy gets it

i actually really like this. nice job

i wanna vibecode a replacement for git and call it jit

ah yes, the consequences of reward hacking

yes.

yea it was definitely a last straw kinda deal. I got tired of the sycophantic bullshit in the frontier models.