I'm off to Tokyo in the morning to teach SEC660: Advanced Penetration Testing and Exploit Writing. This course has existed for 15 years and it's amazing how different it is now to teach it in the AI era. It's fun to teach the low-level details first and then using AI to amplify.

This was a great talk. Definitely with the watch.

Finding and Exploiting Spacecraft Vulnerabilities xitter.cf/i/broadcasts/1kKzDPeDN…

Just a reminder for the next @offby1security stream on "Finding and Exploiting Spacecraft Vulnerabilities" with @0x4ndy and Milenko Starcik tomorrow at 11AM PT!

Join me this Friday at 11AM PT for the next @offby1security stream with @0x4ndy and Milenko Starcik for a stream on Finding and Exploiting Spacecraft Vulnerabilities! youtube.com/watch?v=j4kx0u_B…

Watching Offensive AI Agents Work xitter.cf/i/broadcasts/1XGygwYaE…

Join us today at 12:30pm!

Looking forward to this event! If you’re going to be there come find me to say hi.

Join me on Friday, September 25th at 12:30PM for the next @offby1security stream with guest Tarun Koyalwar @KoyalwarTarun on "Watching Offensive AI Agents Work!" Thanks for helping us reach 50K subscribers! youtube.com/watch?v=WWQRirWA…

Breaking Windows: Exploring Security Through Kernel Drivers xitter.cf/i/broadcasts/1oKMvNMny…

Stream Reminder: @zodiacon (Pavel Yosifovich) will be joining me on the @offby1security stream tomorrow 18-September at 11AM PT for a stream on Breaking Windows: Exploring Security Through Kernel Drivers! youtube.com/watch?v=3tP1HVwA…

Lesson learned... I forgot I switched to my "family" WiFi network when running an offensive campaign against intended test targets. The first bad indication was when my printer started printing, and then I found my Samsung Family Hub Fridge with a bricked screen and it's EoL.

Question: For pen testers and red teamers working internally at an organization, or working as a consultant, is your offensive AI solution:

Almost at 50K! I think that's great for a channel that focuses primarily on advanced content! Thanks to everyone who has subscribed and to all of the guests who have joined me for a stream!

I’ve been doing a lot of thinking about this over the past week. It’s getting very easy to become complacent and let AI do everything for us, especially when we’re all being pushed to 10x our output. It can be hard to justify spending hours getting into the low-level details when a model can often get you most of the way there in seconds. A lot of respected practitioners have already raised concerns about skill deterioration, and I think they’re right to worry about it. At the same time, AI is going to make software meaningfully more secure. As more companies integrate strong AI code scanning directly into CI/CD, a lot of low-hanging fruit is going to disappear. Even harder memory corruption bugs, unsafe API use, obvious authorization problems, and common implementation mistakes are going to get caught earlier and more consistently. That’s of course a very good thing. But I don’t think vulnerability research or hacking suddenly ends. The offense adapts, and the bar rises. That's always been the "fun" part for those of us in the offensive space. I’ve spent a lot of time lately benchmarking what AI code scanning and dynamic sandbox analysis are good at, and I think the harder problems increasingly move toward things like business logic flaws, strange state-machine behavior, race conditions, cross-service trust mistakes, authorization failures that only emerge across multiple components, protocol composition issues, and distributed-system behavior. I've been trying to write CTF challenges for learning that capture this. And then we’re adding entirely new attack surfaces like agents, tool use, model orchestration, persistent memory, agent-to-agent communication, and systems where one AI is implicitly trusting the output or state of another. AI will continue to help researchers explore these systems at a scale humans never could before. That probably means we’ll discover failure modes and bug classes that we haven’t even thought of yet. Which is why I think it’s more important now, not less, for people to keep putting in the work to understand how things actually work underneath. I catch myself taking the easy route with AI more often than I’d like. Fortunately, I’ve spent thousands of hours coding, debugging, reversing, exploiting, and generally fighting with systems, so I can still drop back down into the weeds when I need to. Thankfully, there are a lot of us in this pool. What worries me more is the next generation coming into the industry. How do they build that same intuition if AI removes so much of the struggle that used to force us to learn? There are fewer intern spots, fewer junior positions, etc... Because if you don’t understand what’s happening underneath, it becomes much harder to know when the AI is wrong, when a finding is overstated, how to properly validate an issue, how to turn odd behavior into a real vulnerability, or how to recognize an entirely new bug class. Vulnerability research has never really been about instant gratification. It takes time, patience, creativity, failure, and a certain amount of stubbornness. AI absolutely makes us faster. We should use it. We just shouldn’t let it make us stop thinking. My current belief is that both offense and defense are going to level up dramatically. Software will get more secure, but researchers and attackers will get more capable too. The bugs that matter will simply become harder, stranger, and more interesting. As a historically offensive practitioner that's exciting to me as it's curiosity that brought many of us into this space. I swear I reread this 10 times worried that it sounds like AI wrote it. I promise it didn't. :) My hope with this tweet is that it encourages those coming into the space, or who are new to the space, to put the work in to learn as much as you can. One thing that attracted many of us to this space is the challenges with solving complex puzzles. I encourage you to go back and read Hacking: The Art of Exploitation... .The Shellcoder's Handbook, and selfishly, the Gray Hat Hacking series! Sorry for the looooooooooooong tweet.