Just found this awesome Open Source repository with a list of 10 AI prompts you can integrate into your bug bounty hunting workflow
Web2 Security focused, still very valuable - scoping, triaging, validation & more. 10x for the great resource @mdp_sec 🫡
github.com/mdpsec/bug-bounty…
Open AI's proof that Borsuk's conjecture fails already in dimension 9! (And other related news.)
gilkalai.wordpress.com/2026/…
Utsav Singh retweeted
📣📣📣 Calling all Chrome bug hunters! 📣📣📣
Rules updates: We're rewarding more types of deep security research, recognizing high-value fixes across more severity tiers, and providing new opportunities for researcher recognition.
For details, see our latest blog post 👇
bughunters.google.com/blog/c…
Utsav Singh retweeted
The Rust style guide used by Google has been open sourced!
google.github.io/styleguide/…
Utsav Singh retweeted
For years, I was an open source skeptic. I didn’t think open models would ever close the gap with frontier labs and I was wrong. I’ve moved all my research to open source models. Over the next 3-4 months, I’m putting around $1M into my own mini data centre to train and specialize them. The amount of tokens I have spent on frontier labs have been astronomical for the kind of results I was looking for and it has cost me hundreds of thousands of dollars in short period of time and it’s still restricted in speed and quality which isn’t enough anymore for impactful outcomes. A model doesn't need to be great at everything. A team of specialized models, each trained deeply in its own field and working together, can beat a single generalist. I believe that approach can outperform today's frontier models like Fable and Astra by a wide margin.
With the current advancement in AI I believe the GPU prices will skyrocket even further and soon it’ll be too expensive to be even able to run open source models even for people who can afford it today.
I’m excited for what’s coming. I’m working a lot in silence like a maniac, it’s advancing well, I’m sure the results will follow very soon.
Utsav Singh retweeted
If you work on education, homeschool your kids, want to learn something new… check this out.
You can use AI to create the coolest and most engaging explainers in the world. Grab a coding agent, ask it for an explainer, deploy it, share the link.
So many ideas can be derived from this. Imagine a platform of vetted visualizations by experts in each field. Games or quizzes where you repair or reassemble the systems. A prompt input to extend them…
And follow @DilumSanjaya!
Hardware looks scary until you break it down into small steps. So I built an app that takes you through Arduino one circuit at a time.
Made with Opus 5.5
learn-arduino-red.vercel.app
As the embargo is now lifted, find all the information needed on php2shell.com/ - the critical RCE vulnerability our research team identified affecting PHP core wiz.io/blog/php2shell-php-rc…
皆様に、今夜に対応して頂きたい大至急のお願いです。
多くのウェブサイトで使用されているPHPに関し、PHPのセキュリティチームが、重大な2件の脆弱性に関する注意喚起を行っています。
公開しているウェブサイトでPHPを使用しているか確認し、今夜、10月21日午後11時(日本時間)に公開される修正パッチについて、可及的速やかに適用できるよう準備をお願いします。
修正パッチを速やかに適用することが困難な場合は、例えばウェブサイト等を一時的に停止させることも、リスクを低減させるための有効策の一つと考えられます。
国家サイバー統括室のXアカウントでも関係する情報を発信していますので、そちらも参考にして下さい。
国家サイバー統括室(注意・警戒情報)(@cyber_forecast) / X
Utsav Singh retweeted
You can now perform content discovery at 100k requests per second with h3fuzz on http/3 hosts (fork of ffuf with http/3 support).
Tool here: github.com/assetnote/h3fuzz
Research post here: slcyber.io/research/how-prac…
Utsav Singh retweeted
If you want to start writing, the greatest thing you can do is block off 1 hour every morning and stick to it. Absolutely no exposure to other opinions or distractions (social media, messages, phone). You need space for creative ideas and modern life is great at taking that from you.
Utsav Singh retweeted
I just overheard an 8 year old talking about SFT vs RL post training. Time to restart the simulation.
Utsav Singh retweeted
We at @exodus BBP fully automated triage with multi agents workflows with very high accuracy, has reduced triage time 7x and needing a human to only 0.2h/week.
Though giving agents Github access was huge bump in accuracy and Platform doesn't have such luxury for their bots.
I’d be willing to pay $100 per report for priority triage with automated dupe checking and faster payouts (<48 hours). My experience with this on Immunefi was great, and it’s not a bad way to incentivize researchers to stop abusing teams as the initial assessors of AI reports.
Utsav Singh retweeted
The best practitioner (not lab) AI evals for offensive cybersecurity I follow myself:
1) The @dreadnode dreadindex. Evals al the way down to the vuln category level, and refusals accounting
dreadnode.io/research/dreadi…
2) @AikidoSecurity white-box but i've confirmed that it extends to dynamic testing well
aikido.dev/aikido-arena
3) BArena by @mdp_sec focused on bounty-like black box bugs.
blackboxarena.ai/
4) @mindfort 's nexbench has info downto the config of a model including thinking or effort setting, and cost per finding, which many omit.
mindfort.ai/blog/introducing…
Utsav Singh retweeted
done 😊
📄 Skills in Agent Harnesses
A lot of people don't know this (I didn't until recently) but most agent harnesses will load the description of your skill upon starting up your harness. This is how Claude Code works.
What people don't usually know is that even when you explicitly call a skill to be used inside of a harness, or the AI figures out to use a skill, it usually only does a read of the first 150 lines of the skill (to understand how to use it or if it applies to the work it's trying to do).
It's really important to outline a table in the first 150 lines of the mandatory parts of the skill that must be run when you invoke the skill.
If you make some type of mandatory instruction after 150 lines, it might get missed entirely. If you describe in prompting that you want to use a provided Python script or template, it also might be out of bounds of that 150 lines and never get called correctly.
If you write a table of contents of the skill actions in the first 150 lines and mark which ones are mandatory (or that, if the user has called the skill, you must read the whole skill context and all references), you get more reliable skills. We use markdown checklists for this now.
yo, just sharing my latest personal achievement. My biggest bug bounty yet, $30,000 from MSRC.
@bsysop and I uncovered RCE vulnerabilities affecting 100% of the Major Cloud providers.
Proud of the research. Even prouder of the impact.
We may share the technical deep dive in a future blog post.
Utsav Singh retweeted
New research from our team at @SLCyberSec :
Pre-Auth Remote Code Execution in Adobe AEM!
👇🏻
slcyber.io/research/more-cri…
Utsav Singh retweeted
interpretability might be the most important scientific problem in the world right now, as I don't think we can solve alignment if we don't know what we're building. I think I have good news about it. I co-authored early work in mechanistic interpretability at OpenAI and came away pessimistic, because neural networks appeared to fold into arbitrary tangled knots. years later, I started openai's first large-scale automated interpretability project, finding about 2% of neurons legible with the primitive tools we had
with modern agentic tools and a much closer look, the picture looks totally different. the vast majority in models up to trillions of parameters are legible, and their circuits beautiful. many famous examples of tangled neurons turned out to be misunderstood. The roadblocks I expected mostly aren't there. I now think ambitious interpretability will be solved by the time we need it most, and possibly quite soon, as automated scientists keep improving. it may be a bitter lesson for interpretability: the simple thing, at absurd scale, works
already-clean.goodfire.com/
Utsav Singh retweeted
random thought: the desire to learn (compress information and generate new knowledge) is the biggest difference between living and non-living things. when the universe generate environments where learnable patterns exist and there's a reward for learning them, life begins.
In 2022, Berkeley PhD student Woosuk Kwon thought he could make Meta's new open-weight model, OPT-175B, run faster in two weeks.
Four years and 3,000 contributors later, that project is @vllm_project, one of the largest open-source inference engines, running on ~500,000 GPUs at any given time.
He and fellow researchers Simon Mo, Kaichao You, and Roger Wang borrowed "virtual memory" from operating systems, handing out memory only as it's needed so each GPU can juggle requests of wildly different sizes. (The "v" in vLLM is for virtual.)
Their first user, Berkeley neighbor @arena, cut its GPU needs in half. Today Google, Amazon, and Meta all run vLLM in production.
In January, the core maintainers founded @inferact and raised $150M to give vLLM a full-time team.
They're hiring across eng, marketing, and devrel in SF and Singapore: a16zjobs.substack.com/p/infe…
@simon_mo_ @woosuk_k @KaichaoYou @rogerw0108
Utsav Singh retweeted
Sharing some deeply personal and existential reflections on scientific identity, the changing culture of AI research, the erosion of intellectual autonomy, and the growing disconnect between scientific rigor, professional recognition, and what organizations actually reward.
As usual, feedback and debate are welcome and actively encouraged!
mariya.fyi/posts/stranger-in… – at San Francisco, CA




























