🇫🇷 | "social" engineer & poker degen | @depthfirstlabs | https://teapawt.org/t.co/jhCoyDDLpx
San Francisco, California
Joined July 2017
- Tweets2.4K
- Following1.7K
- Followers529
- Likes1.6K
STJ retweeted
Every company should own their secure cloud dev environment where agents can change code, run the full application, and verify their work. At @depthfirstlabs we care tremendously about this and today we share how we built our environment.
Each developer gets a persistent devbox, and each task gets its own application stack, database, and workflow state, so agents work in parallel. Engineers have flexibility to switch between Codex, Claude Code, and other agents without losing context.
The environment runs inside our private AWS network, with access controlled through @Tailscale and package requests checked by depthfirst’s Dependency Firewall in configured build and registry paths.
When an agent finishes an iteration, it can share reproduction steps, video evidence, and a private preview URL. We can open the exact environment it tested and review the behavior ourselves.
We had it operational within a week.
currently replicating a mock aws entirely using ai to do local e2e testing
its going well, no divergence from spec observed
fuck
this shit is supposed to be hard for me to stay employed. we r cooked
work pays for dinner and i got a sushi addiction so now my doordash homepage just looks like this all the time
we're hiring btw so if you want daily sushi dinners: depthfirst.com/company#caree…
STJ retweeted
We are showcasing our work with @nvidia to post-train Nemotron 3.5 Lightning for defensive cybersecurity at GTC.
As AI makes cyberattacks faster, cheaper, and more common, we need to equip defenders with advanced cyber intelligence that is affordable enough to be always on.
That's what we're building at depthfirst: powerful, specialized security models that defenders can run on their own infrastructure, with full control over their models and data, at a fraction of today's cost.
We're proud to work with NVIDIA to strengthen the U.S. AI cybersecurity ecosystem and help put sovereign security intelligence in the hands of defenders.
what reassures me is that if a threat actor decides to run a nation-state wide cyberattack we can always just send 2x F35’s and bomb the shit out of that datacenter
what if a big lab decides that for legislation and $$ to align with their incentives, they create themselves the biggest cyber attack and then blame china.
pic unrelated
any company who doesn’t have a security engineer who’s actually in the know and not an anthropic meat proxy is actually cooked and ngmi
STJ retweeted
We published a breakdown of how the PHP vulnerabilities work, how to identify potentially affected installations, and what organizations can do to protect themselves.
If you're unsure whether your company is exposed, reach out. depthfirst is offering free repository and container image scans to help identify potentially vulnerable PHP installations. If you're running an unsupported version and can't upgrade immediately, our team can also help assess temporary mitigations to reduce exposure.
Links to the blog and free assessment in the comments.
the models are getting exponentially cheaper 🫣
We tested Gemini 4 Argon on @depthfirstlabs dfbench, our benchmark for finding real vulnerabilities in code.
On application and smart-contract tasks, where it rarely refused, it found 74% of known vulnerabilities, the highest recall we have measured. Across all 165 tasks it scored 67.5%, second only to Mythos 5 (69%{.
observation: there is a concerningly growing amount of security companies completely forgetting first principles.
what do you mean you integrated an offline cold wallet inside a phone Ledger.
why are we jumping in the fire and then blaming the sky for it not raining
STJ retweeted
Agentic pen testing alone is nice, but it's supercharged when combined with a broader appsec platform to 1) validate whether vulnerabilities found elsewhere are exploitable and 2) verify patches did, in fact, patch.
depthfirst executing early on building a compound startup! Well done @hohnjeyer
Today, we’re excited to introduce Agentic Pentesting on the depthfirst platform.
Agentic Pentesting involves autonomous agents that attack your running application like a team of elite security researchers.
Security teams can:
- Find complex vulnerabilities in systems and running applications, with or without source code access
- Confirm whether findings from code scans and other sources can be exploited at runtime
- Run ad hoc agentic pentests or integrate them into CI/CD for new feature releases
- Create tickets in Jira or Linear, or use depthfirst to autonomously remediate vulnerabilities
- Replay an attack after remediation to verify that the vulnerability has been fixed
We built Agentic Pentesting in close collaboration with our customers. We’re grateful to every security and engineering team that helped shape the product and to the depthfirst team that brought it to life.
Learn more from the links in the comments.
STJ retweeted
Today, we’re excited to introduce Agentic Pentesting on the depthfirst platform.
Agentic Pentesting involves autonomous agents that attack your running application like a team of elite security researchers.
Security teams can:
- Find complex vulnerabilities in systems and running applications, with or without source code access
- Confirm whether findings from code scans and other sources can be exploited at runtime
- Run ad hoc agentic pentests or integrate them into CI/CD for new feature releases
- Create tickets in Jira or Linear, or use depthfirst to autonomously remediate vulnerabilities
- Replay an attack after remediation to verify that the vulnerability has been fixed
We built Agentic Pentesting in close collaboration with our customers. We’re grateful to every security and engineering team that helped shape the product and to the depthfirst team that brought it to life.
Learn more from the links in the comments.
