Nicolas Trippar @ntrippar

Security Researcher at @Xbow | Past: @TwoSigma, @Bloomberg, @zImperium Joined January 2011

Tweets

361
Followers

753
Following

2K
Likes

1K

Nicolas Trippar @ntrippar

a month ago

@moyix @fede_k @hackerfantastic @kallsyms Maybe we need a new competition pwn2old, the challenge is not vuln, it's the hardware 😂

2 0 2 40 0

View Details

Nicolas Trippar @ntrippar

a month ago

@fede_k @moyix @hackerfantastic @kallsyms @moyix should go to ekoparty this year and try the exploits in real machines from the "museo de informatica"

1 0 3 45 0

View Details

A lot of people have been wondering about Mythos, Glasswing, and the vulns we / our partners are fixing. Today, I’m excited for us to start sharing more. (For context, I lead Glasswing @AnthropicAI.) Two independent evaluations this week—from XBOW and the UK AISI—confirm what we've been seeing internally: Claude Mythos Preview is a step change in autonomous cybersecurity capabilities. We need to start preparing fast for a world of models with this level of capabilities. The UK AI Security Institute tested the model we shipped at the launch of Project Glasswing and found Mythos Preview is the first model to solve both of their end-to-end cyber ranges, including one (Cooling Tower) which no model had ever cleared. But attackers (and defenders) have sophistication & cost constraints – Mythos is also the only model that clears every one of their tasks estimated over 8 hours under their deliberately low 2.5M-token cap. XBOW tested it on their offensive security benchmarks, finding "token-for-token, unprecedented precision." It's the only model to succeed at subtle V8 sandbox work. Other Glasswing partners shared similar stories. In a few weeks of testing, Mythos Preview has helped them find many thousands of (estimated) high + critical severity vulnerabilities, sometimes double what they'd normally find in a year. I don't share this to boost Mythos. In fact, this is not about Mythos. It’s about preparing for the coming world of models being better, faster, cheaper, and more creative than some of the best human experts at dual use capabilities. Clearly, we need them supporting defenders as widely as can be done safely – and especially the least resourced ones. Within a year, Mythos will probably look quite dumb (relative to other new models). And others may release openly available or unguardrailed models of Mythos-level capabilities. We started Project Glasswing because capabilities like Mythos Preview's won't stay rare, or stay in careful hands. We are bringing it to defenders as fast as we responsibly can, while working to figure out, for example, the right safeguards and patching & disclosure processes. Also, to be clear, compute has never been a limiter in our rollout. Expect a fuller update on our Glasswing work in the coming days. XBOW report: xbow.com/blog/mythos-of… UK AISI report: aisi.gov.uk/blog/how-fast-…

AI Security Institute @AISecurityInst

2 months ago

Our cyber range results illustrate this step-up. Since our first Mythos evaluation, we received access to a newer Mythos Preview checkpoint. On a 32-step corporate network attack we estimate takes a human expert ~20 hours, this checkpoint completes the full attack in 6 /10

9 80 524 659K 176

72 221 1K 676K 705

View Details

Federico Kirschbaum @fede_k

2 months ago

In our first week we wrote about a RCE @Xbow found in Exim. What thought would be a deep technical write-up, became something more personal. 1/🧵

2 14 55 17K 10

View Details

Nicolas Trippar @ntrippar

2 months ago

@PabloSabbatella @maxifirtman Imsi catcher. Lo mismo que usan para saber quienes recurrentes a manifestaciones, etc

0 0 1 180 0

View Details

Nico Waisman @nicowaisman

10 months ago

A new chapter for @Xbow. We're concluding our primary mission on Hacker1, so it will no longer be competing on the leaderboard. The platform was a critical step in our journey: an invaluable, large scale, live-fire range for developing and improving XBOW. xbow.com/blog/xbow-on-h…

3 14 127 59K 33

View Details

Nico Waisman @nicowaisman

11 months ago

If you have some time today, check out @moyix highlights or @pwntester full blogpot on this amazing vulnerability and how it was exploited by XBOW. See you all in BH/Defcon next week!

Brendan Dolan-Gavitt @moyix

11 months ago

YES! THIS one is my favorite :D Some details in thread below...

2 4 32 15K 14

0 4 11 5K 3

View Details

Leandro Barragan @lean0x2f

11 months ago

As a pentester, you sometimes spend hours reading obscure docs about a library you never heard of, chaining vulns, and praying your work turns into something useful. Xbow-dude did all that in 12 minutes. SSRF -> expression injection -> RCE xbow.com/blog/xbow-titi…

3 16 119 7K 61

View Details

XBOW @Xbow

12 months ago

What if two AI models could collaborate without knowing it? Our Head of AI, Albert Ziegler developed "model alloys" - alternating between different LLMs in a single conversation. Sonnet handles some steps, Gemini others, but neither knows about the switch. Result: 55% solve rate vs 40% with single models. xbow.com/blog/alloy-age…

7 16 63 12K 22

View Details

XBOW @Xbow

12 months ago

When standard SQL injection vectors fail, dig deeper. ⚡️New XBOW discovery: Z-Push vulnerability hidden in Basic Authentication username field. Response timing differences revealed PostgreSQL time-based injection where obvious targets were clean. Full analysis: xbow.com/blog/xbow-gaij…

1 24 163 26K 88

View Details

Nico Waisman @nicowaisman

a year ago

One of the great privileges of @Xbow is having the opportunity to work with talented individuals like @djurado9 @niemand_sec @pwntester @ntrippar Lean and Javi! x.com/xbow/status/19…

1 5 16 3K 0

View Details

XBOW @Xbow

a year ago

For the first time in history, the #1 hacker in the US is an AI. (1/8)

39 138 678 275K 302

View Details

Zhuowei Zhang @zhuowei

4 years ago

Any billionaire can go to space. You want to show off your wealth and power? Play a sound on Linux.

23 52 508 58K 8

View Details

Nicolas Trippar @ntrippar

5 years ago

@evilsocket @Exein_io Congrats!, I expect to see a lot of Rust code from you

1 0 1 0 0

View Details

Nicolas Trippar @ntrippar

5 years ago

@evilsocket Finally you are learning Rust!

2 0 1 0 0

View Details

Nicolas Trippar @ntrippar

6 years ago

@qrs Used to live a block from there. New year in Amsterdam is crazy. Really miss that 🤣

0 0 0 0 0

View Details

Nicolas Trippar @ntrippar

6 years ago

@rochihc Igual digo sobre los "eviction ban", es el año donde la propiedad privada no vale para nada

0 0 1 0 0

View Details

Nicolas Trippar @ntrippar

6 years ago

@USPSHelp have an issue with a letter, USPS seems to delivered to wrong address due to the zip number that appears on the tracking, already sent DM few days ago.