Tim @t7d_dev

Pentester & Security Engineer - Opinions are my own! Germany Joined December 2015

Tweets

217
Followers

89
Following

336
Likes

168

Tim @t7d_dev

3 weeks ago

@chompie1337 Uhh nice! I bought the last version in university will buy this one too! 😍

0 0 0 21 0

View Details

Tim @t7d_dev

3 weeks ago

@lks_kln @marckohlbrugge StackChan is ordered :D

0 0 0 27 0

View Details

@kunchenguid But why should they stop listening? They will be trained to take a problem as an input and in the best case give a perfect solution to as output. Why should they stop if addressed by Opus 4.8? The only problem I see is when the models are no longer available or not open.

1 0 1 348 0

View Details

Tim @t7d_dev

2 months ago

@VittoStack Also interested to join

0 0 0 13 0

View Details

Tim @t7d_dev

2 months ago

@kunchenguid AWS Bedrock Claude seems to be still up and fine.

0 0 1 105 0

View Details

Tim @t7d_dev

a year ago

@simonw We could also note the weights down and compute them by hand if power is off. And develop a cult out of it, where all the calculations are done from generation to generation to get the next token to form the secret ancient wisdom. And the answer to the meaning of life will be...

0 0 1 175 0

View Details

Tim @t7d_dev

a year ago

@_kun_19 @Hacker0x01 Now on my reading list. :)

0 0 1 52 0

View Details

Tim @t7d_dev

a year ago

@dcapitella @lbeurerkellner @simonw @edoardo_debe Awesome repo nice work!

0 0 0 20 0

View Details

Tim @t7d_dev

a year ago

@steipete @philippberner @mitsuhiko I will do exactly that! Thanks ❤️

0 0 1 344 0

View Details

Tim @t7d_dev

a year ago

AI Testing Tip: I encountered a potential remote code execution vulnerability in an AI application that turned out to be a hallucination from the model. Although all of my exploits were tested locally and worked, the result did not. Better use a shasum with random input to verify

0 0 1 31 0

View Details

Tim @t7d_dev

a year ago

A quick personal reminder to all (AI) startups: At the very least, implement a security.txt file in your web root to enable security researchers to quickly disclose vulnerabilities to you. There are so many bugs out there! securitytxt.org

0 0 1 37 0

View Details

Edoardo Debenedetti @edoardo_debe

a year ago

We recently updated the CaMeL paper, with results on new models (which improve utility a lot with zero changes!). Most importantly, we released code with it. Go have a look if you're curious to find out more details! Paper: arxiv.org/abs/2503.18813 Code: github.com/google-researc…

1 19 123 27K 75

View Details

Tim @t7d_dev

a year ago

Remember this weekend (27.06.-29.06.) is Google CTF time. It is always fun to participate! It will be interesting to see how much LLM use will happen to auto solve the challenges. Anyone playing? capturetheflag.withgoogle.com #security #ctf

0 0 0 72 0

View Details

Tim @t7d_dev

a year ago

@terjanq I'm interested to see how much LLM use is going to happen.

0 0 0 666 0

View Details

XBOW @Xbow

a year ago

XBOW automatically runs expert-level attacks across all webapps, giving security teams unprecedented scale. @XBOW reported 1092 vulnerabilities on HackerOne in just a few months, including RCE, XXE, SQLi, SSRF, exposed secrets, and XSS.

6 14 107 110K 24

View Details

Tim @t7d_dev

a year ago

@wunderwuzzi23 What was your prompt? Did you include enough context for the CVSS rating? I guess the result improves with more context and examples.

0 0 0 12 0

View Details

Tim @t7d_dev

a year ago

@simonw do you know if there are terms or research for "context rot" with system prompts? It feels like to me, the longer the conversation get, the importance of the llm guardrails reduces. Maybe because they make up less and less of the text feeded into the llm.

1 0 0 26 0

View Details

Simon Willison @simonw

a year ago

If you use "AI agents" (LLMs that call tools) you need to be aware of the Lethal Trifecta Any time you combine access to private data with exposure to untrusted content and the ability to externally communicate an attacker can trick the system into stealing your data!