🧵𝗙𝗿𝗼𝗺 𝗚𝗶𝘁𝗛𝘂𝗯 𝘁𝗼 𝗚𝗿𝗼𝗸: 𝘅𝗔𝗜 𝗹𝗲𝗮𝗸𝗲𝗱 𝗮 𝘀𝗲𝗰𝗿𝗲𝘁 𝘁𝗵𝗮𝘁 𝗲𝘅𝗽𝗼𝘀𝗲𝗱 𝗮 𝗡𝗲𝘅𝘁𝗚𝗲𝗻 𝗮𝘁𝘁𝗮𝗰𝗸 𝘃𝗲𝗰𝘁𝗼𝗿. So a XAi dev leaked a ApiKey on GitHub. At first, it seemed like just another API key leak. But the deeper you look, the more alarming it becomes. 👇 #AIsecurity #LLMs #xAI #Tesla #SpaceX #Grok #Infosec #APISecurity

🚨 A Remote Access Trojan was hiding in a popular npm package— rand-user-agent — using whitespace and crazy obfuscation to stay out of sight. Supply chain attacks are getting sneaky. Check your deps. Full video in comments 🧪 #infosec #npm #malware #devsecops

Now available from the @aikidosecurity.bsky.social swag store. The Maction (see what I did there) figure. Dogs aren't allowed in the Aikido office, which is good because I just have a very large cat that sometimes comes in.

So apparently everyone is getting on the studio #Gihbli trend. Did I do it right? 😅 #studioGihbli

1 𝐰𝐞𝐞𝐤(ish) 𝐮𝐧𝐭𝐢𝐥 𝐈'𝐦 𝐛𝐚𝐜𝐤 𝐨𝐧 𝐭𝐡𝐞 𝐫𝐨𝐚𝐝 𝐚𝐠𝐚𝐢𝐧! Pumped to be back on stage speaking again at some world class events after taking a little break. We have put together some seriously cool research and exploits I can't wait unleash (𝘢𝘯𝘥, 𝘰𝘧 𝘤𝘰𝘶𝘳𝘴𝘦, 𝘴𝘰𝘮𝘦 𝘵𝘳𝘶𝘭𝘺 𝘩𝘰𝘳𝘳𝘪𝘣𝘭𝘦 𝘫𝘰𝘬𝘦𝘴).

Oh man, the feed on here gives me hope in the world again

At @AikidoSecurity we have been using LLMs to find vulnerabilities in open-source packages that were never disclosed. This year we found 511 vulnerabilities (patched but never reported), 67% of them were never disclosed.