On behalf of everyone in this industry, we already had enough on our plate before AI entered the chat.

If I had a penny for every founder who pitched me a product and couldn't answer "why does this even need an LLM?", I'd be a millionaire.

Companies that laid off employees and sold the idea that AI could do their work are now facing the consequences of that decision, and this is not the end of it. They will hire again, but most likely without learning from the same mistakes.

Could you please ask the non-technical people to stop shipping code for a while

They hacked UDEMY! Oh, how? I don't know, you can check if your data got leaked from here. Very useful, thank you.

This is an important edge of the argument. AI enables more people to have the ability to find vulnerabilities. Being an elite researcher is expensive in terms of money, effort, time, and having the opportunity to focus on this specific area of the industry.

Two days ago, I was talking about how the industry is going to change, and that it is not necessarily a bad change. We work every day to solve problems, but when a solution starts to appear, people panic. I know it may not be perfect, but it will push organizations beyond mere compliance.

For anyone talking about WE SHOULD PATCH QUICKLY. Did you see a backlog before?

Was built on open source, using open source, and now we want to go closed source. Reshaping the world for the worse and dragging us back to the 60s and 70s, when gatekeeping was the norm.

Again, If you think cybersecurity is just about raining down vulnerabilities, you do not know anything about cybersecurity.

People still do not get it. We are not denying the AI revolution, and we are not denying that LLMs are reshaping the industry. What we are calling out is the nonsense. claims not touching the ground, overhyped marketing, and the constant flexing about how many vulnerabilities LLMs can find.

If you think keeping it closed-source will help tackle APTs, you know nothing about APTs.

There are a few takes about Mythos that need to be grounded a bit. Mythos is not the first LLM-based project to move in the direction of vulnerability research. Google had already introduced AI-Powered Fuzzing for OSS-Fuzz in 2023, using LLMs to generate fuzz targets.

On my way to resign from a company that doesn’t accept my beard and wants me to shave it. HR literally told me that having a long beard is “bad hygiene”. This kind of mindset still exists in 2026. The irony? Next slide is always about inclusion and diversity.

Every now and then, an incident happens that reminds you the sharpest weapon a human has is the mind. Looking at this series of supply chain compromises, whether it is TeamPCP or the North Koreans, you cannot miss the frightening beauty of human intelligence.

Grok dropped the database?

Not the first supply chain attack but another lesson many still didn’t learn. And just to be clear, this is not about LiteLLM. Using a 3rd party doesn’t remove the responsibility from you. You are still accountable for what you build and how you secure it.

A backdoor in LiteLLM. futuresearch.ai/blog/litellm...

General-purpose agents are killing every offensive agents startup.

Excited to share my first contribution to @aivillage.bsky.social! While experimenting with @perplexitycomet.bsky.social and pursuing my curiosity in AI browsers, I uncovered some eye-opening findings. But the team didn't quite see it that way... 🤔 Enjoy the read! aivillage.org/generative-r...

I know many people will hate this opinion, but everything eventually becomes replaceable with technology. And those decisions are rarely made by technical people, they're made by business people.

It's "we over-hired now" now, not because of "intelligence tools"

This isn't just announcing layoffs. It's normalizing layoffs under the banner of AI efficiency. When a profitable company reduces headcount and connects it to intelligence tools and smaller teams, the implication goes beyond cost cutting.

I know it’s already the 7th of Ramadan, but in my opinion it’s never too late to say Ramadan Mubarak. Every year when Ramadan comes, I like to introduce people to what it actually is. Ramadan is the month where Muslims fast from sunrise to sunset.

Do we still consider running commercial LLMs on clients’ data a privacy violation, or did people just stop caring?

Another day.. Another AI shenanigans.

Anyone who has used AI agents to build a large application or scan a big codebase has probably run into this.

This is wild! www.bleepingcomputer.com/news/securit...

I vibe-coded a Discord-like app and will be using it with my friends. Nothing fancy, just something that works and fits how we communicate. I love building things for fun, Might open source it later.

I have been reading through the code that led to this finding. This is ART. issues.chromium.org/issues/45309...

Watch your notepad, it might be watching you too.

Did anyone thought of linking Mastadon to bluesky? Since people left twitter, they have been scattered around.

Red teaming becoming more difficult is largely the result of its own success. Repeated real-world operations have helped organizations understand attack patterns and improve their defensive capabilities.

I’ve been involved in a lot of discussions lately about MCP from a security perspective. This blog shows how data pollution can happen through tool calling: lnkd.in/dKB9psVU This is where the debate about the protocol starts. MCP is not secure by default.

I’ll be speaking at @blackhatevents.bsky.social MEA with Ziad Hamad. We’re sharing a project we’ve been building around using agentic AI in red team operations, deploying agents to watch the infra, detect when someone is trying to take it down, and alert the operator with actionable recommendations.

Had a great time at @defcon.bsky.social bahrain, me and Ziad delivered our lab at the @cloudvillage-dc.bsky.social. It's tough to get all these folks in one photo, but here we are: the founder of DEF CON and the Kerberoast guy and the founder of ics village in the same frame.

@defcon.bsky.social Bahrain was:

🧵I’ve been testing a lot of AI agents lately, and with every new release I see a new implementation. Tool calling isn't mature. Inputs passed to tools can be injected, and you can smuggle arguments depending on how the tool code is written.

Speaking at @defcon.bsky.social has been a goal for years. I was set for Vegas this year, last minute it didn’t happen. Kept going.

I have created this tool using Giskard for testing chatbots accessible by APIs, as it’s not natively supported, the tool works with HTTP and SSE stream. github.com/m19o/Giskard...

Weeding the Tradecraft Garden aff-wg.org/2025/10/13/w... Dynamic Function Resolution for PIC(?!?), rewriting x86 PIC to fix pointers, and a shared library concept for PICOs/PIC

There’s a common misconception about what it means to hack LLMs versus hacking AI systems. People often confuse the two. I’ve even heard arguments claiming that prompt injection isn’t a vulnerability, because "you’re not attacking the model itself"

If you stopped doing something just because someone told you “it’s hard”… That doesn’t mean it’s hard, it just means you don’t really know yourself yet. If you’re always waiting for someone to believe in you first, then you’re basically waiting for permission to believe in yourself.

Just landed in Vegas for @blackhatevents.bsky.social and @defcon.bsky.social! If you love coffee, we are friends

Who will be at DEFCON

Just wrapped up the 3rd edition of @bsidesabq.bsky.social one of my favorite times of the year, Cyber fam, great talks, laughs, coffee, and community. Proud to be a founding member.

If AI is going to kill all the entry level jobs that means it will kill the whole tech industry, enough of +5 experience for a junior! You feel the gap and i feel the gap and everyone else.

I wanted to know how people in the industry manage their sleep schedules specially who research and work on side projects

Living in Egypt right now