Data Engineer | Cloud Security Researcher
Joined May 2009
- Tweets 1,071
- Following 761
- Followers 228
- Likes 326
248 Photos and videos
Pinned Tweet
May 12
The silent installation of MCP servers and AI tooling from a supply chain attack is a real threat. Agentic tooling is powerful on a users machine. Repos, AI Tools, NPM Packages, anything that can write to config files at the local and global levels as a trusted source should be monitored closely.
Enterprise Organisations are jumping at the chance to implement AI tools but are their secrity teams aware of the hidden dangers? The recent supply chain attack I think highlights the initial dangers of this attack surface but there are still others not seen and being actively reserached.
1
234
Hacking Google with A.I. for $500,000
brutecat.com/r/hacking-googl…
59
500
2,456
322,870
Merrick Hare retweeted
If you haven't watched ep. 162 yet, we talked with @senorarroz from @Hacker0x01 and here are the most important questions and answers:
1. Are they training AI models on researcher reports? (8:50)
No. The part of their ToS that mentions AI training was written a long time ago, back when "AI" just meant basic spam filters not the LLMs we have today.
They are not using bug bounty reports to train or improve any large language model.
They admitted they should have updated the ToS language sooner to make this clear, and they are working on it.
2. What about the new agentic pentest platform, where is its "exploit intelligence" coming from? (29:25)
Not from bug bounty reports. The platform was trained using public benchmarks, internal test apps they built themselves, public CVEs, and pentest sessions where both the pentester and the client agreed to share the data.
The only indirect overlap with bug bounty is that some CVEs originally came from BB submissions, but that's it.
3. Do researchers actually own their reports? (18:45)
Yes. According to Section 8 of H1's community terms, you keep the intellectual property.
You give H1 a limited license to run the platform, and the customer a slightly broader license to fix their own vulnerabilities.
The real risk of your techniques leaking is on the customer side, through CVE advisories, internal security teams, or threat intel sharing. That's where things tend to get out.
4. Why did they cut bounties? (41:59)
They changed how they benchmark their own program. Before, they were comparing themselves to Google, Meta, and Amazon. Now they're comparing to "high-growth tech companies" and targeting the 80th percentile instead of the top 1%.
The biggest cuts were on lows and mediums, but highs dropped from $12,500 to $7,000 and crits from $25,000 to $15,000.
They said they're watching engagement closely and will adjust if needed.
Justin pushed back hard on this, cutting high and crit payouts sends a bad signal to the whole industry, not just H1's own program. They said they're going to take a second look at it.
5. If you think your techniques were leaked or fed into an AI, how do you report it? (21:28)
Use the mediation button on the specific report. For something more serious, email their legal or privacy team directly.
They also said they're setting up a dedicated tip line for exactly this kind of concern, it's not live yet but it's on their list.
---
One last thing.
Everything you just read came from a live, unscripted interview. No questions were shared in advance, nothing was edited after, Alex answered on the record.
Watch the full interview: youtu.be/Pa4wWv_ONjM
1
5
38
14,700
Jun 1
Deepseek wired into claude code or claude code with opus 4.7 or 4.8 for security research?
Not a hackbot but more of a protcol research assistant anyone have thoughts on this?
#bugbounty
2
2
141
May 29
Since MSRC stories are coming out as a newer researcher ( not new to azure or cloud systems ) My experience has been the following:
I get a good case manager that dupes a report and provides the relevant information that I'm comfortable with as proof and its a great experience.
I get a bad case manager and the report gets marked completed-duplicate with 0 messages from the case manager at all. I reach out and am still waiting for someting anything from the case manager. Terrible.
I have a report that was reproduced successfully, fixed by the team and sent me the confirmation email, awarded points BEFORE bounty review (points aligned with an Imporant EOP severity) and now its Out of Scope - Moderate Severity Rating and points removed. Cross Tenant credential expsoure and replay is Moderate but it had a fix right away? Still waiting on a response that makes sense for this one. If you already knew about it then this should be a missed fix or variant or a duplicate right away. If its moderate then as with all of my other moderate reports why did it require a fix immediately? I feel scammed on this one.
I have another report Sandbox Escape to SYSTEM, your program awards 20 percent but for some reason it was marked as "by design". How can you offer a bonus for it if its "by design"?
@msftsecresponse
1
135
May 30
an update on this my report that was a duplicate was finally responded to with a one liner that it was a duplicate from another researcher.
A few hours later I get a message saying that it was assesed and didnt pose an actionable threat. ADF forwards MI token to attacker set url and can be replayed against the victim tenant. But this is by design and no threat. Crazy.
So is it a duplicate or by design and not an actionable threat?
57
Merrick Hare retweeted
May 26
🚨 NPM Malware-slop Alert!🚨
We detected and reported a malware-slop package to npm - the malware uses it's OWN PRIVATE GitHub token, which is EMBEDDED INSIDE the malware itself - to read sensitive information and upload it to the threat actor's GitHub repository.
The malware is still live on npm - npmjs.com/package/mouse5212-…
The threat actor's GitHub page was opened 5h ago -
github.com/unplowed3584
Detailed report will be published tomorrow.
13
31
203
34,007
This is exactly why @SocketSecurity built Socket Firewall back in 2023. It's 100% free, and it will block malware from making it onto your device.
To get protection for VSCode extensions and more, you need to run Socket Firewall as a proxy. Get in touch with our sales team, who can help!
socket.dev/blog/introducing-…
1/ We are sharing additional details regarding our investigation into unauthorized access to GitHub's internal repositories.
Yesterday we detected and contained a compromise of an employee device involving a poisoned VS Code extension. We removed the malicious extension version, isolated the endpoint, and began incident response immediately.
7
22
239
110,624
May 22
With AI tools and agentic coding available to folks that would never have otherwise used npm, pip or any of these other easy to install cli tools the conversation of where the security boundaries are must evolve.
Open doors and unlocked windows are being pushed by these tools "let us run the show with your permissions" and it's created an ecosystem ripe for abuse.
The average person who now uses AI doesn't think about security the same way Developers and Engineers do.
Pushing the security back onto people like this is giving them their own rope basically.
Alerts and warnings and all of that are great but convenience will usually win no matter how many times you tell someone don't trust this feature, repo, installable package, whatever.
When your vibe coding and the AI tells you to npm or pip install this package and the tools don't prevent their MCP configs from being altered without warning in some cases who is responsible for what? Is it really back on the user who is relying on their tools and AI to give them the best advice?
May 22
Last week npm decided to shift trust instead of embedding malware analysis in their ecosystem.
This should raise a red flag for anyone who's following the latest supply chain attack news.
Developer accounts are being broken into, either phished, compromised by malware or via data leaks, then the threat actors use these accounts to deliver malware to anyone who's using the victim's code packages.
If we're going to treat every account hijacking technique separately and try to add more authentication factors, more key rotations, we're not protecting developers, we're just making their process slower, and - we're not solving the actual problem.
Malicious code.
If a threat actor is able to uploaded malicious code to npm, PyPi, GitHub, GitLab, Maven, (and the list goes on) without being blocked *before* the code could infect others - the malware problem is not solved, just shifts responsibility.
Scanning malicious code, analyzing code behaviour and intent is key for protecting users. When npm says that they revoke one type of authentication, they just open the door to threat actors to use other methods to continue upload malicious code. What if someone is just giving a threat actor full access to his account willingly? or selling access to the highest bidder? Threat Actors could just pretend to be regular developers, gaining downloads and trust before turning their code into an info stealing malware.
Malicious code should be treated like harmful content - it should be detected and blocked before anyone is exposed to it. Social media and content platforms are doing this for years, scanning, detecting and removing bad content before we even see it. If code was treated the way, threat actors would have a much harder time pulling off successful supply chain attacks endangering millions of users around the world.
3
74
If you're seeing this you should join us on Reddit.
reddit.com/r/Bugcrowd
5
3
31
3,067
May 12
The team over at @msftsecresponse has been busy. While not always the response that i'm looking for always greatful for the review that happens and the information providing clarity on trust boundries within the products.
94
Merrick Hare retweeted
May 5
1/7 OS Command Injection 💻
Ever wondered what happens when a website passes your input directly to a terminal?
This guide walks you through how to detect and exploit OS command injection vulnerabilities!
yeswehack.com/learn-bug-boun…
1
1
11
1,117
May 1
Never thought I would find anything but having a moderate severity bug confirmed and a potential fix in June is rewarding. No bounty for this one but still grateful to be validated by @msftsecresponse
2
4
1,023
Mar 28
Stripe tells you something important.
It just doesn’t tell you everything important.
2
64
Mar 27
The dangerous founder blind spot is not ‘I forgot to track one expense.’
It’s ‘I still don’t know which product deserves another month.’
1
2
55
Mar 26
A product does not need to be losing money to be a bad use of your time.
Sometimes it is just barely alive and hiding behind top-line revenue.
40
Mar 25
Revenue is easy to romanticize.
Costs are where the story gets honest.
1
34
Mar 25
Everyone is talking about MRR and how much they made this week/month. Show us the costs as well. I use indiespend.com to keep track of expenses and stripe revenue and costs as well per SaaS or project
34
Mar 24
I think a lot of founders make pricing decisions with half the picture.
They know demand.
They know MRR.
They do not know true operating cost by product.
25