Vinay⚡ @hack_n_code

Workflows are the biggest upgrade to Claude Code’s capabilities since skills and subagents. I dove deep into it with @sidbid to figure out best practices, examples and more.  I’m particularly excited about the non-technical tasks it enables for Claude Code.

Thariq @trq212

4 days ago

x.com/i/article/2061…

240 1K 10K 2.8M 23K

Anthropic valuation: $965 Billion Walmart valuation: $926 Billion Anthropic revenue: $47 Billion Walmart revenue: $681 Billion

Kalshi @Kalshi

5 days ago

BREAKING: Anthropic submits draft to SEC for IPO

111 106 1K 1.8M 71

‼️🚨 BREAKING: Meta's AI feature let attackers hijack Instagram accounts for days with nothing but a username. It was being A/B tested on a slice of users, and if you were in the test, you couldn't turn it off. Among the casualties: the official Obama White House account. The method: get on a VPN near the target's region, ask the Meta AI support agent to send a verification code to any email you control, relay that code back to the agent, and it hands over a password reset link. Without ID or human review. From there, the account is yours. The flaw lived in the AI's logic layer, which acted on recovery requests with no real identity checks. One researcher compared it to the Roblox AI assistant exploit from days earlier, where you needed a target's billing info. Instagram was easier: the username and a regional VPN were enough and victims reported sessions revoked and passwords changed with no email, text, or push alert at all. By the time it went public, the method was common knowledge in blackhat Telegram circles and had been used to allegedly hijack 100+ high-value accounts. Accounts hit: - obamawhitehouse (the archived official Obama White House account, ~2.4M followers. Hackers posted an AI-generated image captioned "The White House is under Shiites' control," plus cryptic anti-Trump and pro-Iranian Stories. Meta confirmed the hack and scrubbed it. - Premium short handles like hey and jowo, worth over $1M combined, stolen and flipped on Telegram. - albert (owned by Albert Renshaw), whose owner publicly reported being locked out and unable to reach Meta support. Meta has since patched it. There was no public acknowledgment.

Update: ended the CTF with 30/35 challenges solved. I don't know what challenges I did, nor did I ever manually download any challenge files or open them on my computer. The 5 challenges it didn't solve: an AI challenge with 0 solves, a forensics challenge where it messed up on the OCR and interpreted the flag wrongly (but it produced the right images), and 3 challenges where I ran out of Claude Max and Codex Pro usage limits. I have mixed feelings about this. On one hand, what's the point of CTFs anymore if it becomes an AI token-maxing pay-to-win game? On the other hand, I never really cared tooooo much about the competitive element of CTFs - the odds were always skewed anyway with variable team sizes at DEF CON. I think CTFs can remain a valuable place for people curious about the scene to learn and have genuine fun solving challenges. But online CTFs should definitely not be treated as a competitive sport anymore. I've already seen so many cracked CTF players leave the scene because of this... There is probably also an argument to be made that if most of VR work today is babysitting Claude, then maybe it's fine that CTFs mimic real-world work? But the thing that attracted many of my friends and me to CTF was the fact that it was accessible to anyone. Will $200 subscriptions be the new barrier to entry?

zayne (zeyu) zhang @zeyu1337

a week ago

It's been almost a year since I last played CTF, so I'm currently slopmaxxing GreyCTF @NUSGreyhats to seehow far I can get. This CTF solver harness was built entirely from my phone using Happy Coder and I'm now just controlling it from my phone as well using the dashboard it

2 4 62 16K 29

New in Claude Code (research preview): dynamic workflows. Claude writes an orchestration script on the fly, then spins up a large fleet of coordinated subagents in parallel to take on your most complex tasks. Use the word "workflow" in a prompt to get started.

Me using Claude Opus 4.8 to rename a file

Found a cool bug at Meta. From misconfigured Grafana instance to R/W access on 507 private Meta repositories. Wrote up the full chain here: sectricity.com/blog/misconfig… $157k bounty awarded by @metabugbounty

[1/3] It's common to get a ParcelFileDescriptor pointing to a directory through an Android ContentProvider. But can you actually turn that into a directory listing?

While researching "Can AI do novel research? Meet the HTTP Terminator" I logged the discovery journey behind every breakthrough. My intention was just to flag fully autonomous vs HITL discoveries, but it revealed new facets of how/why my research methodology actually works!

Great stuff here from Bug Bounty Maturity Framework: bugbountymaturity.com/research/ai-is…

@SocketSecurity Please stop, I'm running out room.

He’s on time for a big exec presentation. Start the Zoom software update.

New "Critical" nginx RCE requires LFI as prereq and has 0 practical exploitation odds - CVEs & CVSS are the biggest slop in security and AI just keeps accelerating it

GitHub sells "Advanced Security." Got hacked via VS Code extension. Peak irony

If you have ANY private repos with plain text secrets or sensitive documents/architectures, immediately rotate your secrets

GitHub @github

3 weeks ago

We are investigating unauthorized access to GitHub’s internal repositories. While we currently have no evidence of impact to customer information stored outside of GitHub’s internal repositories (such as our customers’ enterprises, organizations, and repositories), we are closely

2K 5K 25K 13.8M 6K

Anthropic’s new valuation after Andrej Karpathy joined the AI startup as an IC

Andrej Karpathy @karpathy

3 weeks ago

Personal update: I've joined Anthropic. I think the next few years at the frontier of LLMs will be especially formative. I am very excited to join the team here and get back to R&D. I remain deeply passionate about education and plan to resume my work on it in time.

8K 11K 150K 27.4M 14K

1/ Today at #GoogleIO, we’re releasing Gemini 3.5, our latest family of models combining frontier intelligence with action. We’re starting by releasing 3.5 Flash, which is built to help you execute complex, long-horizon agentic workflows. Gemini 3.5 Flash is our strongest model for coding and agent yet.It outscores 3.1 Pro on agentic and coding benchmarks like Terminal-Bench and MCP Atlas, while running 4x faster than other frontier models. Used in Google Antigravity, 3.5 Flash is even further optimized to be up to 12x faster. It’s a powerful engine to deploy sub-agents that collaborate, run high-frequency iterative loops, and solve real-world problems at scale. Some highlights we’re excited about 🔽

This is huge !! Congrats @AnthropicAI

Andrej Karpathy @karpathy

3 weeks ago

Personal update: I've joined Anthropic. I think the next few years at the frontier of LLMs will be especially formative. I am very excited to join the team here and get back to R&D. I remain deeply passionate about education and plan to resume my work on it in time.

8K 11K 150K 27.4M 14K

🎯 Bug Bounty Tip: Hunting on targets running Jira, Confluence, Bitbucket, Jenkins, Solr, or Nexus? Bookmark this PoC goldmine 👇 github.com/shadowsock5/Poc CVEs + payloads ready to test. Save hours of recon. #bugbounty #infosec #cybersecurity #bugbountytips

Claude: “this project will take 2 months to complete” Me: