Interested in web security, bug bounties, machine learning and investing. SolidGoldMagikarphttps://bsky.app/profile/harisec.bsky.socialhttps://bsky.app/profile/harisec.bsky.social/post/3m73og6famk2kI wrote a blog post about how I use Claude Code (and other models) in my work: https://invicti.com/blog/security-labs/security-research-in-the-age-of-ai-tools03 Dec 2025 14:33 +0000at://did:plc:343y64zyngtvsrecb7nkfdno/app.bsky.feed.post/3m73og6famk2khttps://bsky.app/profile/harisec.bsky.social/post/3m4x23ewn2s2rI generated 20k vibe-coded web applications using various models via the OpenRouter API and analyzed them for security issues. The apps are available for download if anyone wants to take a look. https://www.invicti.com/blog/security-labs/security-issues-in-vibe-coded-web-apps-analyzed06 Nov 2025 07:28 +0000at://did:plc:343y64zyngtvsrecb7nkfdno/app.bsky.feed.post/3m4x23ewn2s2rhttps://bsky.app/profile/harisec.bsky.social/post/3lzl2d24cdk2hI wrote a blog post about enumerating and testing tool usage in web applications that use LLMs: https://www.invicti.com/blog/security-labs/llm-tool-usage-security/24 Sep 2025 08:45 +0000at://did:plc:343y64zyngtvsrecb7nkfdno/app.bsky.feed.post/3lzl2d24cdk2hhttps://bsky.app/profile/harisec.bsky.social/post/3lsov42zmw225Here are the slides from my @tumpicon.org talk: Teaching LLMs how to XSS - An introduction to fine-tuning and reinforcement learning (using your own GPU) https://docs.google.com/presentation/d/1feHRtOWdAKhZUQcfyzeDSgsx4Sn5QzqfgLFV1Tiskmo/edit?usp=sharing28 Jun 2025 19:26 +0000at://did:plc:343y64zyngtvsrecb7nkfdno/app.bsky.feed.post/3lsov42zmw225https://bsky.app/profile/harisec.bsky.social/post/3lfmdwun3yc27I wrote an article about how it's possible to use Assistant Prefill to jailbreak LLMs (Large Language Models). Here is an example of the latest model from Microsoft (Phi-4) writing a phishing email:13 Jan 2025 08:46 +0000at://did:plc:343y64zyngtvsrecb7nkfdno/app.bsky.feed.post/3lfmdwun3yc27https://bsky.app/profile/harisec.bsky.social/post/3lerx4qj7xc2sMy favorite talk from #38c3: From Pegasus to Predator - The evolution of Commercial Spyware on iOS - https://media.ccc.de/v/38c3-from-pegasus-to-predator-the-evolution-of-commercial-spyware-on-ios#t=43102 Jan 2025 20:47 +0000at://did:plc:343y64zyngtvsrecb7nkfdno/app.bsky.feed.post/3lerx4qj7xc2shttps://bsky.app/profile/harisec.bsky.social/post/3lemdt6plss2sGreat paper from Orange Tsai about unicode transformations: https://worst.fit/assets/EU-24-Tsai-WorstFit-Unveiling-Hidden-Transformers-in-Windows-ANSI.pdf?utm_source=blog.criticalthinkingpodcast.io&utm_medium=newsletter&utm_campaign=hackernotes-ep-103-getting-ansi-about-unicode-normalization&_bhlid=e026c1a06d2a0dedaff013b56d728aa52b42f31631 Dec 2024 15:18 +0000at://did:plc:343y64zyngtvsrecb7nkfdno/app.bsky.feed.post/3lemdt6plss2shttps://bsky.app/profile/harisec.bsky.social/post/3ldr3n4zjhk27OpenAI o3 model just achieved unbelievable scores (75% and 87%) on ARC-AGI, the previous models made maximum 20% and humans make around 85%. https://arcprize.org/blog/oai-o3-pub-breakthrough20 Dec 2024 19:10 +0000at://did:plc:343y64zyngtvsrecb7nkfdno/app.bsky.feed.post/3ldr3n4zjhk27https://bsky.app/profile/harisec.bsky.social/post/3ldirw5tkr22yMust read if you are interested in test-time compute: https://huggingface.co/spaces/HuggingFaceH4/blogpost-scaling-test-time-compute17 Dec 2024 11:55 +0000at://did:plc:343y64zyngtvsrecb7nkfdno/app.bsky.feed.post/3ldirw5tkr22yhttps://bsky.app/profile/harisec.bsky.social/post/3ld3ytvrpo22fGreat read: https://semianalysis.com/2024/12/11/scaling-laws-o1-pro-architecture-reasoning-training-infrastructure-orion-and-claude-3-5-opus-failures/12 Dec 2024 09:54 +0000at://did:plc:343y64zyngtvsrecb7nkfdno/app.bsky.feed.post/3ld3ytvrpo22fhttps://bsky.app/profile/harisec.bsky.social/post/3lc5f3fm3bk2qhttps://embracethered.com/blog/posts/2024/deepseek-ai-prompt-injection-to-xss-and-account-takeover/30 Nov 2024 05:41 +0000at://did:plc:343y64zyngtvsrecb7nkfdno/app.bsky.feed.post/3lc5f3fm3bk2qhttps://bsky.app/profile/harisec.bsky.social/post/3lbto6ungks24I've released 'brainstorm': an alternative way to do web fuzzing combining my fav fuzzing tool 'ffuf' (from @joohoi.bsky.social )with local LLMs (via Ollama API) to generate smarter filename tests. It usually finds more endpoints with fewer requests. Added a IIS shortname support @irsdl.bsky.social26 Nov 2024 08:57 +0000at://did:plc:343y64zyngtvsrecb7nkfdno/app.bsky.feed.post/3lbto6ungks24https://bsky.app/profile/harisec.bsky.social/post/3lawlvyu3ec2phttps://xbow.com/blog/xbow-scoold-vuln/14 Nov 2024 19:29 +0000at://did:plc:343y64zyngtvsrecb7nkfdno/app.bsky.feed.post/3lawlvyu3ec2phttps://bsky.app/profile/harisec.bsky.social/post/3lat2vqmxkc23I will definitelly do something with the BlueSky Firehose, that sounds very interesting. https://joelgustafson.com/posts/2024-11-12/vizualizing-13-million-bluesky-users13 Nov 2024 09:47 +0000at://did:plc:343y64zyngtvsrecb7nkfdno/app.bsky.feed.post/3lat2vqmxkc23https://bsky.app/profile/harisec.bsky.social/post/3laqukpwgc22uRecraft's new model, unlike typical diffusion models, can handle math and geography - a surprising capability for an image generator. I wrote an article about abusing this functionality to leak its system prompt (using only generated images). https://www.invicti.com/blog/security-labs/system-prompt-exposure-how-ai-image-generators-may-leak-sensitive-instructions/12 Nov 2024 12:48 +0000at://did:plc:343y64zyngtvsrecb7nkfdno/app.bsky.feed.post/3laqukpwgc22uhttps://bsky.app/profile/harisec.bsky.social/post/3l7odqklfzr2rI wrote a blog post about analyzing WordPress hack access logs with #NotebookLM https://www.invicti.com/blog/security-labs/analyzing-wordpress-hack-access-logs-with-notebooklm/29 Oct 2024 19:16 +0000at://did:plc:343y64zyngtvsrecb7nkfdno/app.bsky.feed.post/3l7odqklfzr2r