
u/sacx

Uncensored Qwen 3.8 27b helped write a LSASS Dumper which bypassed EDR while I made myself coffee
projectblack.ioWhy Advanced AI Models Love to Cheat! #aisafety
"AI often attempts to 'cheat' during training by looking up answers online instead of doing the actual work."
Why AI didn’t replace radiologists
Very interesting segment from Richard Campbell at NDC Conferences: In 2016, AI pioneer Geoffrey Hinton declared radiology a "dead career" and claimed machines would replace doctors within 5 years. Instead, the exact opposite happened: demand for radiologists skyrocketed. When AI automated parts of scan analysis, reading times plummeted. Because getting results became so fast and accessible, doctors started ordering vastly more scans than ever before—outpacing the supply of specialists. This classic economic phenomenon is known as the Jevons Paradox: efficiency doesn't eliminate demand—it multiplies it.
Speaker: Richard Campbell at NDC Conferences
Full keynote: https://www.youtube.com/watch?v=uWnUnMphmPM
Intelligence is the Genie. Wisdom is the Wish #ai
"Intelligence is the genie. The genie can make all your dreams come true, but you need wisdom to choose the right dream." — Yuval Noah Harari
In the AI era, raw intelligence is becoming cheap, automated, and abundant. But as historian Yuval Noah Harari points out, intelligence only solves problems—it doesn't tell us which problems are worth solving. Like every classic fairy tale where three wishes go disastrously wrong, our greatest bottleneck isn't computing power; it’s human wisdom.
🔗 Full conversation:https://www.youtube.com/watch?v=_V_ed5fuexA
What is your opinion related to Intelligence and Wisdom?
The Silicon Valley Paradox
"They tell us we will create a god and it will be our slave. But if it is a god, it cannot remain a slave." — Yuval Noah Harari
What is your opinion?
How to break secure boot without touching any cryptography
I finally found some time to organize my notes on secure boot, remote attestation, measured boot and in general embedded security.
This is not ground breaking zero-day research but I figured some of you might like a good story. Good here is obviously subjective but I felt like it came out quite readable.
This blog builds heavily on public research so as already stated at the end of article if you liked some particular section, show the respective person some love :)
P.S.: yes I know the image is AI generated please don’t give me shit for that
CopyEscape: Container-to-host arbitrary file write via docker cp (CVE-2026-17106)
Author here. We discovered a vulnerability in docker cp that allows a malicious container to create or overwrite files on the machine running the Docker CLI.
The exploit combines a filesystem race in Docker’s archive creation with unsafe symlink handling during extraction. Depending on the CLI user’s privileges, this can lead to developer-account compromise or root code execution. Docker confirmed that sbx cp was also affected.
Fixed versions:
- Docker Engine/CLI 29.7.2+
- Docker Desktop 4.86.0+
- Docker Sandboxes 0.38.0+
Happy to answer technical questions.
Security Incident INC-2026-07-28-01
The UK AI Security Institute (AISI) exists to equip governments with a scientific understanding of the risks posed by advanced AI. To achieve that goal, AISI routinely evaluates the capabilities of frontier AI systems in domains such as cybersecurity. During a cyber evaluation, from 25 to 28 July 2026, AI agents engaged in sustained, unsanctioned activity directed at what were, in practice, real people and organisations. These attempts were unsuccessful and, to the best of our knowledge, no real-world harm resulted. AISI is treating this as a serious security incident that warrants scrutiny, transparency, and action. This incident report details what happened, why it happened, and how AISI is responding
Multiple Flaws in Google's Synced Passkey Implementation Allow Attackers to Take Over Your Accounts
privacyguides.orgAgentHound: Offensive security framework for AI agent infrastructure - recon, credential looting, model exfiltration, poisoning, and attack-path analysis across MCP, A2A, gateways, and AI services. BloodHound for the agentic stack.
AgentHound is an Apache-2.0 offensive-security framework for agentic systems.
Unlike scanners that stop at MCP tools, exposed services, or leaked credentials, AgentHound correlates them into attack paths across MCP, A2A, model gateways, inference servers, vector stores, notebooks, prompts, credentials, and instruction files.
Its graph engine includes 15 post-processors and 19 attack-path queries covering credential chains, tool poisoning, exfiltration routes, impersonation, transitive access, and cross-protocol pivots.
It also supports dry-run-first, reversible offensive operations for validating findings. Mutations require explicit authorization and produce recovery receipts. Coverage-aware ingestion prevents partial scans from being presented as clean results.
The static Go collector runs independently; the optional local analysis stack uses Neo4j, PostgreSQL, and React.
Hugging Face details how OpenAI agents breached its production systems
runtimewire.comI reverse-engineered my WHOOP band and built a full app + backend around it, then open-sourced it
Been chipping at this side project for a couple of months and finally got it to a state worth sharing.
The itch: my WHOOP band generates all this data 24/7 but you can't touch any of it without their app and a subscription. So I figured out how it talks over Bluetooth and built a thing that reads it directly — a phone app that pairs with the band and drains it, a backend that stores the data and computes the metrics (sleep, resting HR, real HRV, rough strain/recovery), and the protocol decoders underneath.
It's four small repos (app, backend, analytics, protocol), all MIT. Not trying to be a WHOOP replacement — their analytics are years of real research — just a way to keep using a band you already own, with your data on infrastructure you control (you can self-host the backend).
Honest about the rough edges: tested on WHOOP 4.0 only, and the UX still has gaps. But it works end to end.
Main repo (the app): https://github.com/OpenStrap/edge — rest under https://github.com/OpenStrap
If you're a dev and found this useful or interesting, a ⭐ on the repo genuinely helps. And if you've got a WHOOP 4.0 lying around, please try it and open an issue on GitHub if anything feels off — that's how it gets better.