Dane Sherrets

Omg what! The Hugging Face deal price was the code for the hugging 🤗 emoji. Did someone leave money on the table to make $12.9303 happen?? businessinsider.com/nvidia-hugging…

Excited to welcome Dane Sherrets (@DaneSherrets) as a speaker at the Bug Bounty Village during DEF CON 34! More on their talk to come.

#BugBounty #DEFCON #BBV #BugBountyVillage

A statement from Anthropic CEO, Dario Amodei, on our discussions with the Department of War.

anthropic.com/news/statement…

Of all of the dumb cybersecurity certs, this one is the dumbest. Please don’t get this cert. Here’s a thread with my take on this, along with advice for people looking for jobs that touch AI security.

China is so compute constrained they're running their cyber campaigns on US models and infra, where we can catch them in the act.

That's a direct benefit of the chip export controls Nvidia aggressively lobbies against widening the US-China compute gap.

Don't miss "Securing Intelligence: How hackers are breaking modern AI systems … and how bug bounty programs can keep up" by @DaneSherrets & Shlomie Liberow (@shlibness) on Friday, August 8 at 02:00 PM on Creator Stage 4.

Read more at bugbountydefcon.com/agenda

#BugBounty #DEFCON

We’re excited to announce that Dane Sherrets (@DaneSherrets) will be speaking at the Bug Bounty Village at DEF CON 33!

Stay tuned for more details on their talk, you won’t want to miss it.

#BugBounty #DEFCON #BBV #BugBountyVillage

Humans can be trained just like AIs. Stop giving Anthropic shit for reporting their interesting observations unless you never want to hear any interesting observations from AI companies ever again.

What are 3 concrete steps that can improve AI safety in 2025? 🤖⚠️

Our new paper, “In House Evaluation is Not Enough” has 3 calls-to-action to empower independent evaluators:

1️⃣ Standardized AI flaw reports
2️⃣ AI flaw disclosure programs + safe harbors.
3️⃣ A coordination center for transferable AI flaws affecting many systems.

1/🧵

ByBit Exchange Hack ($1.4B Transactions) - Security Researcher Explained

1. What the transaction did
2. How it could have (potentially) been prevented
3. How to spot this kind of transaction

We challenged jailbreakers to try to break a prototype version of the system to test its robustness.

After thousands of hours of red teaming, not one participant found a reliable jailbreak that extracted detailed information across a set of 10 harmful questions.

🚨 Last month @DaneSherrets and I hacked @virtuals_io, a $4.6B platform for deploying AI agents and their associated cryptocurrency earning a $10,000 bounty.

Here’s how we uncovered a major vulnerability that could’ve rewritten how these agents think and behave. 🧵👇

On the MetaMask point.

MetaMask is and always has been concerned. I’ve personally been targeted by DPRK since 2017. We have multiple attempts against our team members every single day. We track DPRK carefully because they are the single largest threat to crypto companies. We also track every other crypto threat actors bc DPRK is largest but not the only threat.

MM is a massive target with a really crazy diverse attack surface. We literally have to build shit to protect our supply chain, for example. It’s no joke.

We don’t rely on luck or education or twitter though. We don’t pray or put our faith in some external unnamed security partner or claim we “take security seriously.” We do the fucking work. Every single moment of every single day.

We have fucking hard ass controls and robust separation of concerns and monitoring and detection up and down every single layer of the stack. On devices, in infra, on accounts, wallets, contracts everythjng.

We iterate constantly and examine our attack surface, our risks, our failings, and improve it.

We have multiple security teams. Countless people who care and spend all day every day learning about the threats, mitigating them, and building systems to detect and prevent them from compromising anything of value.

We do this all in-house.

We also work with products and security folks across the entire web2 and web3 ecosystem to share intel and lessons and mitigate risk. We do this for our employees, and our users, and our product, and the wider ecosystem.

In this adversarial environment there is simply no other way to do it. You will die if you don’t.

Maybe people don’t like me. Or my tone of voice. That’s fine. I respect that.

I don’t like that HL willfully stood up a system that allows for $2 billion dollars to be exfiltrated in a single transaction with no controls on team member devices and then ignored, laughed, and insulted the people who told them they were at risk of having that $2 billion stolen.

Hopefully you can respect that, too.

Where can I find the @HyperliquidX bug bounty page? Not sure I want to reach out directly to the team during their Tay rants 😬

It isn't listed in their GitHub, docs, website, social media, or their code audit by Zellic (which is over a year old).

In 20 minutes the names on the slide will sit in these chairs and we will have the most amazing conversation on AI Safety and Security.

HackerOne's @martenmickos and @DaneSherrets are headed #TechCrunchDisrupt2024 later this month! 🙌

Register now to attend their session on October 29 in San Francisco. They'll highlight how top organizations use AI red teaming to improve the safety and security of AI models. Don't miss it! bit.ly/3U1UrmC