V12

@v12sec

dangerously powerful agentic security

Pinned
V12
@v12sec
Jul 30
Article
How to raise a $10M Seed Round
Earlier this month, we won a $2.5M bug bounty–the largest bounty ever received by an AI agent. This was a bug in a major blockchain, and it put >$100M of funds at risk. We found the bug fully...
85
V12
@v12sec
6h
Default configuration of WKWebView can cause downloaded files to instead be rendered on the host page. This allows HTML injection, and sometimes even XSS, in countless iOS and WebKit apps. PlayStation 5. Firefox. X. Instagram. TikTok. Telegram. Binance... Breakdown and POC. 🧵
1
V12
@v12sec
Sep 8
Stored XSS in Forgejo, leading to full control over a victim's account:
00:00
1
V12
@v12sec
Sep 2
XSS to full account takeover and wallet drain in Ditto. V12 found a deeplink parser bug that steals Nostr private keys with just one click. Here's how. 🧵
00:00
6
V12
@v12sec
Aug 26
Signal's Contact Discovery automatically sends your contact list information to an SGX enclave in the cloud. V12 broke into that enclave and leaked the key, allowing the server host to decrypt everything. Two separate critical bugs: arbitrary read and RCE. Here's how. 🧵
00:00
17