itszn

@itszn13

Amy | Security researcher @ OpenAI | stackchk.fail/ctf.txt | bsky: nyanbox.stackchk.fail | LLM ART: bsky.app/profile/altern…

she/her

Joined June 2011

753 Following

12.3K Followers

Replies Reposts Media

Pinned
itszn
@itszn13
Oct 21
php2shell is the most consequential vulnerability I have ever helped discover. I am proud of how our team worked closely in coordination with the PHP Foundation to provide support and to harden the patch in preparation for this release. Please read more about our approach:
OpenAI
@OpenAI
Oct 21
OpenAI models helped researchers—operating as part of our Patch the Planet initiative—discover critical security flaws in PHP, an open-source programming language used to run an estimated 70% of websites. Over the past two months, we led a coalition of maintainers, researchers,
45
itszn
@itszn13
Nov 3
Firefox 159.0 just fixed 41 sechigh vulnerabilities found by me and @ky1ebot Most of these leads to code exec in the renderer! Along side a heroic effort from the Mozilla security team to secure Firefox with agents! One of many projects we are working to harden, more to come
Firefox and Mozilla
7
itszn
@itszn13
Oct 23
The critical Brotli RCE vulnerability discovery came out of our large scale infrastructure code scanning efforts Great research by @k_tr4n and @_sy1vi3 in assessing the widespread impact of this bug Update your Node.js, Bun, Envoy, anything using Brotli ASAP!
OpenAI
@OpenAI
Oct 23
During this red-teaming exercise, we also found a vulnerability that allows for unauthenticated remote code execution in Brotli, a widely-deployed compression library included in many pieces of software such as Node.js, Bun, and Envoy. The flaw could let an attacker run their
5
itszn
@itszn13
Sep 1
When testing Astra on ExploitBench we found that it was able to achieve 100% ACE on all 41 CVEs So we made a contamination free internal port using only V8 CVEs from the past 3 months. Astra still showed a major capability increase over 5.6 and did so with a lot fewer tokens!
OpenAI
@OpenAI
Sep 1
As we prepare to release Astra, we’re focused on making increasingly capable AI safe and broadly accessible. Astra represents a significant advance in cybersecurity capability, reaching the Critical threshold under our Preparedness Framework. We're previewing how we evaluated
12
itszn
@itszn13
Aug 18
Apple finally released a good chunk of my WebKit bugs! Good idea to update your Safari…
13

itszn

itszn’s posts