Trail of Bits

We help secure the world’s most targeted organizations and products. We combine security research with an attacker mentality to reduce risk and fortify code.

Website: https://trailofbits.com
Podcast: https://trailofbits.audio
GitHub: https://github.com/trailofbits
Blog: https://blog.trailofbits.com

Public Key

npub1rcsevfzqfj6xzk0rajfaftsnq4f4wewydfyxd9u46jch4sxta60qjz7sw8

NIP-05 Address

[email protected]

Profile Code

nprofile1qqspugvky3qyedrpt837ey754cfs256hvhzx5jrxj72afvt6cr97a8spzpmhxue69uhkummnw3ezuamfdejszrthwden5te0dehhxtnvdakquc2lz2

Publishing to

nostr.wine

nos.lol

relay.damus.io

Author Public Key

npub1rcsevfzqfj6xzk0rajfaftsnq4f4wewydfyxd9u46jch4sxta60qjz7sw8

Show more details

Last Notes

2026-07-31 11:03:01 UTC

Agentic AI headlines Black Hat's keynotes and DEF CON's main stage next week, and it's a topic we've been researching for years. We've hijacked multi-agent systems with one web page, pulled Gmail data from Perplexity's Comet via prompt injection, and built image-scaling attacks invisible to humans but not models. All documented on blog.trailofbits.com.
We'll be in Vegas Aug 4-6. If you're around, we'd love to chat: https://meetings.hubspot.com/trailofbits/blackhat-defcon-scheduling
#infosec #aisecurity

2026-07-02 11:15:06 UTC

We gave GPT-5.5-Cyber a single /goal: find a specific class of bugs in zlib. It built a fuzzing lab in less than a day, a task that takes a skilled researcher weeks.
Harnesses across a dozen entry points (inflateBack, uncompress2, MiniZip, puff), ASan/UBSan builds, seeds from zlib's own tests. Findings are now in coordinated disclosure.
Patch the Planet field report by Benjamin Samuels:
https://blog.trailofbits.com/2026/07/02/field-reports-from-patch-the-planet/
#fuzzing #infosec #zlib

2026-07-01 11:01:26 UTC

cargo-audit flags Rust dependencies with known vulnerabilities. A flagged crate, though, doesn't tell you whether your code calls the vulnerable function.
We added a feature that matches a binary's symbols against the functions named in each advisory. Any matches are labeled "Affected," separating real exposure from advisories that don't apply.
It's live in cargo-audit 0.22.2+. If you're behind, update with `cargo install -f cargo-audit`.
#rust #infosec #supplychain
https://crates.io/crates/cargo-audit
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/844/375/901/972/490/original/1f0613f4d15ce4c8.png

2026-06-30 14:00:42 UTC

OpenAI handed us their most cyber-capable models and asked us to work directly with open-source maintainers to Patch the Planet.
We started with 19 projects: cURL, Python, Sigstore, NATS, and more. 50 projects have now joined the initiative. Each get a dedicated team reviewing code, finding vulnerabilities, and writing patches.
More in their blog: https://openai.com/index/patch-the-planet/
#infosec #opensource #security

2026-06-30 11:15:05 UTC

1.2 billion downloads ran through pyca/cryptography last month. Nearly every Python app that touches crypto depends on it. If it doesn't ship post-quantum primitives, the Python ecosystem can't migrate.
We helped add ML-DSA (FIPS 204) for signatures and ML-KEM (FIPS 203) for key exchange to the library. Install and migration details in the blog. https://blog.trailofbits.com/2026/06/30/shipping-post-quantum-cryptography-to-python/

2026-06-29 11:15:04 UTC

2026-05-05 11:03:01 UTC

30 readers took our C/C++ challenge. Some solved the Linux warmup, but nobody cracked the Windows driver bug. Even LLM-assisted submissions came up short.
The walkthrough explains both, including the Windows escalation from local DoS to kernel code execution.
Best 10 submissions are still getting swag. If you won, we'll be in contact.
https://blog.trailofbits.com/2026/05/05/c/c-checklist-challenges-solved/

2026-04-29 14:00:54 UTC

"You can write exploits for software that exists in only one configuration that one company has. And you can do it on the fly." —CEO Dan Guido in The Verge on how AI collapses the cost of finding bugs. https://www.theverge.com/ai-artificial-intelligence/915660/mythos-script-kiddies-hackers-attack-cybersecurity-ai

2026-04-21 11:03:05 UTC

"Human plus LLM is vastly vastly better than either one alone."
Our Blockchain Engineering Director Ben Samuels explains why security auditors aren't going anywhere.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/442/358/325/253/685/original/6c4a9b3dd1a2eb0b.mp4

2026-04-16 18:07:49 UTC

RE: https://fosstodon.org/@pypi/116414611218430369
4 billion downloads a day run through @npub1g52…8fy6. A missing permission check let any org member invite new owners. One of 14 findings from our second audit.
#note1hpu…v8qj

2026-04-15 11:02:33 UTC

Our C/C++ code review challenge closes April 17.
The new Testing Handbook chapter covers memory safety, integer errors, type confusion, kernel modules, Windows usermode, and seccomp sandbox escapes through manual code review.
Analyze the vulnerable programs, explain how to exploit them, and submit a writeup. First 10 correct entries win swag.
https://trailofbits.com/c-whats-wrong-challenge/

2026-04-09 11:02:02 UTC

C and C++ run your OS, your browser, your database, and your critical infrastructure. They're also the easiest languages to get catastrophically wrong.
We wrote down everything a security auditor should check: language-level bug classes, stdlib pitfalls, Linux and Windows issues from usermode to kernel, seccomp sandbox escapes, and ptrace handler race conditions.
One checklist, hundreds of checks. https://appsec.guide/docs/languages/c-cpp/

2026-04-07 14:00:55 UTC

Thousands of CEOs said AI had no impact on productivity. We use AI to catch 200 bugs/week where we used to find 15, and generate $8M per sales rep.
95% of the company pushed back when we started. At unprompted, Dan Guido explains how our 140-person team went AI-native.
https://www.youtube.com/watch?v=kgwvAyF7qsA

2026-04-07 11:02:01 UTC

Before its launch, we audited WhatsApp's Private Processing TEEs and found 8 high-severity issues (patched). The enclaves yielded to injected config files, unmeasured ACPI tables, spoofed firmware levels, and stale attestation reports.
TEE security is only as good as the implementation details. Four lessons and the full report: https://blog.trailofbits.com/2026/04/07/what-we-learned-about-tee-security-from-auditing-whatsapps-private-inference/

2026-02-20 16:07:02 UTC

Before launch, Perplexity hired us to test the security of Comet, their AI browser assistant. We demonstrated how four prompt injection techniques could extract users' private information from Gmail.

2026-01-29 12:15:04 UTC

Today's software signatures may not survive tomorrow's quantum computers.
Over the past two years, we collaborated with the Sigstore community to build controlled cryptographic agility into the ecosystem with a centralized algorithm registry, configurable restrictions, and Go implementations of post-quantum algorithms LMS and ML-DSA to prove it's future-ready. https://blog.trailofbits.com/2026/01/29/building-cryptographic-agility-into-sigstore/

2026-01-22 17:30:43 UTC

TEE security breaks down in predictable ways. In our December webinar, we showed exactly where.
Jules Drean from Tinfoil walked through their threat model, covering repositories, hardware configurations, and CVM images. Our security engineers, Paul Bottinelli and Tjaden Hess, dug into vulnerabilities they've found in production TEE deployments.
Watch the full recording: https://watch.getcontrast.io/register/trail-of-bits-top-tee-bugs-you-should-fix-before-your-audit?utm_source=socials
https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/939/936/963/046/356/original/aefe26238baa70cd.mp4

2026-01-08 12:37:00 UTC

We're now accepting applications for our 2026 summer internship program!
Trail of Bits is hiring interns across our software assurance, security engineering, and research & development teams. Over the summer, you'll work on real projects that might include conducting security assessments for critical systems, developing open-source tools, and contributing research that advances the field.
Applications are open now through February! Learn more and apply here!
https://apply.workable.com/trailofbits/j/0C784B6D41/

2026-01-06 10:45:02 UTC

Are we entering a world where chatbots will replace devs?
Probably not. Prompting an LLM with natural language is inherently lossy and ambiguous. Up to this point, programming has always been deterministic: Your code does what you say it should do otherwise, it’s a bug. Coding agents break that contract.
Our blog:
https://blog.trailofbits.com/2025/12/19/can-chatbots-craft-correct-code/

2025-12-16 12:15:04 UTC

Memory bugs, such as use-after-free and buffer overflows, are the most exploited vulnerability class; however, AddressSanitizer's 2-4x performance overhead makes it unusable in production.
So, we recommend GWP-ASan, which uses sampling and guard pages to detect memory safety bugs at scale. Learn the technique and how to implement it in your C++ projects using LLVM's scudo allocator:
https://blog.trailofbits.com/2025/12/16/use-gwp-asan-to-detect-exploits-in-production-environments/

2025-10-31 11:46:31 UTC

This week's deep dive: The Cryptography Behind Passports
Your passport is a computer with its own filesystem and cryptographic protocols designed to prevent unauthorized reading, eavesdropping, forgery, and copying. However, passports remain in circulation for 5-10 years, so the legacy protocols become security risks.
Learn about how electronic passports work, security risks, and novel use cases: https://blog.trailofbits.com/2025/10/31/the-cryptography-behind-electronic-passports/
https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/468/611/734/083/662/original/5d7720f587b7f256.png

2025-10-30 11:10:19 UTC

We're spilling the TEE: We're disclosing vulnerabilities (CVE-2025-59054, CVE-2025-58356) in LUKS2 disk encryption affecting 8 confidential computing systems.
https://blog.trailofbits.com/2025/10/30/vulnerabilities-in-luks2-disk-encryption-for-confidential-vms/
https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/462/807/106/255/279/original/328676a5c2487191.png

2025-09-04 16:41:32 UTC

We built local backdoors for Signal, 1Password & Slack through V8 heap snapshot tampering (CVE-2025-55305).
Method: Replace v8_context_snapshot.bin files with versions that override JavaScript builtins. When apps call Array.isArray(), malicious code executes.
Works because integrity checks ignore these "non-executable" files that actually contain executable JavaScript.
Impact: Nearly every Chromium-based app is vulnerable.
https://blog.trailofbits.com/2025/09/03/subverting-code-integrity-checks-to-locally-backdoor-signal-1password-slack-and-more/
https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/147/020/110/097/710/original/4badccec501f5bc8.png

2025-08-25 11:55:01 UTC

How do Trail of Bits security engineers spend their free time? Solving the Traveling Salesman Problem for NYC's 474-station subway network!
When YouTuber @ImmigrantJackson challenged us to break the world record, Evan Sultanik applied combinatorial optimization from his PhD. Result: 20h 42min route beating the record by 45 minutes using Christofides algorithm .
https://blog.trailofbits.com/2025/08/25/speedrunning-the-new-york-subway/

2025-08-21 13:38:36 UTC

We hacked Gemini CLI, Vertex AI, Assistant, and other AI systems by embedding prompts into images that are not visible to users.
When these systems auto-downscale images, the hidden prompts emerge from previously invisible pixel patterns. https://blog.trailofbits.com/2025/08/21/weaponizing-image-scaling-against-production-ai-systems/
https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/067/028/426/174/684/original/23e804c554f5dcb8.png

2025-08-19 15:12:29 UTC

Trail of Bits August Newsletter:
This month, we exposed prompt injection attacks in GitHub Copilot, disclosed two high-severity NVIDIA Triton vulnerabilities found during new hire onboarding, and demonstrated how easily multi-agent systems can be hijacked.
Plus: We've open-sourced our cyber-reasoning system Buttercup so it runs on your laptop!
Read the full August Tribune for technical details, public security reviews, and our latest tool releases: https://mailchi.mp/trailofbits/trail-of-bits-tribune-august

2025-08-08 19:27:41 UTC

🥈 We won second place in DARPA's AI Cyber Challenge with Buttercup!
After competing against 7 top teams to build autonomous AI systems, we're excited to announce that Buttercup, our Cyber Reasoning System that automatically discovers and patches vulnerabilities, is now open source.
Learn more about Buttercup: https://blog.trailofbits.com/2025/08/08/buttercup-is-now-open-source/
https://media.infosec.exchange/infosec.exchange/media_attachments/files/114/994/791/039/569/221/original/dcbf46007efc4e47.jpeg

2025-08-05 11:28:21 UTC

Today, we’re disclosing two 9.8 CVSS memory corruption vulnerabilities in the NVIDIA Triton Inference Server that lets attackers crash production AI services through malicious HTTP requests (CVE-2025-23310 and CVE-2025-23311)
Found during new hire onboarding: our AI/ML Security Engineer, Will Vandevanter, followed our standard static analysis approach against Pwn2Own 2025 targets.
Read the blog: https://blog.trailofbits.com/2025/08/04/uncovering-memory-corruption-in-nvidia-triton-as-a-new-hire/

2025-07-25 15:23:30 UTC

At DistrictCon's inaugural Junkyard competition, we achieved full remote execution on two popular home network devices: a Netgear WGR614v9 router and BitDefender Box V1 security appliance.
Our exploitation techniques included chaining four buffer overflow vulnerabilities with authentication bypass on the router, plus a novel "bashsledding" ROP technique that sprays shell commands into NVRAM for reliable code execution.
Read the blog: https://blog.trailofbits.com/2025/07/25/exploiting-zero-days-in-abandoned-hardware/

2025-07-24 11:11:01 UTC

New Trail of Bits Tribune: Our AIxCC finals submission, how we exposed critical flaws in Go's built-in parsers that can enable authentication bypass and data exfiltration from production systems, and 14 new security reviews.
Read it here: https://mailchi.mp/trailofbits/trail-of-bits-tribune-july-2025

2025-07-17 07:06:09 UTC

disconnect3d from Trail of Bits presents Pwndbg at #EuroPython.
Pwndbg is a Python tool that makes low-level debugging actually enjoyable for security work.
Pwndbg provides:
→ Clear context displays for assembly analysis
→ Built-in heap and stack visualization
→ Streamlined commands for exploit development
→ Python extensibility for custom analysis
Today at 10:30 at Terrace 2A. Perfect for anyone doing systems security, malware analysis, or CTF challenges.
https://ep2025.europython.eu/session/pwndbg-low-level-debugging-and-exploit-development-with-python

2025-05-02 13:27:40 UTC

Do you know exactly what data was used to train your ML models?
Datasig generates fingerprints for AI training datasets that can help detect poisoning attacks without needing to store a dataset’s raw data.
Our new tool helps AI Bill of Materials (AIBOM) tools track datasets that are part of an AI model’s supply chain. Datasig’s fingerprints can trace a model’s data supply chain to determined if it was trained on data that was poisoned, erroneous, or contained sensitive information.
Read more about the tool: https://blog.trailofbits.com/2025/05/02/datasig-fingerprinting-ai/ml-datasets-to-stop-data-borne-attacks/

2025-04-21 15:01:04 UTC

Attackers can use MCP servers to hack your system before tools are invoked.
We call this attack vector "line jumping." This is a critical vulnerability in which tool descriptions become prompt injection vectors during the initial tools/list request. This technique bypasses invocation controls, breaking connection isolation and rendering security checkpoints ineffective.
Even "human approval" fails: AI-enabled IDEs permit automatic execution, and users rarely recognize disguised malicious commands.
Read the blog: https://blog.trailofbits.com/2025/04/21/jumping-the-line-how-mcp-servers-can-attack-you-before-you-ever-use-them/

2025-04-18 13:28:52 UTC

Coming to PyCA Cryptography—a new Rust-powered ASN.1 API that reduces parser differentials while giving you clean Python syntax and native-speed parsing.
Why does Python need this? Most devs aren't working with ASN.1 daily, but many need custom encoding beyond standard X.509. Think extracting DER-encoded values from X.509 certs like sigstore custom extensions
Read the blog: https://blog.trailofbits.com/2025/04/18/sneak-peek-a-new-asn.1-api-for-python/

2025-04-09 13:58:03 UTC

Our new Testing Handbook section on snapshot fuzzing helps security engineers test software that's traditionally difficult to analyze, such as kernel components and antivirus, where a single crash can take down the entire system.
Snapshot fuzzing captures memory and register states at critical execution points, allowing security engineers to:
- Test thousands of code paths without time-consuming system restarts
- Ensure fully deterministic testing where the same input always produces the same result
- Eliminate unreproducible crashes by starting each test from identical states
-Easily track code coverage and detect failures in emulated environments
In this section, we provide step-by-step instructions for building custom harnesses, fuzz campaigns, and more using What the Fuzz (wtf), an open-source snapshot-based fuzzer.
https://blog.trailofbits.com/2025/04/09/introducing-a-new-section-on-snapshot-fuzzing-for-kernel-level-testing-in-the-testing-handbook/
https://media.infosec.exchange/infosec.exchange/media_attachments/files/114/308/353/056/644/944/original/8d39f591f7acd177.png

2025-03-12 14:17:40 UTC

If you're fuzzing C/C++ code and need more customizability, our new Testing Handbook chapter shows you exactly how to set up and use LibAFL - both as a libFuzzer drop-in and as a Rust library.
https://appsec.guide/docs/fuzzing/c-cpp/libafl/

2025-02-14 15:05:51 UTC

Thanks to OSTIF!, in 2024, we assessed cURL's HTTP/3 components. We found two issues, enhanced fuzzing coverage, and provided testing and security recommendations.
https://github.com/trailofbits/publications/blob/master/reviews/2023-12-curl-http3-securityreview.pdf
cURL marked our 14th security assessment with OSTIF, with our first being in 2019. OSTIF's mission to secure critical open-source software has led to security improvements across projects on which we all depend.
Read their annual reports:
https://ostif.org/ostif-2024-annual-report/
https://ostif.org/2024-sovtech-audit-report/

2025-01-30 14:49:49 UTC

PyPI's new archival feature lets maintainers explicitly signal when projects won't receive future updates. No more guessing about maintenance status - package users can now make clear, informed decisions about their dependencies.
https://blog.trailofbits.com/2025/01/30/pypi-now-supports-archiving-projects/

2025-01-29 16:46:10 UTC

Now accepting applications for our 2025 summer internship program!
Available tracks & examples:
AI/ML Security: Develop safety frameworks, conduct risk assessments
Application Security: Exploit kernel vulnerabilities, conduct code reviews, develop anti-DRM solutions
Blockchain: Enhance Slither/Echidna, shadow professional security audits
Cryptography: Build next-gen cryptanalysis tools, contribute to academic research
Operations: Drive strategic initiatives alongside our CEO
Details:
Duration: June - August 2025
Location: NYC or Remote
Direct mentorship from industry experts
Apply now: https://apply.workable.com/trailofbits/j/7476E8C7DC/

2024-12-09 15:32:24 UTC

We've released 35 new Semgrep rules targeting infrastructure, supply chain, and Ruby security issues. Plus, learn how to leverage regex mode and HCL support for better infrastructure-as-code security.
https://blog.trailofbits.com/2024/12/09/35-more-semgrep-rules-infrastructure-supply-chain-and-ruby/

2024-09-24 13:57:16 UTC

AWS Nitro Enclaves offer strong isolation for sensitive workloads but require careful security implementation. We cover key areas to help developers avoid common pitfalls and harden their enclave deployments. https://blog.trailofbits.com/2024/09/24/notes-on-aws-nitro-enclaves-attack-surface/

2024-09-11 12:17:00 UTC

We've completed a comparative security assessment of authorization policy languages: Cedar, Rego, and the OpenFGA modeling language.
If you are a language designer or a software developer, our AWS-sponsored assessment also provides recommendations for improving policy language design and for securing systems that use policy languages.
https://buff.ly/4cSO63s

2024-09-05 14:37:03 UTC

We want your old GPUs that were destined to become e-waste.
We're repurposing outdated GPUs to tackle challenging computer security and program analysis problems. https://buff.ly/3XsbdgJ
https://media.infosec.exchange/infosec.exchange/media_attachments/files/113/085/449/658/073/647/original/4da9dc3bbe6ce26e.png

2024-08-27 13:50:17 UTC

We provisioned cloud infrastructure the Max Power way, showing that AI tools often generate code that works but has terrible security properties.
https://buff.ly/3X54ZSN
https://media.infosec.exchange/infosec.exchange/media_attachments/files/113/034/304/937/073/570/original/1bbd04430f63bdfb.png