Nostr notes by Trail of Bits

Agentic AI headlines Black Hat's keynotes and DEF CON's ...

2026-07-31T11:03:01Z

Agentic AI headlines Black Hat's keynotes and DEF CON's main stage next week, and it's a topic we've been researching for years. We've hijacked multi-agent systems with one web page, pulled Gmail data from Perplexity's Comet via prompt injection, and built image-scaling attacks invisible to humans but not models. All documented on blog.trailofbits.com.

We'll be in Vegas Aug 4-6. If you're around, we'd love to chat: https://meetings.hubspot.com/trailofbits/blackhat-defcon-scheduling

#infosec #aisecurity

We gave GPT-5.5-Cyber a single /goal: find a specific class of ...

2026-07-02T11:15:06Z

We gave GPT-5.5-Cyber a single /goal: find a specific class of bugs in zlib. It built a fuzzing lab in less than a day, a task that takes a skilled researcher weeks.

Harnesses across a dozen entry points (inflateBack, uncompress2, MiniZip, puff), ASan/UBSan builds, seeds from zlib's own tests. Findings are now in coordinated disclosure.

Patch the Planet field report by Benjamin Samuels:
https://blog.trailofbits.com/2026/07/02/field-reports-from-patch-the-planet/

#fuzzing #infosec #zlib

cargo-audit flags Rust dependencies with known vulnerabilities. A ...

2026-07-01T11:01:26Z

cargo-audit flags Rust dependencies with known vulnerabilities. A flagged crate, though, doesn't tell you whether your code calls the vulnerable function.

We added a feature that matches a binary's symbols against the functions named in each advisory. Any matches are labeled "Affected," separating real exposure from advisories that don't apply.

It's live in cargo-audit 0.22.2+. If you're behind, update with `cargo install -f cargo-audit`.

#rust #infosec #supplychain

https://crates.io/crates/cargo-audit

OpenAI handed us their most cyber-capable models and asked us to ...

2026-06-30T14:00:42Z

OpenAI handed us their most cyber-capable models and asked us to work directly with open-source maintainers to Patch the Planet.

We started with 19 projects: cURL, Python, Sigstore, NATS, and more. 50 projects have now joined the initiative. Each get a dedicated team reviewing code, finding vulnerabilities, and writing patches.

More in their blog: https://openai.com/index/patch-the-planet/

#infosec #opensource #security

1.2 billion downloads ran through pyca/cryptography last month. ...

2026-06-30T11:15:05Z

1.2 billion downloads ran through pyca/cryptography last month. Nearly every Python app that touches crypto depends on it. If it doesn't ship post-quantum primitives, the Python ecosystem can't migrate.

We helped add ML-DSA (FIPS 204) for signatures and ML-KEM (FIPS 203) for key exchange to the library. Install and migration details in the blog. https://blog.trailofbits.com/2026/06/30/shipping-post-quantum-cryptography-to-python/

1.2 billion downloads ran through pyca/cryptography last month. ...

2026-06-29T11:15:04Z

30 readers took our C/C++ challenge. Some solved the Linux ...

2026-05-05T11:03:01Z

30 readers took our C/C++ challenge. Some solved the Linux warmup, but nobody cracked the Windows driver bug. Even LLM-assisted submissions came up short.

The walkthrough explains both, including the Windows escalation from local DoS to kernel code execution.

Best 10 submissions are still getting swag. If you won, we'll be in contact.
https://blog.trailofbits.com/2026/05/05/c/c-checklist-challenges-solved/

"You can write exploits for software that exists in only one ...

2026-04-29T14:00:54Z

"You can write exploits for software that exists in only one configuration that one company has. And you can do it on the fly." —CEO Dan Guido in The Verge on how AI collapses the cost of finding bugs. https://www.theverge.com/ai-artificial-intelligence/915660/mythos-script-kiddies-hackers-attack-cybersecurity-ai

"Human plus LLM is vastly vastly better than either one ...

2026-04-21T11:03:05Z

"Human plus LLM is vastly vastly better than either one alone."

Our Blockchain Engineering Director Ben Samuels explains why security auditors aren't going anywhere.

RE: https://fosstodon.org/@pypi/116414611218430369 4 billion ...

2026-04-16T18:07:49Z

RE: https://fosstodon.org/@pypi/116414611218430369

4 billion downloads a day run through Python Package Index (npub1g52…8fy6). A missing permission check let any org member invite new owners. One of 14 findings from our second audit.

quoting
note1hpu…v8qj

🔎🔐 #PyPI has completed its second external #security audit! Thanks to Sovereign Tech Agency (npub1yng…nhrk) for funding, Trail of Bits (npub1rcs…7sw8) for the audit, and Alpha-Omega for supporting rapid remediation. Find the full report on the Trail of Bits publication page. #Python
https://blog.pypi.org/posts/2026-04-16-pypi-completes-second-audit/

Our C/C++ code review challenge closes April 17. The new Testing ...

2026-04-15T11:02:33Z

Our C/C++ code review challenge closes April 17.

The new Testing Handbook chapter covers memory safety, integer errors, type confusion, kernel modules, Windows usermode, and seccomp sandbox escapes through manual code review.

Analyze the vulnerable programs, explain how to exploit them, and submit a writeup. First 10 correct entries win swag.

https://trailofbits.com/c-whats-wrong-challenge/

C and C++ run your OS, your browser, your database, and your ...

2026-04-09T11:02:02Z

C and C++ run your OS, your browser, your database, and your critical infrastructure. They're also the easiest languages to get catastrophically wrong.

We wrote down everything a security auditor should check: language-level bug classes, stdlib pitfalls, Linux and Windows issues from usermode to kernel, seccomp sandbox escapes, and ptrace handler race conditions.

One checklist, hundreds of checks. https://appsec.guide/docs/languages/c-cpp/

Thousands of CEOs said AI had no impact on productivity. We use ...

2026-04-07T14:00:55Z

Thousands of CEOs said AI had no impact on productivity. We use AI to catch 200 bugs/week where we used to find 15, and generate $8M per sales rep.

95% of the company pushed back when we started. At unprompted, Dan Guido explains how our 140-person team went AI-native.
https://www.youtube.com/watch?v=kgwvAyF7qsA

Before its launch, we audited WhatsApp's Private Processing ...

2026-04-07T11:02:01Z

Before its launch, we audited WhatsApp's Private Processing TEEs and found 8 high-severity issues (patched). The enclaves yielded to injected config files, unmeasured ACPI tables, spoofed firmware levels, and stale attestation reports.

TEE security is only as good as the implementation details. Four lessons and the full report: https://blog.trailofbits.com/2026/04/07/what-we-learned-about-tee-security-from-auditing-whatsapps-private-inference/

Before launch, Perplexity hired us to test the security of Comet, ...

2026-02-20T16:07:02Z

Before launch, Perplexity hired us to test the security of Comet, their AI browser assistant. We demonstrated how four prompt injection techniques could extract users' private information from Gmail.

Today's software signatures may not survive tomorrow's ...

2026-01-29T12:15:04Z

Today's software signatures may not survive tomorrow's quantum computers.
Over the past two years, we collaborated with the Sigstore community to build controlled cryptographic agility into the ecosystem with a centralized algorithm registry, configurable restrictions, and Go implementations of post-quantum algorithms LMS and ML-DSA to prove it's future-ready. https://blog.trailofbits.com/2026/01/29/building-cryptographic-agility-into-sigstore/

TEE security breaks down in predictable ways. In our December ...

2026-01-22T17:30:43Z

TEE security breaks down in predictable ways. In our December webinar, we showed exactly where.
Jules Drean from Tinfoil walked through their threat model, covering repositories, hardware configurations, and CVM images. Our security engineers, Paul Bottinelli and Tjaden Hess, dug into vulnerabilities they've found in production TEE deployments.

Watch the full recording: https://watch.getcontrast.io/register/trail-of-bits-top-tee-bugs-you-should-fix-before-your-audit?utm_source=socials

We're now accepting applications for our 2026 summer ...

2026-01-08T12:37:00Z

We're now accepting applications for our 2026 summer internship program!

Trail of Bits is hiring interns across our software assurance, security engineering, and research & development teams. Over the summer, you'll work on real projects that might include conducting security assessments for critical systems, developing open-source tools, and contributing research that advances the field.

Applications are open now through February! Learn more and apply here!
https://apply.workable.com/trailofbits/j/0C784B6D41/

Are we entering a world where chatbots will replace devs? ...

2026-01-06T10:45:02Z

Are we entering a world where chatbots will replace devs?
Probably not. Prompting an LLM with natural language is inherently lossy and ambiguous. Up to this point, programming has always been deterministic: Your code does what you say it should do otherwise, it’s a bug. Coding agents break that contract.

Our blog:
https://blog.trailofbits.com/2025/12/19/can-chatbots-craft-correct-code/

Memory bugs, such as use-after-free and buffer overflows, are the ...

2025-12-16T12:15:04Z

Memory bugs, such as use-after-free and buffer overflows, are the most exploited vulnerability class; however, AddressSanitizer's 2-4x performance overhead makes it unusable in production.

So, we recommend GWP-ASan, which uses sampling and guard pages to detect memory safety bugs at scale. Learn the technique and how to implement it in your C++ projects using LLVM's scudo allocator:
https://blog.trailofbits.com/2025/12/16/use-gwp-asan-to-detect-exploits-in-production-environments/

This week's deep dive: The Cryptography Behind Passports Your ...

2025-10-31T11:46:31Z

This week's deep dive: The Cryptography Behind Passports

Your passport is a computer with its own filesystem and cryptographic protocols designed to prevent unauthorized reading, eavesdropping, forgery, and copying. However, passports remain in circulation for 5-10 years, so the legacy protocols become security risks.

Learn about how electronic passports work, security risks, and novel use cases: https://blog.trailofbits.com/2025/10/31/the-cryptography-behind-electronic-passports/

We're spilling the TEE: We're disclosing vulnerabilities ...

2025-10-30T11:10:19Z

We're spilling the TEE: We're disclosing vulnerabilities (CVE-2025-59054, CVE-2025-58356) in LUKS2 disk encryption affecting 8 confidential computing systems.

https://blog.trailofbits.com/2025/10/30/vulnerabilities-in-luks2-disk-encryption-for-confidential-vms/

We built local backdoors for Signal, 1Password & Slack ...

2025-09-04T16:41:32Z

We built local backdoors for Signal, 1Password & Slack through V8 heap snapshot tampering (CVE-2025-55305).

Method: Replace v8_context_snapshot.bin files with versions that override JavaScript builtins. When apps call Array.isArray(), malicious code executes.
Works because integrity checks ignore these "non-executable" files that actually contain executable JavaScript.

Impact: Nearly every Chromium-based app is vulnerable.
https://blog.trailofbits.com/2025/09/03/subverting-code-integrity-checks-to-locally-backdoor-signal-1password-slack-and-more/

How do Trail of Bits security engineers spend their free time? ...

2025-08-25T11:55:01Z

How do Trail of Bits security engineers spend their free time? Solving the Traveling Salesman Problem for NYC's 474-station subway network!

When YouTuber @ImmigrantJackson challenged us to break the world record, Evan Sultanik applied combinatorial optimization from his PhD. Result: 20h 42min route beating the record by 45 minutes using Christofides algorithm .
https://blog.trailofbits.com/2025/08/25/speedrunning-the-new-york-subway/

We hacked Gemini CLI, Vertex AI, Assistant, and other AI systems ...

2025-08-21T13:38:36Z

We hacked Gemini CLI, Vertex AI, Assistant, and other AI systems by embedding prompts into images that are not visible to users.

When these systems auto-downscale images, the hidden prompts emerge from previously invisible pixel patterns. https://blog.trailofbits.com/2025/08/21/weaponizing-image-scaling-against-production-ai-systems/

Trail of Bits August Newsletter: This month, we exposed prompt ...

2025-08-19T15:12:29Z

Trail of Bits August Newsletter:

This month, we exposed prompt injection attacks in GitHub Copilot, disclosed two high-severity NVIDIA Triton vulnerabilities found during new hire onboarding, and demonstrated how easily multi-agent systems can be hijacked.

Plus: We've open-sourced our cyber-reasoning system Buttercup so it runs on your laptop!

Read the full August Tribune for technical details, public security reviews, and our latest tool releases: https://mailchi.mp/trailofbits/trail-of-bits-tribune-august

🥈 We won second place in DARPA's AI Cyber Challenge with ...

2025-08-08T19:27:41Z

🥈 We won second place in DARPA's AI Cyber Challenge with Buttercup!

After competing against 7 top teams to build autonomous AI systems, we're excited to announce that Buttercup, our Cyber Reasoning System that automatically discovers and patches vulnerabilities, is now open source.

Learn more about Buttercup: https://blog.trailofbits.com/2025/08/08/buttercup-is-now-open-source/

Today, we’re disclosing two 9.8 CVSS memory corruption ...

2025-08-05T11:28:21Z

Today, we’re disclosing two 9.8 CVSS memory corruption vulnerabilities in the NVIDIA Triton Inference Server that lets attackers crash production AI services through malicious HTTP requests (CVE-2025-23310 and CVE-2025-23311)

Found during new hire onboarding: our AI/ML Security Engineer, Will Vandevanter, followed our standard static analysis approach against Pwn2Own 2025 targets.

Read the blog: https://blog.trailofbits.com/2025/08/04/uncovering-memory-corruption-in-nvidia-triton-as-a-new-hire/

At DistrictCon's inaugural Junkyard competition, we achieved ...

2025-07-25T15:23:30Z

At DistrictCon's inaugural Junkyard competition, we achieved full remote execution on two popular home network devices: a Netgear WGR614v9 router and BitDefender Box V1 security appliance.

Our exploitation techniques included chaining four buffer overflow vulnerabilities with authentication bypass on the router, plus a novel "bashsledding" ROP technique that sprays shell commands into NVRAM for reliable code execution.

Read the blog: https://blog.trailofbits.com/2025/07/25/exploiting-zero-days-in-abandoned-hardware/

New Trail of Bits Tribune: Our AIxCC finals submission, how we ...

2025-07-24T11:11:01Z

New Trail of Bits Tribune: Our AIxCC finals submission, how we exposed critical flaws in Go's built-in parsers that can enable authentication bypass and data exfiltration from production systems, and 14 new security reviews.
Read it here: https://mailchi.mp/trailofbits/trail-of-bits-tribune-july-2025

disconnect3d from Trail of Bits presents Pwndbg at #EuroPython. ...

2025-07-17T07:06:09Z

disconnect3d from Trail of Bits presents Pwndbg at #EuroPython.
Pwndbg is a Python tool that makes low-level debugging actually enjoyable for security work.
Pwndbg provides:
→ Clear context displays for assembly analysis
→ Built-in heap and stack visualization
→ Streamlined commands for exploit development
→ Python extensibility for custom analysis
Today at 10:30 at Terrace 2A. Perfect for anyone doing systems security, malware analysis, or CTF challenges.
https://ep2025.europython.eu/session/pwndbg-low-level-debugging-and-exploit-development-with-python

Do you know exactly what data was used to train your ML models? ...

2025-05-02T13:27:40Z

Do you know exactly what data was used to train your ML models?

Datasig generates fingerprints for AI training datasets that can help detect poisoning attacks without needing to store a dataset’s raw data.

Our new tool helps AI Bill of Materials (AIBOM) tools track datasets that are part of an AI model’s supply chain. Datasig’s fingerprints can trace a model’s data supply chain to determined if it was trained on data that was poisoned, erroneous, or contained sensitive information.

Read more about the tool: https://blog.trailofbits.com/2025/05/02/datasig-fingerprinting-ai/ml-datasets-to-stop-data-borne-attacks/

Attackers can use MCP servers to hack your system before tools ...

2025-04-21T15:01:04Z

Attackers can use MCP servers to hack your system before tools are invoked.

We call this attack vector "line jumping." This is a critical vulnerability in which tool descriptions become prompt injection vectors during the initial tools/list request. This technique bypasses invocation controls, breaking connection isolation and rendering security checkpoints ineffective.

Even "human approval" fails: AI-enabled IDEs permit automatic execution, and users rarely recognize disguised malicious commands.

Read the blog: https://blog.trailofbits.com/2025/04/21/jumping-the-line-how-mcp-servers-can-attack-you-before-you-ever-use-them/

Coming to PyCA Cryptography—a new Rust-powered ASN.1 API that ...

2025-04-18T13:28:52Z

Coming to PyCA Cryptography—a new Rust-powered ASN.1 API that reduces parser differentials while giving you clean Python syntax and native-speed parsing.

Why does Python need this? Most devs aren't working with ASN.1 daily, but many need custom encoding beyond standard X.509. Think extracting DER-encoded values from X.509 certs like sigstore custom extensions

Read the blog: https://blog.trailofbits.com/2025/04/18/sneak-peek-a-new-asn.1-api-for-python/

Our new Testing Handbook section on snapshot fuzzing helps ...

2025-04-09T13:58:03Z

Our new Testing Handbook section on snapshot fuzzing helps security engineers test software that's traditionally difficult to analyze, such as kernel components and antivirus, where a single crash can take down the entire system.

Snapshot fuzzing captures memory and register states at critical execution points, allowing security engineers to:

- Test thousands of code paths without time-consuming system restarts
- Ensure fully deterministic testing where the same input always produces the same result
- Eliminate unreproducible crashes by starting each test from identical states
-Easily track code coverage and detect failures in emulated environments

In this section, we provide step-by-step instructions for building custom harnesses, fuzz campaigns, and more using What the Fuzz (wtf), an open-source snapshot-based fuzzer.

https://blog.trailofbits.com/2025/04/09/introducing-a-new-section-on-snapshot-fuzzing-for-kernel-level-testing-in-the-testing-handbook/

If you're fuzzing C/C++ code and need more customizability, ...

2025-03-12T14:17:40Z

If you're fuzzing C/C++ code and need more customizability, our new Testing Handbook chapter shows you exactly how to set up and use LibAFL - both as a libFuzzer drop-in and as a Rust library.
https://appsec.guide/docs/fuzzing/c-cpp/libafl/

Thanks to OSTIF!, in 2024, we assessed cURL's HTTP/3 ...

2025-02-14T15:05:51Z

Thanks to OSTIF!, in 2024, we assessed cURL's HTTP/3 components. We found two issues, enhanced fuzzing coverage, and provided testing and security recommendations.

https://github.com/trailofbits/publications/blob/master/reviews/2023-12-curl-http3-securityreview.pdf

cURL marked our 14th security assessment with OSTIF, with our first being in 2019. OSTIF's mission to secure critical open-source software has led to security improvements across projects on which we all depend.
Read their annual reports:
https://ostif.org/ostif-2024-annual-report/
https://ostif.org/2024-sovtech-audit-report/

PyPI's new archival feature lets maintainers explicitly ...

2025-01-30T14:49:49Z

PyPI's new archival feature lets maintainers explicitly signal when projects won't receive future updates. No more guessing about maintenance status - package users can now make clear, informed decisions about their dependencies.

https://blog.trailofbits.com/2025/01/30/pypi-now-supports-archiving-projects/

Now accepting applications for our 2025 summer internship ...

2025-01-29T16:46:10Z

Now accepting applications for our 2025 summer internship program!

Available tracks & examples:
AI/ML Security: Develop safety frameworks, conduct risk assessments
Application Security: Exploit kernel vulnerabilities, conduct code reviews, develop anti-DRM solutions
Blockchain: Enhance Slither/Echidna, shadow professional security audits
Cryptography: Build next-gen cryptanalysis tools, contribute to academic research
Operations: Drive strategic initiatives alongside our CEO

Details:
Duration: June - August 2025
Location: NYC or Remote
Direct mentorship from industry experts

Apply now: https://apply.workable.com/trailofbits/j/7476E8C7DC/

We've released 35 new Semgrep rules targeting infrastructure, ...

2024-12-09T15:32:24Z

We've released 35 new Semgrep rules targeting infrastructure, supply chain, and Ruby security issues. Plus, learn how to leverage regex mode and HCL support for better infrastructure-as-code security.

https://blog.trailofbits.com/2024/12/09/35-more-semgrep-rules-infrastructure-supply-chain-and-ruby/

AWS Nitro Enclaves offer strong isolation for sensitive workloads ...

2024-09-24T13:57:16Z

AWS Nitro Enclaves offer strong isolation for sensitive workloads but require careful security implementation. We cover key areas to help developers avoid common pitfalls and harden their enclave deployments. https://blog.trailofbits.com/2024/09/24/notes-on-aws-nitro-enclaves-attack-surface/

We've completed a comparative security assessment of ...

2024-09-11T12:17:00Z

We've completed a comparative security assessment of authorization policy languages: Cedar, Rego, and the OpenFGA modeling language.
If you are a language designer or a software developer, our AWS-sponsored assessment also provides recommendations for improving policy language design and for securing systems that use policy languages.
https://buff.ly/4cSO63s

We want your old GPUs that were destined to become e-waste. ...

2024-09-05T14:37:03Z

We want your old GPUs that were destined to become e-waste.
We're repurposing outdated GPUs to tackle challenging computer security and program analysis problems. https://buff.ly/3XsbdgJ

We provisioned cloud infrastructure the Max Power way, showing ...

2024-08-27T13:50:17Z

We provisioned cloud infrastructure the Max Power way, showing that AI tools often generate code that works but has terrible security properties.
https://buff.ly/3X54ZSN