omkhar

anthropic.comDiscovering and exploiting vulnerabilities in critical, real-world software with ClaudeOver the past few months, we’ve used an unreleased, internal research model to find critical vulnerabilities in some of the world’s most widely used software, such as browsers and operating systems. I...

14h

An unreleased Claude research model wrote five attack chains after initial prompting: Chrome, Safari, Android, Windows and Linux. All since addressed. Advice from @anthropic.com 's Frontier Red Team: scan your own code. www.anthropic.com/research/dis...

anthropic.comUsing Claude to reduce the attack surface of codeAutomated attack surface analysis and reduction can meaningfully improve the security of deployed software in the near term. In this post, we preview data we’ve collected from applying attack surface ...

OpenSSH 10.6 gated roughly a fifth of what an unauthenticated client could reach in a default build, mostly off-by-default ML-DSA code. Found by Anthropic's Frontier Red Team with Claude. www.anthropic.com/research/att...

Yesterday I started at @anthropic.com as a Member of Technical Staff. I've spent 28 years securing critical infrastructure and the open source the world runs on. As Dario wrote, "we need hope as well." Sky's the limit. Let's go!

Friday 10/9 was my last day at LinkedIn (Yes, I announced it on LinkedIn too 🤣) Thank you to my InfoSec and core infra teams for everything. Stay tuned for what's next...

Sabrina and I started the @skscholarship.com to help underrepresented people get a fair shot. This Fall, Lingjing and Abdon join 36 other recipients in pursuing their M.Sc. in Cybersecurity. A scholarship does not change the coursework. It changes who can finish.

skscholarship.comS&K Scholarship | Cybersecurity scholarship at NYU TandonThe S&K Scholarship helps students from underrepresented groups complete the NYU online Cybersecurity, M.S. at NYU Tandon. Awarded in the Spring and Fall semesters. Email to apply.

If you know someone interested in getting their M.Sc. in Cybersecurity send them the post below or send them to www.skscholarship.com Congratulations, Lingjing and ABDON!

If you haven’t watched this BlackHat talk about the OpenAI / huggingface incident, give it a watch. I can’t wait to see the full post mortem. youtu.be/87DyyMV0kCY

youtu.beBlack Hat USA 2026: The 'Breaking' News: The OpenAI–Hugging Face IncidentYouTube video by Black Hat

linkedin.comLinkedIn hiring Staff Security Engineer - AI in Sunnyvale, CA | LinkedInPosted 9:34:52 AM. LinkedIn is the world's largest professional network, built to create economic opportunity for…See this and similar jobs on LinkedIn.

27 July

Wanna secure AI for 30K employees and over a billion members? Come work with us in LinkedIn InfoSec! www.linkedin.com/jobs/view/44... FAQ: * If you'd like to know if you’re a good fit, apply. * If I’ve worked with you before, I’m happy to refer you, DM me. * This role is located in Sunnyvale, CA

My feed is awash with “innovative” “thought leadership” pieces about the impact of Fable/Mythos being restricted. Doing security research and are looking for a portable skill that you can use to discover new vulnerabilities? Check out Vulnerability Validation skill: github.com/omkhar/vulne...

13 June

It supports Codex, Claude Code, Gemini CLI, GitHub Copilot, Google Antigravity. It has unofficial support for anything that can read an AGENT.md Check it out, tell me what I got wrong. Pull requests are welcome. PS Knicks in 5

11 June

Last night's MVPs: 1. Wu-Tang 2. Brunson 3. Anunoby Knicks in 5

9 June

Mythos/Fable is out... Before the thought leaders start publish whitepapers, or hosting "CISO dinners" etc, I'll offer some boring/sobering advice: 1. Make sure you know where all your stuff is - ya even that 3rd party software that the person in accounting bought on a credit card in 2016.

9 June

2. Make sure you understand how to patch / update all of your stuff as fixes come out. Quickly. Bad guys have no respect for risk acceptances and patch windows. 3. Make sure that you've hardened anything external facing as best you can. 4. Hydrate, get sleep. It's a marathon not a sprint

usenix.orgPEPR '26The 2026 USENIX Conference on Privacy Engineering Practice and Respect (PEPR '26) will take place on June 1–2, 2026. PEPR is focused on designing and building products and systems with privacy and res...

9 June

5. As per Jurassic Park...

omkhar reposted

Lea Kissner

@leak.bsky.social

20 May

Are you a privacy engineer or work with privacy engineers? Would you like to learn more about probably engineering? Boy do I have a conference for you! PEPR, the conference on privacy engineering, practice, and respect, is happening June 1-2 in Santa Clara, CA. www.usenix.org/conference/p...

18 May

Vulns are getting packed up github.com/ImageMagick/... #iykyk #cybersecurity #opensourcesoftware

Mee-thos? Meye-thos? Mi-thos? A month in, I still couldn't tell you. The loudest opinions on AI vulnerability research almost never come from the people actually using it or contributing to making the world more secure.

One thing I won't wait to say: To the open source maintainers who've fielded our reports, triaged with patience, and shipped fixes through what has genuinely been an unprecedented stretch, thank you. I owe you many coffees/beers/waters. Much love.

Wu-Tang said it in '93: protect ya neck. You've been doing it for the rest of us ever since. No royalties, no panels, no merch. Just the work. Back to research and helping fix upstream. #opensourcesoftware #cybersecurity

The actual work is unglamorous. You read code. You read more code. You look upstream at the open source the whole world depends on. You find things. You report them carefully. You wait. And hopefully you've made the world a little more secure.

That's what our team at LinkedIn has been doing, inside our own stack and across the dependencies we all share. I'll share more when I can.

Since Anthropic shipped Mythos and OpenAI Codex Cyber, my feed has been wall-to-wall thought leadership. Sage wisdom. Whitepapers. Panels. Frameworks for "AI-augmented vulnerability discovery." Panels about the frameworks. And one framework about panels

Meanwhile, the engineers I know, the ones helping secure the internet, have gone quiet. There's usually a reason for that.

“I went from negative to positive.” - Biggie Smalls, BedStuy Motivational Speaker That came up near the end of my conversation with Cameron on The Defender’s Journal, and it probably says more about my career than any title ever has.

The thread through all of it: I’m still happiest building things at scale, with smart people, where security, software engineering, and productivity are treated as one system.

linkedin.comEP. 35, THE DEFENDER'S JOURNAL - OMKHAR ARASARATNAM! 🎙️ | Techfellow LimitedMost careers don’t go to plan. Some don’t follow a plan at all… In Episode 35 of The Defender’s Journal, Omkhar Arasaratnam shares how he went from factory work and DJ’ing to shaping security at Link...

The correct step is a step. When you come to a fork in the road, take it. Thanks Cameron for the conversation. Link in below. What did your “dead end” teach you later? www.linkedin.com/posts/ep-35-...

* Coding agents are not autocomplete with a better haircut. They are creative, persistent, and occasionally behave like mini red teams. Correctness, provenance, test harnesses, and mutation testing matter more now, not less.

* Mentorship is not doing someone’s job for them. It’s giving enough scaffolding that they can pick up the hard thing themselves.

A few things we got into: * Humans have context windows too. At billions-with-a-B scale, you can’t keep making people the load-bearing control.

* The industry will continue to underestimate fundamentals. We’ll talk about nation-state actors on panels and still get burned by sketchy remote-control software on a work laptop.

I started in factory work, DJing, and ThinkPad tech support. I somehow ended up working on security, software, and systems at global scale. Over a long enough story arc, I’m not sure any of the “dead ends” were actually dead ends.

22 Apr

Me right now while doing vuln research

17 Apr

"Do you know the ledge?" Rakim - Long Island 0-day Researcher The last 10 days, everyone's had an opinion on Mythos and GPT 5.4-Cyber.

17 Apr

Having spent time with both, I can tell you the biggest security vulnerability they've exposed isn't technical. It's people who haven't touched either one confidently telling you what it all means.

17 Apr

Unsurprisingly, the best defense right now for most people is the same as it's always been: patch your stuff, and keep it up to date. The basics aren't sexy, but they work. Know the ledge before you step to it. Some things never change.

15 Apr

Most security tools slow you down. Most fast tools ignore security. We wanted both. So we built Workcell. It started with a few co-conspirators asking: "How do we vibe code at yolo speed and not get owned?"

It works. But it's not done yet, and I'd rather build what YOU need than guess. The roadmap is open. Go add to it: github.com/omkhar/workcell/blob/main/ROADMAP.md What would make Workcell indispensable for you? Pull requests are welcome!

Happy tax day to all those who observe :lolsob:

github.comGitHub - omkhar/workcell: Bounded local runtime and policy boundary for coding agentsBounded local runtime and policy boundary for coding agents - omkhar/workcell

10 Apr

Coding agents are powerful. They’re also one bad boundary away from self-compromising your machine. I wanted the speed of “YOLO mode” without giving up isolation, so I built Workcell. With a lot of help from Codex, Claude, Gemini, and Rick, it’s now out: github.com/omkhar/workc...

10 Apr

Try it. Break it. Tell me what holds up. Patches welcome. #cybersecurity #codingagents #security #opensource

8 Apr

A few years ago, when I was working at @openssf.org , we partnered with @darpa.mil on the AI Cyber Challenge. Yesterday's news from @anthropic.com about Mythos and Glasswing both highlight the opportunity that we saw, and the primary reason we were so focused on securing open source software.

"Code Rules Everything Around Me, CREAM" - Method Man, Chief AI Scientist, Wu-Tang Clan Code got cheaper. Engineering didn’t.

So the engineering model has to change too: * Optimize for learning velocity, not backlog pressure * Use smaller, high-context teams with clear ownership - reduce fractal communication complexity

* Spend less time on code production, more on architecture, evals, and review * Treat observability, rollback, and correctness as part of the product Same game. Different scoreboard. How are you adapting to the new economics of building? #softwareengineering #code #ai #agents #codex #claude #gemini

"Code Rules Everything Around Me, CREAM" - Method Man, Chief AI Scientist, Wu-Tang Clan Code got cheaper. Engineering didn’t.

For years, engineering organizations were built around one constraint: implementation was expensive, so every idea had to survive layers of prioritization before anyone wrote a line of code. AI changed that.