depthfirst @depthfirstlabs

The Operating System for Modern Security depthfirst.com San Francisco Joined April 2025

Tweets

122
Followers

2K
Following

41
Likes

430

depthfirst @depthfirstlabs

a day ago

@IntCyberDigest @francescpicc Thanks for the coverage! More here: x.com/qasimmith/stat…

Today, @washingtonpost covered critical vulnerabilities @depthfirstlabs found in TikTok. These vulnerabilities allowed hackers to access anything on a user’s device that TikTok itself could access, including the camera, microphone, payment information, photos, and the user’s

15 76 349 95K 183

1 0 28 4K 11

View Details

QM @qasimmith

2 days ago

15 76 349 95K 183

View Details

depthfirst @depthfirstlabs

2 days ago

@GloboNews Obrigado por cobrir nossas notícias

0 0 3 153 0

View Details

Andrea Michi @andreamichi

3 days ago

I left DeepMind two years ago with the conviction that cybersecurity would be fundamental to the future of AI. The atomic bomb offers lessons about competition, cooperation, and control. But with AI, we do not yet know what forms the technology will take, how its risks will emerge, or what containing them will require. Calls from frontier labs to slow development may buy time. We still need to build the means to stay in control. One thing we do know: AI will run on compute and interact with the world through software and networks. Those systems give us concrete places to observe its behavior, enforce limits, and intervene, even as our understanding of the risks evolves. Some thoughts on this new frontier for cybersecurity: Building the Means to Stay in Control

8 7 55 4K 24

View Details

depthfirst @depthfirstlabs

4 days ago

@arakharazian Thanks for the callout @arakharazian Great to see our customers @supabase and @Tailscale on the list as well

0 0 7 145 0

View Details

depthfirst @depthfirstlabs

6 days ago

Device Mode enforces package security policies on the device. It blocks malicious or untrusted packages across AI agents, applications, package managers, and registry configurations. Policies can be managed centrally without changing how employees use their tools. Read more: depthfirst.com/post/introduci…

0 0 4 266 1

View Details

depthfirst @depthfirstlabs

6 days ago

During our testing, agents often responded to blocked package installations by trying another path. They switched package managers, returned to public registries, changed local settings, or downloaded packages directly.

1 0 3 267 0

View Details

depthfirst @depthfirstlabs

6 days ago

We are excited to introduce Dependency Firewall with On-Device Protection. It enforces security policies on devices and blocks malicious or untrusted packages across AI agents, applications, package managers, and registries. Centrally managed without changing how employees use their tools. Thread on supply chain attacks, how agents make this harder, and what device mode enables:

11 11 58 13K 51

View Details

depthfirst @depthfirstlabs

6 days ago

5) Device Mode enforces package security policies on the device. It blocks malicious or untrusted packages across AI agents, applications, package managers, and registry configurations. Policies can be managed centrally without changing how employees use their tools. Read more: depthfirst.com/post/introduci…

0 0 0 25 0

View Details

depthfirst @depthfirstlabs

6 days ago

4) During our testing, agents often responded to blocked package installations by trying another path. They switched package managers, returned to public registries, changed local settings, or downloaded packages directly.

1 0 0 27 0

View Details

Andrea Michi @andreamichi

a week ago

DeepSeek v4.1 Flash is the most impressive open-source cybersecurity model available right now. It's the first one to achieve frontier-level detection, and it does so at 1/15th of the cost of comparable closed models. Progress in defensive AI cybersecurity models is happening on two dimensions: detection and cost-efficiency. 4.1 Flash achieved a 57.3% recall and 36.4% precision at just $1.69 per task on dfbench, demonstrating that strong vulnerability detection doesn’t have to be expensive. See a more detailed breakdown of 4.1 Flash’s results:

3 5 39 5K 14

View Details

depthfirst @depthfirstlabs

a week ago

AI agents are increasingly completing tasks even when that means bypassing guardrails set by security teams. We explore how malware moved into trusted dependencies, who sits behind the package ecosystem, and what enterprises need to do next. Read more: depthfirst.com/post/preventin…

1 10 26 3K 4

View Details

depthfirst @depthfirstlabs

3 weeks ago

@levie 👀

0 0 2 195 0

View Details

Andrea Michi @andreamichi

3 weeks ago

Mythos has been one of the most closely watched model releases in cybersecurity. We wanted to measure how it performs on open-ended defensive security work, so we evaluated it on dfbench using the same methodology as other frontier systems. Mythos achieved 69% detection recall (the highest we’ve measured) and 24.5% precision on validation tasks. It’s a highly capable model, but gap to other frontier models is narrower than the attention around Mythos might suggest: GPT 5.6 Sol reached 65.7% recall at 18% precision, while dfs-large1 reached 62.2% and 18.3%. Looking at the economics, Mythos ran at an estimated $99.19 per task, compared with $43.37 for GPT 5.6 Sol and $6.77 for dfs-large1. At the same spend, GPT 5.6 Sol and dfs-large1 can respectively analyze roughly 2x and 15x as many scopes.