Lucc @securitystack

Our @OWASPLondon meetup has started and we currently have Chris Holman on stage speaking about the frontline story : "When Security Scanner Gets Popped". watch the live-stream 📺 here: 👇 youtube.com/live/YDgR_Xhhj…

OWASP London Chapter meetup is on Monday. Two talks "A Story from the Frontline: When the Security Scanner Gets Popped" Chris Holman and "SAML - Yep, it's Broken" by myself eventbrite.co.uk/e/owasp-london…

Our October meetup has started and we currently have Chris Holman speaking about the frontline story : "When Security Scanner Gets Popped". watch the live-stream 📺 here: 👇 youtube.com/live/YDgR_Xhhj…

Does it *actually* matter if the thing attacking your application is an AI agent? I don't think so. Human attacker? Script? Bot? AI agent? Your application still needs to withstand hostile behaviour. Correct authentication and authorization. Least privilege. Input validation. Rate limits. Logging. Monitoring. Alerting. The big difference with agents is **speed and adaptability**. They can potentially discover something, try it, adapt, try something else, exploit a vulnerability, and keep moving. They also don't need sleep, snacks, or bathroom breaks. :-/ So perhaps we don't need a whole new magical category of "AI agent security." But we do need to get really, really good at AppSec. 🎥 I talked about it here: twp.ai/E5FNo7

A supply-chain attack became a #databreach. Malicious TanStack npm packages stole a GitHub token from an ex-CrowdSec employee whose access remained active. Attackers copied ~170 private repos and exposed data on 83 users and 51 potential investors: 👇 thehackernews.com/2026/09/crowds…

Instead of slowing down AI, why not focus efforts on it writing secure code, one-shot, without additional intent? Why not build models that are excellent at patching vulnerable code when given a bug location. We don’t need better exploitation, we need better defensive moves.

I hear rumors from @manicode and @ronperris that LocoMocoSec will rise again? Really?

If you’re an IT admin and you run CrowdStrike in your environment, listen to this episode and check these settings in your tenant. Heck, transcribe this and have your AI do it for all I care, just do it, this week, please. offsec.blog/tuning-crowdst…

I’d like to be the capybara of AppSec and AI security: mellow, relaxed, unbothered, and somehow friends with everyone. I’m more like the chihuahua of AppSec and AI security: pacing the perimeter, barking at threat models, picking fights in public, and somehow vibrating even when standing still. Ah well. Might as well lean into it. 😁

There are two ways AI progress could go very badly and that we must avoid. First, we could lose control of the future to AI. This is unacceptable; we are unapologetically on Team Humanity, and AI must always serve people. To ensure that, we need ways to ensure that alignment and safety techniques stay ahead of progress in model capabilities. Second, we could end up in a world with too much concentration of power. If an extraordinarily powerful AI is used by one person or company to impress their worldview onto everyone else, the results could be extremely dystopian. Avoiding these two threats requires walking a narrow middle path; for example, one country could gain too much power. Another example is one lab ending up with too much power.

Sam Altman @sama

3 weeks ago

The world deserves confidence that American companies developing increasingly capable AI will act responsibly, especially as the trajectory of progress has steepened. Every frontier lab must deliver on this, and there is no reason any of us should come to work if we cannot. We

3K 1K 14K 6.2M 3K

Hi everyone, please check out our new chapter website which we will be actively developing to include more resources going forwards. Future events will be posted there so please sign up for notifications so you don't miss out. owasp.org/chapters/newca…

A security researcher just sparked a huge debate about C making a comeback because of AI. Here's what you need to know. Jim Manico, from Manicode Security, posted that C, not C++, not Python, not any modern web language, may become one of the most important programming languages of the future. His point, once AI reliably writes, tests, and maintains low-level code, the human-productivity cost of high-level languages stops paying off, and C's efficiency becomes the bigger win. The post exploded, pulling in nearly 100,000 views and hundreds of replies. Supporters point out C already runs the world's core infrastructure, the Linux, Windows, and macOS kernels, web servers like Nginx and Apache, databases like SQLite, PostgreSQL, and MySQL, and even the interpreters behind Python, Ruby, and PHP. The efficiency argument centers on cost. Python runs 10 to 100x slower than C for most tasks, and a cloud server running Python can cost 10x more than the same app rewritten in C. A JavaScript mobile app might drain a battery in 6 hours versus 18 hours for a C version. Critics pushed back hard. Some argued AI doesn't need a human-oriented language at all and could eventually generate machine code directly, making C just another unnecessary abstraction layer. Others noted AI-generated code still shows 23% more memory safety bugs in C, C++, and Rust unsafe blocks, so the classic buffer-overflow risks haven't disappeared just because AI is writing the code. Key numbers: - Manicode's original post: 99.9K views, 1.1K likes, 217 retweets - Python vs C: 10-100x slower execution - Cloud hosting cost: up to 10x cheaper in C than Python - Mobile battery life: 6 hours (JavaScript) vs 18 hours (C) - AI-generated code: 23% more memory safety bugs in unsafe-block languages The debate is still running on X as of September 15-16, 2026, with no consensus on whether AI favors C or skips human languages entirely.

Jim Manico from Manicode Security @manicode

2 weeks ago

One of the most important programming languages of the future may be C. Not C++. Not Python. Not the latest high-level web language. C. In the era of AI-generated software, we may no longer need to pay as much of the abstraction and runtime cost that comes with languages

455 177 2K 202K 433

166,700 fruit fly neurons just took over 3 drones, and nobody taught them to fly. Scientists mapped the full brain of 1 real fly, every neuron and all 25 million connections, and put it online for free. Someone copied that brain 3 times and plugged each copy into a drone. No flight code, no gesture presets, no "avoid the chair" rule, just a camera feeding the fly's eyes and neurons turning into throttle. 1 drone hovers, 1 slips past a chair, 1 drops to the floor and holds. This brain spent 350 million years learning to stay in the air, and now it's back where it belongs. No GPUs, no training run, no $100B data center, just a brain smaller than a grain of salt. 1 fly gives you 3 pilots, and 1,000 flies give you a swarm. The fly is dead, but its brain just got a squadron.

Spike 1% @SpikeCalls

2 weeks ago

166,700 fruit fly neurons are flying a drone around my bedroom. 1 camera watches my open hand and that's the whole input. The panel in the middle is the brain running live 166,700 neurons, 25 million connections, the full reconstructed map of a fruit fly's head. Camera reads

52 377 3K 1.0M 2K

Anthropic just dropped a 13-page PDF on Agent Memory - 5 layers that cut token cost 90% and make your agent actually learn: here's the 5-layer memory architecture: layer 1 → working memory - the context window. everything the agent sees right now. when it fills up, old context dies. most agents stop here and wonder why they're broken layer 2 → episodic memory - what happened. full interaction logs with timestamps. the agent recalls that the deploy failed Tuesday at 3am because the migration script had a typo layer 3 → semantic memory - what is true. facts, entities, relationships stored as a knowledge graph. "user prefers TypeScript" lives here. doesn't expire when the session ends layer 4 → procedural memory - how to do things. the agent tried 3 approaches, one worked. that method becomes a reusable skill. next time it skips straight to what worked layer 5 → forgetting - what to delete. an agent that never forgets accumulates contradictions. old preferences override new ones. the user moved cities but the agent still recommends restaurants in the old one the result: Mem0 stores 1,800 tokens per query instead of 26,000. Snowflake added one ontology layer - 20% better accuracy, 39% fewer tool calls. memory pays for itself on day one this 13-page PDF is what separates a chatbot from an agent that actually learns don't scroll past this one ↓

chuplung @choopyplug1

2 months ago

x.com/i/article/2088…

25 106 546 1.3M 2K

One of the most important programming languages of the future may be C. Not C++. Not Python. Not the latest high-level web language. C. In the era of AI-generated software, we may no longer need to pay as much of the abstraction and runtime cost that comes with languages designed primarily for human productivity. If AI can reliably generate, analyze, test, and maintain lower-level code, the economics change. C suddenly becomes very interesting again.

Oxford researchers argue that LLMs can never invent anything. It is mathematically impossible. They published a paper called “Theory Is All You Need" and it argues against the claim that computational models can generate genuine novelty or new knowledge. They analyzed the limits of generative ai, and the results are a brutal reality check for the idea that ai will replace human decision making under uncertainty. Here is why AI is stuck and human cognition wins: backward-looking vs forward-looking.. llms are probability machines that look backward at existing data. human cognition is forward-looking and capable of generating genuine novelty. human cognition operates theoretically "top-down" rather than "bottom-up" from data. the "data-belief asymmetry".. the researchers use the invention of "heavier-than-air flight" to illustrate this concept. an ai relies on data-based prediction, which is largely imitative. humans, however, use theory-based causal logic that allows them to hold beliefs that go beyond existing data. the intervention gap.. humans don't just process information; we use theory to practically "intervene" in the world. we engage in directed experimentation to generate entirely new data. ai-based models are theory-free and place primacy on existing data and prediction. tldr? AI uses a probability-based approach to knowledge and ia largely imitative. It can process data and make predictions, but human cognition relies on theory-based causal reasoning. The decades-old analogy comparing human minds and computers to mere "input-output" devices is fundamentally flawed.

A Stanford professor took two average stocks, rebalanced them daily, and turned $100,000 into $7 million without predicting a single price. Bookmark & watch today, no matter what.

The next #OWASP London Chapter meetup [IN-PERSON] will take place on September 28th 2026 at 6pm. Talks from Chris Holman and @glynwintle This event is kindly hosted by #CivoTechJunction and kindly sponsored by @AikidoSecurity Register to attend here: 👇 eventbrite.co.uk/e/owasp-london…

Next #OWASPLondon meetup - Sep 28th 👇

OWASP London @OWASPLondon

3 weeks ago

The next #OWASP London Chapter meetup [IN-PERSON] will take place on September 28th 2026 at 6pm. Talks from Chris Holman and @glynwintle This event is kindly hosted by #CivoTechJunction and kindly sponsored by @AikidoSecurity Register to attend here: 👇 eventbrite.co.uk/e/owasp-london…

0 5 8 2K 1

If you aren't burning through a frontier model account or two weekly on recon, code review, and vuln research, go easy on the sweeping claims about AI in security. The people who know where the line sits can name both sides: the injection sink it caught, and the CVE it invented. Push hard. Then criticize.