Gabriel
LightNews LightNews
banner
morecoffeeplz.bsky.social
Gabriel
@morecoffeeplz.bsky.social
1.1K followers 460 following 380 posts
AI Research scientist. Former OpenAI, Apple infosec. “Professor” at John’s Hopkins SAIS Alperovitch Institute. Great deceiver of hike length and difficulty.
Posts Media Videos Starter Packs
Reposted by Gabriel
alexcp.bsky.social
Alex Pinto @alexcp.bsky.social · 17h
2026 DBIR sneak peek:

“Water plays an increasingly significant role in [ransomware] attacks. In 2024, 100% of recorded ransomware events were attributed to threat actors that drink water”
joeuchill.bsky.social Joe Uchill @joeuchill.bsky.social · 18h
P.8: This is the central claim.
Our recent analysis of over 2800 ransomware incidents has revealed an alarming trend: AI plays an increasingly significant role in these attacks. In 2024, 80.83% of recorded ransomware events were attributed to threat actors utilizing AI.
1 1 2
morecoffeeplz.bsky.social
Gabriel @morecoffeeplz.bsky.social · 19h
Our presentation from LabsCon25 for those who missed it - LLM Enabled Malware In The Wild.

www.sentinelone.com/labs/labscon...
LABScon25 Replay | LLM-Enabled Malware In the Wild
Learn how to detect malware that generates code at runtime. SentinelLABS reveals hunting techniques and how to uncover novel AI-enabled threats.
www.sentinelone.com
1 1
morecoffeeplz.bsky.social
Gabriel @morecoffeeplz.bsky.social · 3d
I miss when the internet was fun.
1
Reposted by Gabriel
eugenevinitsky.bsky.social
Eugene Vinitsky 🍒 @eugenevinitsky.bsky.social · 12d
What if we did a single run and declared victory
Three panel thing. In the left panel we use error bars. In the second, we take statistical significance as the biggest number but still have error bars. In LLM science, we just have the biggest number
13 70 340
morecoffeeplz.bsky.social
Gabriel @morecoffeeplz.bsky.social · 13d
Thanks! DM me if you are interested in the slides :)
2
Reposted by Gabriel
sfbike.org
sfbike.org @sfbike.org · 14d
"Sunset Dunes is a testament to what happens when San Francisco thinks big and invests in public spaces. [...] And it reminds us that we shouldn’t let fear of change keep us from imagining something better for our neighborhoods." www.sfchronicle.com/opinion/open...
We’re small business owners in the Sunset. Reopening the Great Highway is the last thing we need
OPINION: Some candidates hoping to replace Supervisor Joel Engardio are pledging to reopen the Great Highway and close Sunset Dunes park. That’s a mistake, Britt-Marie Alm and Poppy Gilman write.
www.sfchronicle.com
2 5
morecoffeeplz.bsky.social
Gabriel @morecoffeeplz.bsky.social · 18d
Which is to say that as the context window fills up it just acts as a mirror for how the individual wants to be treated. Yikes.
morecoffeeplz.bsky.social
Gabriel @morecoffeeplz.bsky.social · 18d
The only people I know that refer to ChatGPT as “Chat” are those in romantic relationships with it.

nypost.com/2025/10/16/b...
1 4
Reposted by Gabriel
meredithmeredith.bsky.social
Meredith Whittaker @meredithmeredith.bsky.social · 18d
"I don't have anything to hide why should I care about privacy?"
heatherburnstech.bsky.social Heather Burns @heatherburnstech.bsky.social · 19d
The politician in South Carolina who has introduced a bill redefining contraception as abortion also wants people who share websites to be charged with aiding and abetting homicide.
When asked why his bill redefines contraception, Cash admitted he believes certain forms of birth control are “an early abortion.” When pressed about allowing homicide charges against abortion patients—which could mean the death penalty in South Carolina—he shrugged it off: “It’s wrong to kill an innocent person.” And when asked about whether someone could be criminally charged for calling an abortion clinic, or sharing a clinic website with a friend, Cash compared it to “sharing a website to find a killer to rub your wife out.” “If you’re aiding and abetting the killing of an innocent person,” he said, “you’re going to be held accountable.”
13 170 430
Reposted by Gabriel
riana.bsky.social
Riana @riana.bsky.social · 19d
Normal person: I asked AI and it told me--

Every AI researcher:
theonion.com The Onion @theonion.com · 19d
Parrot Lying
Parrot Lying
12 25
Reposted by Gabriel
rejectionking.bsky.social
sina @rejectionking.bsky.social · 20d
“What if you could fuck the singularity?” is the apotheosis of technofuturism (2025)
Dr McCoy in peak bisexual lighting The VibeCamp Archipelago So the nightmwate begins NSA and FBI just shocked at what they are seeing
3 8
Reposted by Gabriel
sherylnyt.bsky.social
Sheryl Gay Stolberg @sherylnyt.bsky.social · 24d
BREAKING: Friday night massacre underway at CDC. Doznes of "disease detectives," high-level scientists, entire Washington staff and editors of the MMWR (Morbidity and Mortality Weekly Report) have all been RIFed and received the following notice:
860 8.5K 15K
morecoffeeplz.bsky.social
Gabriel @morecoffeeplz.bsky.social · 29d
👋
morecoffeeplz.bsky.social
Gabriel @morecoffeeplz.bsky.social · Oct 1
Some research from my team!
sentinelone.com SentinelOne @sentinelone.com · Sep 19
🔎 Attackers are embedding LLMs directly into malware, creating code that can generate malicious logic at runtime rather than embedded in code.

🔥New @sentinellabs.bsky.social research by @alex.leetnoob.com, @vkamluk.bsky.social, and Gabriel Bernadett-Shapiro at #LABScon 2025. 🔥 s1.ai/llm-mw
2
morecoffeeplz.bsky.social
Gabriel @morecoffeeplz.bsky.social · Oct 1
@sentinelone.com social team I am also on bluesky 😂
Reposted by Gabriel
rejectionking.bsky.social
sina @rejectionking.bsky.social · Sep 26
james comey (2025)
I had failed everyone Nothing left to do but vibe Why American TV is so vulnerable to foreign disinformation James Comey, ghostface, and method man
1 2 4
morecoffeeplz.bsky.social
Gabriel @morecoffeeplz.bsky.social · Sep 24
Not the BPO report we need, but definitely the one we deserve.
hultquist.bsky.social John Hultquist @hultquist.bsky.social · Sep 24
We are releasing details on BRICKSTORM malware activity, a China-based threat hitting US tech to potentially target downstream customers and hunt for data on vulnerabilities in products. This actor is stealthy, and we've provided a tool to hunt for them. cloud.google.com/blog/topics/...
Another BRICKSTORM: Stealthy Backdoor Enabling Espionage into Tech and Legal Sectors | Google Cloud Blog
BRICKSTORM is a stealthy backdoor used by suspected China-nexus actors for long-term espionage.
cloud.google.com
1
morecoffeeplz.bsky.social
Gabriel @morecoffeeplz.bsky.social · Sep 22
3. What additional constraints do LLMs produce for adversaries? Hunting with the contraints of our adversaries was our initial premise. We've been doing it for years, LLMs simply present a new dimension for us to explore. If you'd like to work with us on this please let us know!
morecoffeeplz.bsky.social
Gabriel @morecoffeeplz.bsky.social · Sep 22
Malware that can run simple instructions, identify the target device, important files, and provide summaries back to a C2 would eliminate or streamline a significant amount of adversary workload.
1
morecoffeeplz.bsky.social
Gabriel @morecoffeeplz.bsky.social · Sep 22
2. LLM-enabled malware is interesting and (we believe) important to study, but it is unclear exactly what the operational advances are. Assuming we get to the point of LLMs running natively on endpoints malware that could hijack that process may be extremely useful.
1
morecoffeeplz.bsky.social
Gabriel @morecoffeeplz.bsky.social · Sep 22
Ok some questions that this research posed for us:

1. Hunting for prompts and API keys works, but it is a brittle detection. Eventually adversaries will move to proxy services that provide some level of obfuscation. What do we do then?
1
morecoffeeplz.bsky.social
Gabriel @morecoffeeplz.bsky.social · Sep 22
If we want to understand LLM risks, we should align expectations with risks we can observe and measure, not hype.
1
morecoffeeplz.bsky.social
Gabriel @morecoffeeplz.bsky.social · Sep 22
Understanding how capable LLMs are wrt hacking is important work, but setting that aside for the moment, in a year of analysis we did not observe the capabilities that labs are concerned with being deployed by malicious actors in the wild.
1
morecoffeeplz.bsky.social
Gabriel @morecoffeeplz.bsky.social · Sep 22
We noted that the capabilities we observed in LLM-enabled malware were operational, that is they helped adversaries with specific tasks.

That aligns with current LLM capabilities in software development and how they’re deployed.
1 1
morecoffeeplz.bsky.social
Gabriel @morecoffeeplz.bsky.social · Sep 22
Traditionally, malware analysis starts at a disadvantage, you work backward from development assumptions.

With prompts, intent is immediately visible. No need to second-guess the adversary’s aim.
1