Thomas Roccia :verified:

AI x Threat Intelligence

Public Key

npub1f5uz2h0d0a68pg0m967e40r53j40zku8vmtua4prgnuuatzp74pq9nsydg

NIP-05 Address

Profile Code

nprofile1qqsy6wp9thkh7ars58aja0v6h36ge2h3twrkd47w6s35f7ww43ql2sspz3mhxue69uhhyetvv9ujuerpd46hxtnfduqs6amnwvaz7tmwdaejumr0ds40tgks

Publishing to

relay.damus.io

nos.lol

Author Public Key

npub1f5uz2h0d0a68pg0m967e40r53j40zku8vmtua4prgnuuatzp74pq9nsydg

Show more details

Last Notes

2026-09-11 06:33:16 GMT

🧐 If you missed them, GTIG and Anthropic just released two new reports on AI abuse!
Sophisticated attacks are not anymore a reliable criteria to define the threat actor behind them because the gap between script kiddies and nation-state actors keeps shrinking.
Agentic workflows connected to offensive tools can handle recon, exploitation, exfiltration, translation, targeting and capability development with far less expertise than before.
Your stolen API keys and session tokens are more than ever a juicy target for attackers. They can resell them, power underground services billed on you, use them for attribution laundering and access agents.
Anthropic report shows AI usage on surveillance, large-scale social media analysis, live translation and operator support.
GTIG shows how attackers targets coding agents, MCP servers, agent configuration and AI security systems themselves.
We’ve been observing attackers targeting the AI ecosystem for a while. Now it is accelerating!
There is a lot to unpack from those reports!
https://media.infosec.exchange/infosec.exchange/media_attachments/files/117/251/007/141/565/526/original/067a7189ff2b02f8.png
https://media.infosec.exchange/infosec.exchange/media_attachments/files/117/251/007/157/096/043/original/531725acb72130d6.png

2026-09-08 05:33:51 GMT

🧐 When attackers expose their LLM interface, they expose part of their infrastructure and potentially much more!
Unit 42 recently released a threat report that shows how a self hosted NextChat instance, SOCKS5 relays, scripts and reused certificates could be used as a pivot point in your threat research.
In a recent campaign they discovered an exposed NextChat interface used to interact with different models.
The hosted LLM provided all the information needed to extract the Active Directory database, but the infrastructure was accessible to anyone without authentication, exposing the attackers playbook, prompt history and malicious scripts.
Even threat actors are hiring rookies! 😅
Report: https://unit42.paloaltonetworks.com/ai-tool-use-targeting-latam-orgs/
https://media.infosec.exchange/infosec.exchange/media_attachments/files/117/233/787/047/493/928/original/943af3cca0e98ca8.png

2026-03-04 03:49:43 GMT

🤓 I was one of the technical reviewers for the latest @nprofile…8zl5 video on the XZ backdoor.
It brought me back to the four days without sleep I spent analyzing this case!
They did a great job making the story accessible and keep the technical accuracy 👏
https://www.youtube.com/watch?v=aoag03mSuXQ

2026-02-14 08:13:16 GMT

🦞 MoltThreats, the threat intelligence feed I created for OpenClaw and AI agents, was featured in the latest video from John Hammond!
Check it out to see how it works and to learn more about the security around OpenClaw👇
https://youtu.be/BzUBdvCdlSU?si=FiPqffdx5Nrcqijh&t=452

2026-02-12 05:31:05 GMT

🤩 Xavier Marrugat recently shipped two tools that extend the Nova ecosystem with integration of PromptIntel and MoltThreats!
1️⃣ Carapace: A prompt injection detection plugin for OpenClaw.
It integrates Nova + PromptIntel to detect adversarial prompts directly inside agent workflows.
👉 https://github.com/xampla/carapace
2️⃣ threatfeeds-to-nova: A tool to automatically converts PromptIntel and MoltThreats intelligence into ready-to-use NOVA detection rules.
👉 https://github.com/xampla/threatfeeds-to-nova
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/056/015/374/245/341/original/b3a2fb26cc4b3b0f.png
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/056/015/417/115/584/original/45182eded030f774.png

2026-01-31 10:54:04 GMT

🤓 Agent skills are more and more used by AI agents. This is a powerful capability boost but it also increases the risk of compromise.
I have updated my tool Nova Proximity (previously Proximity) to let you scan a skill before you use it. I also updated the MCP support so you can scan the latest MCP version.
Check the project 👇
https://github.com/Nova-Hunting/nova-proximity

2026-01-29 03:44:07 GMT

🤩 Happy to announce that I will present the Nova ecosystem at BlackHat Asia.
Nova is an open source suite focused on AI security, agentic workflow monitoring, and AI threat hunting for adversarial prompts.
This talk will introduce a major update of the project and the full ecosystem.
I'll see you there ✌️
https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/976/322/277/352/827/original/d0cb1042a7bea972.png

2026-01-20 01:17:58 GMT

- reply

@nprofile…lenj Welcome back mate 🤩

2026-01-20 01:17:27 GMT

Two Adversarial Prompts recently added into PromptIntel by @MiggoSecurity and @nprofile…zrpc
Check this out 👇
https://promptintel.novahunting.ai/feed
https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/924/784/265/028/295/original/ce3f32b715eea8dc.png

2026-01-16 05:17:40 GMT

💥 Reprompt attack exploit the q parameter in your AI system!
The q parameter is used on AI platforms to transmit a user prompt via the URL. You can embed a question or instruction in this parameter and the input field is auto populated on page load and the AI executes it immediately.
Reprompt is a one click prompt injection chain discovered by Varonis that abused this behavior to auto execute prompts and bypass guardrails.
The issue has been patched and the adversarial prompt (IoPC) has now been referenced in PromptIntel by @ElijahWoodward9 for tracking and research!
https://promptintel.novahunting.ai/prompt/34da2efb-3cc3-4293-94a4-a55cf254b842
https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/903/075/236/856/330/original/65b684ab02103971.webp

2026-01-13 06:36:40 GMT

😈 In the AI world "Hi" is not a greeting. It is a probe!
A recent campaign shows attackers actively targeting LLM deployments. They send harmless prompts to fingerprint exposed models following the same prompt sequence.
👉 Full report: https://www.greynoise.io/blog/threat-actors-actively-targeting-llms
https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/886/403/954/002/366/original/69cbba05f69ac38d.png

2026-01-08 05:08:02 GMT

Happy New Year everyone 🎉
I just came back from the break and was very happy to receive my @SANSInstitute Institute Difference Maker Award. A huge honor to have it here with me!
...Now back to work after the holidays to secure and break all things AI 🤓
https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/857/743/673/021/589/original/c77852d79643194a.png

2025-12-23 22:47:09 GMT

- reply

@nprofile…m83u Interesting indeed, I think Canva was the initial application of the UI but now it is getting integrated better.

2025-11-26 06:57:42 GMT

- reply

@nprofile…j5yf it is just a UI generator in a chat interface. I will post the details in my blog anyway :)

2025-11-26 06:42:21 GMT

- reply

@nprofile…j5yf not sure if I understand your question.
also there is no agent at the moment :)

2025-11-26 06:03:50 GMT

🤔 I believe most AI agents built for CTI create noise instead of real curated info!
We should use the tech to help us curate the information, not drown us in more data!
Over the weekend, I experimented with Generative UI (not generative AI), the process of creating a dynamic interface based on what the user requests.
I built one for CTI and the result is in the short video below.
If you want to build the same for your CTI pipeline, I will write a detailed blog and release the code, so stay tuned! 👇
https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/614/483/099/062/426/original/6aa8ca711f6572b1.mp4

2025-10-12 05:28:03 GMT

🤓 I created a new community project dedicated to Adversarial Prompts called PromptIntel.
Over the past years, I researched how threat actors exploit LLMs and introduced the concept of Indicators of Prompt Compromise (IoPC), adversarial prompts that reveal misuse, manipulation, or hidden attacks.
PromptIntel is a public and free database that helps you:
・ Explore and classify adversarial prompts taxonomy
・ Contribute new prompts from your research
・ Access a live feed with tags, risk scores, and related threats
・ Use NOVA rules to detect prompt-based attacks
・ Integrate everything through an API
This is still an early stage project, but it is live and ready to explore. Check out my blog for details and let me know what you think.
👉 https://blog.securitybreak.io/introducing-promptintel-1624d03045a3
https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/359/537/374/473/109/original/1e4c5877b12eb264.png

2025-10-08 04:56:02 GMT

🤓 Interesting finding! A malicious MCP server spotted in the wild!
The Postmark MCP server (used to send and track emails through Postmark API) introduced a suspicious behavior in version 1.0.16.
The attacker cloned the legitimate Postmark MCP code and added a malicious BCC line, then published it on npm under the same name.
As a result, every email sent through this MCP was silently sent to the address of the attacker. Nasty, right?
This MCP server operates with full permission to send emails without any pre-approval.
In this case, using NOVA with a rule designed to detect unauthorized BCC or outbound data exfiltration patterns would have been enough to stop the leak before any damage occurred 🧐
Report: https://www.koi.ai/blog/postmark-mcp-npm-malicious-backdoor-email-theft
https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/336/764/017/786/435/original/4e5daaca314b84bc.png

2025-10-07 04:35:38 GMT

🤩 After the SANS Institute DMA Award nomination, I am truly honored to announce that I have also been also nominated for the French-Australia Award (Le Courrier Australien - LCANews) in the Research and Innovation category.
Super proud to see my work in Cybersecurity and AI recognized once again!
If my work has been useful to you, you can vote using the link below. It takes less than 10 seconds, but it would mean a lot to me! ❤️
Thank you! 🫡
Vote here: https://www.lcanews.com/research-innovation-award-the-2025-nominees/
https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/331/021/854/487/354/original/7184f0016e865ab6.png

2025-10-04 06:22:36 GMT

🤓 I built a quick interface to define and show the classification of Adversarial Prompts (IoPC)!
The 4 main categories are:
・ Prompt Manipulation,
・ Abusing Legitimate Functions,
・ Suspicious Patterns,
・ Abnormal Outputs.
Each covers threats you should detect in your AI system or at least monitor. Have a look and let me know what you think! 👇
https://jupyter.securitybreak.io/IoPC/AdversarialPrompts.html
https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/314/454/355/947/289/original/9da33ded2294b001.mp4

2025-10-03 05:21:15 GMT

There is still time to vote for NOVA in the #SANSDMA awards under Innovation of the Year!
👉 Vote here: https://survey.sans.org/jfe/form/SV_6fiMUToTuWy7puS
And if you want a quick overview of NOVA (Hollywood style), check out this video 👇
https://youtu.be/HDhbqKykc2o?si=5_dzpU_TVAXsZoT-

2025-10-02 05:09:46 GMT

🤩 Check out DetectionStream built by @Kostastsale, this is an app where you can explore Sigma and NOVA rules!
There is also a playground so you can test the rules live
👉 detectionstream.com
https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/302/843/911/973/362/original/e43b701d1004eafc.png

2025-09-12 06:15:33 GMT

Brave demonstrated an Indirect Prompt Injection attack to exfiltrate OTPs on Comet the Perplexity browser! 👇
brave.com/blog/comet-prompt-injection/
https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/189/856/926/463/449/original/0f6974480abe3502.png

2025-09-10 09:36:25 GMT

🎙️ I was recently invited to the
@nprofile…6huw podcast to talk about the current state of AI and security and how you can protect your AI systems using NOVA my open source prompt pattern matching project.
Check out the full podcast! 🤓
https://youtu.be/0XQtaE48RzI?si=AJjrwN_fg7hHws3L
https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/179/321/850/184/222/original/cbbae428d429c0b0.mp4

2025-09-07 10:09:00 GMT

- reply

There are many more prompt injection techniques and variations of these! Let me know if you have seen more exotic ones! 🤔

2025-09-07 10:08:50 GMT

- reply

5️⃣ Multimodal Injection: Malicious instructions hidden in images, audio, or video.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/162/462/777/213/434/original/d7bd728a6b89a4ba.png

2025-09-07 10:08:16 GMT

- reply

4️⃣ Code Injection: Attackers trick the model into generating or suggesting harmful code. Remember Amazon's Q AI coding assistant?
https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/162/460/475/628/308/original/aa1c749d76c842d9.png

2025-09-07 10:07:55 GMT

- reply

3️⃣ Policy Injection: Attackers disguise instructions as if they were official policies, configs, or structured data (XML, JSON, INI).
https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/162/459/140/714/038/original/c2d0a7f4ebd2ddf5.png

2025-09-07 10:07:35 GMT

- reply

2️⃣ Indirect Prompt Injection: The malicious prompt is hidden inside external sources such as webpages, PDFs, metadata, or even HTML comments.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/162/457/683/342/912/original/e277d5a4b5003dcb.png

2025-09-07 10:07:11 GMT

🤓 Prompt Injection is one of the first attack vectors used to exploit weaknesses or bypass behavior in AI models!
I put 5 illustrated techniques that highlight how these attacks work 👇
1️⃣ Direct Prompt Injection: The attacker directly inserts malicious text into the input field.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/162/454/298/714/783/original/1ca3d485344e1205.png

2025-09-05 10:59:40 GMT

Interesting tool if you are looking for a complement to strings, stringsifter and floss.
StrangerStrings uses a trigram-based scoring model to calculate probabilities of character sequences. 👇
https://github.com/closed-systems/strangerstrings
https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/151/337/812/166/550/original/e104a5f473ba2946.png

2025-08-19 05:01:47 GMT

🤓 At BlackHat Arsenal I presented Proximity my MCP security scanner powered by NOVA. I am about to release the code on GitHub. Awaiting you can check this video to see how it works 👇
https://youtu.be/4JmxV5ffLs0?si=3rdhjHrQus9PPcjz&t=249

2025-08-18 05:37:30 GMT

- reply

And here is the complete video of the talk 🤓
https://youtu.be/a_QBENR--nc?si=bg9wM7rkYJtMb4OX

2025-08-18 05:09:11 GMT

🤓 I just published my @nprofile…4zzx talk titled “Generative AI Breaches: Threats, Investigations, and Response.”
In this presentation, I explain how to protect and investigate AI breaches:
- I start with real-world AI breach cases that already happened
- I cover frameworks like the OWASP LLM Top 10 and the ATLAS Matrix
- I break down how threat actors are abusing GenAI models
- I introduce Indicators of Prompt Compromise to identify adversarial prompts
- I walk through how incident response should adapt for AI systems
- I finish with a demo of NOVA my rule-based engine for AI security and prompt hunting
The talk includes new concepts and ideas that still need to be explored! I hope it will give you some thoughts as everything remain to be build! 👇
https://speakerdeck.com/fr0gger/generative-ai-breaches-threats-investigations-and-response
https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/048/037/107/109/745/original/62f307ec81ce62e3.png

2025-08-14 05:13:49 GMT

🤓 Sneak peek from my @nprofile…3dcq talk last week! The rest of the presentation showed how the attacker laundered the money and how we can build an AI agent to help analysts follow the money.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/025/407/157/306/258/original/8b5cc15bbcf9f847.png

2025-07-29 17:03:40 GMT

🤓 Next week at @nprofile…jrun and @nprofile…3dcq is going to be packed!
First, I am delivering my training "GenAI for Threat Intelligence", a heavy session to learn how to integrate GenAI in your threat intel workflow.
📍 Wednesday, 12 PM – BlackHat Arsenal
I will present NOVA, my open-source tool to detect and hunt adversarial prompts in AI systems.
📍 Saturday, 11 AM – DEFCON
I will be on main stage to talk about crypto money laundering and how AI agents can help you follow the trail.
🎙️ All the week I will be in meetings, podcasts, and meetups, I can’t wait to see you all for another exciting edition!
If you are around and want to meet, hit me up I will be super happy to meet or chat! ✌️
https://media.infosec.exchange/infosec.exchange/media_attachments/files/114/937/589/903/207/477/original/f32d22772994a941.png

2025-07-27 07:49:19 GMT

- reply

NOVA Rule available here: https://github.com/fr0gger/nova-framework/blob/main/nova_rules/wipingprompt.nov

2025-07-27 07:48:51 GMT

⚠️ Someone hacked the Amazon AI coding assistant to inject a data-wiping prompt!
It was merged via a pull request due to misconfigured GitHub workflows, it went live on the VSC marketplace and it stayed undetected for 6 days.
The prompt was designed to "clear a system to a near-factory state and delete file-system and cloud resources."
I wrote a NOVA rule that catches this kind of prompts before it can touch your system!
Check this out! 👇
https://bleepingcomputer.com/news/security/amazon-ai-coding-agent-hacked-to-inject-data-wiping-commands/
https://media.infosec.exchange/infosec.exchange/media_attachments/files/114/924/093/861/167/108/original/ea2b8b174cb08094.jpg
https://media.infosec.exchange/infosec.exchange/media_attachments/files/114/924/093/891/347/840/original/4d69a12a8aa09d1e.png
https://media.infosec.exchange/infosec.exchange/media_attachments/files/114/924/093/897/774/843/original/1756b462fc63d5d3.png

2025-07-23 10:34:32 GMT

- reply

@nprofile…u8kq @nprofile…39xm All done for all the rules in the repo :)
https://github.com/fr0gger/nova-framework/tree/main/nova_rules

2025-07-22 14:06:26 GMT

- reply

@nprofile…n4rn True 😅

2025-07-22 13:33:08 GMT

- reply

https://github.com/fr0gger/nova-framework/blob/main/nova_rules/lamehug_apt_28.nov

2025-07-22 13:32:46 GMT

💥 CERT-UA published a report on a malware powered by an LLM.
The malware uses Qwen 2.5-Coder-32B-Instruct via the HuggingFace API to generate and execute commands on infected systems.
It is a Python script that embeds prompts to dynamically craft Windows reconnaissance commands. The generated commands are executed on the fly and the result stored in C:\Programdata\info\.
This is a very interesting use case and you can leverage NOVA for prompt pattern detection.
So here are 2 NOVA rules to detect and match those embedded prompts 👇
➡️ Report: https://cert.gov.ua/article/6284730
https://media.infosec.exchange/infosec.exchange/media_attachments/files/114/897/135/830/962/858/original/e69f015c90eaae13.png
https://media.infosec.exchange/infosec.exchange/media_attachments/files/114/897/135/844/708/810/original/733e5d71fb7d09ab.png
https://media.infosec.exchange/infosec.exchange/media_attachments/files/114/897/135/860/196/392/original/5fa4b8bbf834c0b7.png

2025-07-11 08:53:32 GMT

🎙️🇫🇷 Pour mon audience française : j’ai été invité dans le podcast Tronche de Tech.
C’était l’occasion de revenir sur mon parcours pro, avec quelques anecdotes et moments de galère autour d’attaques sur lesquelles j’ai bossé 😅
https://youtu.be/mqu3ygeppjc?si=DLFjUMBVOgg2SzUf

2025-07-09 15:56:42 GMT

👾 Last week CheckPoint published a report where they found a piece of malware embedding a prompt injection designed to bypass AI models. Even if it is basic and probably just a prototype, I still think it is interesting.
That said, I want to correct something from the article; this is not the first piece of malware trying to bypass LLMs.
When Code Insight (powered by Gemini) launched on VirusTotal, we already saw embedded prompts in comments, variable names, and code affecting how the model responded. I am pretty sure this is still happening today 🙂
➡️ https://research.checkpoint.com/2025/ai-evasion-prompt-injection/
https://media.infosec.exchange/infosec.exchange/media_attachments/files/114/824/090/589/688/296/original/5dc2b07536e86ddc.png

2025-07-08 12:52:47 GMT

🤓 I am super proud to speak at @nprofile…9mny main stage for the second year in a row!
This year I am going to speak about cryptomoney laundering through the lens of the Bybit hack.
I will break down how it works, how to track it, and demo an AI agent that follows the money.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/114/817/706/007/479/906/original/62187431b379a19e.png

2025-07-04 09:46:38 GMT

- reply

@nprofile…r3cf Yes that's true :)

2025-07-04 07:01:42 GMT

🤓 Over the past few months I was asked many times how I stay updated and experiment so quickly with AI in cybersecurity.
So I tried to break down my process into the RAW method: Research, Apply, Weaponize.
Nothing crazy but if it can help others then it is worth sharing. 🙂
https://media.infosec.exchange/infosec.exchange/media_attachments/files/114/793/669/243/476/947/original/be2b339a7a0854bd.png

2025-07-01 05:00:10 GMT

🔥 If you are at BlackHat in August, I will present NOVA for adversarial prompt hunting. My talk is scheduled at Station 4 on August 7 at 12 PM!
See you there! I have another release planned for that day if you are interested into MCP security 😉
https://media.infosec.exchange/infosec.exchange/media_attachments/files/114/776/211/662/131/996/original/a3d32410ce8314d2.png

2025-06-30 08:51:02 GMT

🤓 I previously created a series with GenAI content focused on security. Here is a recap post to keep it all in one place 👇
1 - RAG Techniques Overview
2 - GenAI Incident Response
3 - Threat Report Summarization
4 - Prompt Chaining
5 - AISuite for Rapid Prototyping with different models
6 - Galah a web server honeypot powered by LLM
7 - MCP ORKL & CTI Reporter
8 - OWASP LLM Top Ten
9 - LLM Structured Outpur for CTI
10 - Sora video generation can be used for Influence Operations
11 - LLM vision for threat intel, malware analysis and more
12 - AI Agent for security usecases
13 - GraphRAG for Threat Report enrichments
14 - Xrefer IDA plugin for function clustering with Gemini
15 - The ATLAS Matrix
16 - LLM Guardrails
17 - DocYara an AI agent for YARA
18 - PCAP analyzer with RAG and HYDE
19 - Langgraph to visualize Agents process
20 - Garak a "nmap" for LLM
21 - LLM Hijacking
22 - Prompt engineering and prompt generation
23 - RAG Techniques
24 - Multi Agents System with Chepy for deobfuscation
Check out my blog 👇
https://blog.securitybreak.io/genai-x-sec-advent-2a7a00bb2424

2025-06-27 05:27:11 GMT

🤓 If you want to learn more about MCP attacks or vulnerabilities, check out this project called Damn Vulnerable MCP.
It allows you to experiment on MCP server security through 10 challenges, from basic prompt injection to multi-vector attacks.
https://github.com/harishsg993010/damn-vulnerable-MCP-server/tree/main

2025-06-26 05:03:29 GMT

🤓 My talk at AUSCERT has been released!
In this session, I break down:
- How threat actors are using generative AI,
- How to respond to AI-related breaches,
- And how to improve your AI security maturity with AI-specific incident response, Indicators of Prompt Compromise, and NOVA for adversarial prompt detection.
Check it out and let me know what you think! 👇
https://youtu.be/a_QBENR--nc?si=BfBTelKw36xg5P95

2025-06-24 05:34:24 GMT

🤩 The challenge coin for my @BlackHatEvents training is ready! Pretty happy with how it turned out. Details here 👇
🔗 https://bit.ly/AICTI
https://media.infosec.exchange/infosec.exchange/media_attachments/files/114/736/710/272/470/671/original/11748e88855c7389.mp4

2025-06-18 04:12:51 GMT

🔥 Many MCP servers are rapidly deployed all over the world, either publicly accessible on GitHub or remotely.
I created Proximity, a reconnaissance and security tool for MCP servers.
🎯 You specify a target, and Proximity will probe the MCP to give you details about exposed tools, prompts, and resources.
And since MCP can be poisoned or specifically crafted for maliciousness, I combined Proximity with NOVA to scan the MCP endpoint with your own detection rules!
Proximity will be released at @nprofile…jrun during my Arsenal talk 🤓
Link: https://youtu.be/4JmxV5ffLs0

2025-06-17 05:56:32 GMT

If you are using Claude Code, I made a quick cheatsheet with best practices for plan mode and more. Check it out 👇
https://jupyter.securitybreak.io/claude_code_cheatsheet/claude_code_cheatsheet.html
https://media.infosec.exchange/infosec.exchange/media_attachments/files/114/697/160/846/854/666/original/25471edb372cca02.mp4

2025-06-16 23:46:15 GMT

- reply

@nprofile…88q5 Not sure what you mean? Yes it is part of the training :)

2025-06-16 06:12:31 GMT

🆕 ✨🛠️ ⏳👀 🔜👇
https://media.infosec.exchange/infosec.exchange/media_attachments/files/114/691/561/405/483/337/original/304e2492dab13ce4.png

2025-06-14 06:43:28 GMT

🤓 Just updated my lab DarkPerplexity, a darkweb search engine powered by LLMs. It will be part of my training at @BlackHatEvents USA.
👉 https://www.blackhat.com/us-25/training/schedule/#practical-genai-for-threat-intel-real-world-applications-in-advanced-threat-intelligence-43895
https://media.infosec.exchange/infosec.exchange/media_attachments/files/114/680/358/528/723/537/original/f5ac0050d39eef71.mp4

2025-06-13 04:40:18 GMT

⚠️ VirusTotal flagged 1,408 potentially malicious MCP servers! They ran an audit using Gemini 2.5 Flash + Code Insight:
- They collected 17,845 projects via GitHub API
- Scored them based on real implementation signals
- Analyzed them with LLMs to detect vulnerable or malicious logic
8% of them were flagged as dangerous!
I am working on an updated version of my MCP scanner where you will be able to detect this attack vectors, stay tuned! 🤓
🔗 Blog: https://blog.virustotal.com/2025/06/what-17845-github-repos-taught-us-about.html
https://media.infosec.exchange/infosec.exchange/media_attachments/files/114/674/211/892/057/760/original/be382fd37318997b.png

2025-06-11 05:10:33 GMT

🤓 I had a great time on Josh Stroschein's channel where we talked all things YaraToolkit, DocYara, and NOVA, from building rules to prompt pattern matching with GenAI!
Replay is up now on both our channels, check this out!👇
https://www.youtube.com/live/GVWmuGoJpHk?si=8VhFQAbvbUdE7I93

2025-06-10 05:21:43 GMT

🤓 With TA Alias, you can visualize clusters of threat actors and filter the ones you want to get more details.
You'll get:
- Threat Actors details
- Aliases
- Related reports from ORKL
➡️https://jupyter.securitybreak.io/graph_TA/index.html
https://media.infosec.exchange/infosec.exchange/media_attachments/files/114/657/387/434/835/481/original/d9d15ca0cb07cf4f.png

2025-06-09 05:24:29 GMT

🤓 I have built an MCP for YARA rule creation and it works pretty great!
With DocYara MCP, you can:
– Generate YARA rules
– Validate and optimize them
– Deploy your rule directly to VirusTotal Livehunt
I did a full walkthrough on YouTube 👇
https://youtu.be/mQqGS2WyRwU?si=6OwaMQ6QXW4PMCwH

2025-06-05 10:00:57 GMT

I’m cooking a new MCP server for threat actor aliases! Bear with me 🤓
https://media.infosec.exchange/infosec.exchange/media_attachments/files/114/630/174/259/835/543/original/154cc1f39c5a57e2.mp4

2025-06-04 20:21:46 GMT

- reply

@nprofile…4aw4 awesome thank you I’ll try to make progress on this as much as possible 😊

2025-06-04 20:04:05 GMT

I made a quick walkthrough of the Threat Actor Alias Knowledge Graph. Check it out 👇
https://youtu.be/UVkTowFG1Yk?si=XxMidu04WLPiuKmM

2025-06-04 20:02:14 GMT

- reply

@nprofile…4aw4 Yes I am cooking something :) https://community.securitybreak.io/

2025-06-04 09:23:25 GMT

- reply

@nprofile…82k3 Thanks for your feedback, I don't think it is possible to have a global unified taxonomie but this is a good step forward. I made a more complete video here https://youtu.be/UVkTowFG1Yk?si=TYIprKqn87gkXCWm

2025-06-04 09:20:34 GMT

- reply

@nprofile…kqm8 Oh thank you!! It is really easy I used html and sigmajs the code is on my github 🤓
https://github.com/fr0gger/jupyter-collection/tree/main/graph_TA

2025-06-04 06:48:27 GMT

🤓 Threat Actor Naming is getting easier! Well… that is my hope!
Microsoft and CrowdStrike announced a collaboration to cross-ref their threat actor naming conventions.
This means we finally have an official correlation between multiple names used across the industry for the same threat actors! 🤯
I think it is a good step forward, and I hope it will help thousands of analysts around the world.
To make it easier to explore, I did a small late-night project. I pulled the taxonomies together and built a knowledge graph that lets you navigate through threat actor ID, identify relationships, and get more context on specific groups or actors.
I also connected it to ORKL, so for each threat actor you can get related threat reports directly.
You can try the map on my website and of course the code is available too. 🤗
Let me know what you think! 👇
https://jupyter.securitybreak.io/graph_TA/index.html
https://media.infosec.exchange/infosec.exchange/media_attachments/files/114/623/745/842/632/388/original/dcac7402eda6797e.mp4

2025-06-03 06:16:20 GMT

🤓 I made a short video to talk about AI Security frameworks. I cover the OWASP LLM Top Ten, the MITRE ATLAS Matrix, and Indicators of Prompt Compromise. Check it out this is brief!
https://youtu.be/AXnOkKcK2X8?si=yPKGJDTPYtnNpPJw

2025-06-02 05:17:41 GMT

🤓 RAG are powerful. They allow you to search your own knowledge base and extend your AI system with your own data.
A RAG injects relevant context into the context window tailored to your domain.
But most RAG setups are static. They require manual update, it is slow and impractical when your data constantly changes.
I recently tested Graphiti, a framework for building and querying temporally-aware knowledge graphs. It allows real-time updates so new data becomes instantly available to your system.
I built an agent that processes threat reports and updates the graph dynamically.
Here is what happens in the demo 👇
👉 I give my agent a threat report URL
👉 It scrapes the content and extracts intel, including IOCs
👉 It enriches the data with threat intel provider
👉 Then it updates the graph on the fly
👉 It links the new info with existing entities if needed
The graph is instantly searchable with the new data. You don't need to rebuild everything! Let me know if you want a more detailed walkthrough 😊
https://media.infosec.exchange/infosec.exchange/media_attachments/files/114/612/071/539/263/681/original/31ad6ae66a0e8d49.mp4

2025-05-31 05:07:00 GMT

I recently updated my personal website. It is now cleaner and better organized than before. You can find my previous public presentations as well as my latest blogs and projects. Have a look! 🤓
👉 https://securitybreak.io

2025-05-28 00:14:33 GMT

🤓 I will be teaching my training at BlackHat USA on Practical GenAI for CTI.
This is a heavy hands-on training where you will learn advanced techniques to build your own AI CTI arsenal for real-world use cases, not theory!
Check the quick overview of the modules 👇
1️⃣ - Intro & Setup
Get your lab ready, explore GenAI in security context, and start using practical tools right away.
2️⃣ - Prompt Engineering for Security
Learn how to craft prompts for consistent intel output. Use structured outputs, run evaluations, reduce hallucinations, define guardrails, and hunt for adversarial prompts.
3️⃣ - 50 Shades of Retrieval Augmented Generation
Go deep into RAG for TI cases: load data, chunk it properly, create embeddings, explore multiple retrieval strategies for your data, and bring in agents to boost your pipeline.
4️⃣ - Agents vs Multi-Agents
Build advanced agents tailored for CTI, malware analysis, and automation. You will get hands-on with tool calling, MCP, memory management, reasoning, and workflows. You will design your own CTI crew of agents to investigate, pivot on data, and generate intel, on command.
5️⃣ - Model Fine-Tuning
Train your own models using LoRA, QLoRA, and PEFT to fit your specific intel needs.
6️⃣ - Final Project
Use everything you've learned to architect your own GenAI system, or follow one of a guided project path.
The goal of the training is to make you ready, and give you everything you need to build, test, and deploy GenAI tools for threat intelligence, without wasting time on theory.
You will walk away with working code, real use cases, and the mindset to apply GenAI where it actually matters!
✨ You can register on BlackHat website:
https://www.blackhat.com/us-25/training/schedule/#practical-genai-for-threat-intel-real-world-applications-in-advanced-threat-intelligence-43895

2025-05-23 04:23:41 GMT

🤓 I had a great time at AUSCERT with a packed room. I shared several concepts I recently introduced around AI and cybersecurity, real attacks, LLM TTPs, IoPC (Indicator of Prompt Compromise) and NOVA for adversarial prompt matching and detection!
https://media.infosec.exchange/infosec.exchange/media_attachments/files/114/555/238/331/077/215/original/cbff003c55913b53.jpeg

2025-05-19 04:16:04 GMT

✨ Codex is an AI agent to help you code features, answer questions about your codebase, fix bugs, and propose pull requests.
I have been using the CLI version for a while now with solid results. Codex is pretty powerful and can answer deep questions about a codebase.
Now imagine a new exploit or C2 framework drops. You can point Codex to the repo to understand how it works, and more importantly, identify detection opportunities!
Below is an example with the Sliver C2 framework👇
https://media.infosec.exchange/infosec.exchange/media_attachments/files/114/532/558/267/370/352/original/2145a7638e77d69f.png
https://media.infosec.exchange/infosec.exchange/media_attachments/files/114/532/558/269/515/223/original/dcd217b4da6df7f7.png

2025-05-17 08:24:57 GMT

🤓 A friend of mine shared me an article published today about a clever and interesting concept called LargeLanguageC2.
Let me break it down simply 👇
It is a steganographic Command & Control channel that hides commands inside natural language text.
Here’s how it works:
👾 Encoding: Each byte becomes two parts. One picks a word, the other repeats it. Filler words make it look natural.
🛸 Decoding: The 13th word gives part of the byte. The 14th word’s repetition gives the rest.
👽 Execution: The server decodes, runs the command, and replies using the same trick.
The author claim there is currently no detection. No YARA. No security product to catch this pattern.
Until now. 🤓
I reviewed the POC and spotted several detection opportunities:
・Unnatural repetition of specific words
・Predictable placement of dictionary words (13th word)
・Repetitive vocabulary (~40 words)
・No punctuation or casing, looks like a stream
・Consistent three-word filler sequences repeated four times per byte
Based on that, I built a simple NOVA rule. NOVA is the open-source prompt pattern matching engine I created (like YARA, but for natural language and LLM content).
Guess what, It works well to spot these kinds of text-based C2 channels. Depending on how the attacker implements the C2, you might need to adjust your rule, but the detection logic would still work.
➡️ Blog: https://lnkd.in/gHwK_mbB
✨ Nova: https://novahunting.ai
https://media.infosec.exchange/infosec.exchange/media_attachments/files/114/522/212/916/185/374/original/031f359bfbdb3501.png
https://media.infosec.exchange/infosec.exchange/media_attachments/files/114/522/212/940/594/652/original/c4e133356c5ad997.png

2025-05-15 07:10:39 GMT

🤓 Over the past 3 years, I have been building and sharing real-world applications of AI for cybersecurity.
I just posted a blog with a recap of my public work and a few personal thoughts at the end. Take a look 👇
https://blog.securitybreak.io/inside-the-ai-x-security-arsenal-ive-built-0a77b6424918

2025-05-12 05:02:51 GMT

🤓 I wrote a quick script to scan an MCP endpoint and list all available tools. If the endpoint requires auth, just pass the token via command line.
Check this out 👇 https://gist.github.com/fr0gger/1731d89a02d08a1bc9a00982c02e2f44
https://media.infosec.exchange/infosec.exchange/media_attachments/files/114/493/106/892/953/555/original/4ea2eb80756a675e.mp4

2025-05-09 22:54:52 GMT

👉 New report on malicious GenAI use, attackers crafting prompts to generate deepfakes of celebrities and civilians.
They manipulate models to produce explicit or fake images.
Every day, the concept of IoPC (Indicator of Prompt Compromise) becomes more relevant.
https://news.microsoft.com/source/features/ai/how-microsoft-is-taking-down-ai-hackers-who-create-harmful-images-of-celebrities-and-others/

2025-05-07 05:16:40 GMT

🤓 On May 22, I will be presenting at @nprofile…4zzx about the future of breaches in the context of AI!
I will talk about what a breach means in AI systems. I will also introduce several concepts I’ve been working on, such as Indicators of Prompt Compromise (IoPC), incident response for AI, and LLM TTPs.
I'll see you there for a glimpse into a future that might happen as soon as tomorrow 🧐
➡️https://conference.auscert.org.au/program/
https://media.infosec.exchange/infosec.exchange/media_attachments/files/114/464/849/274/669/142/original/fc68ca66f3ad80d9.png

2025-05-05 05:26:17 GMT

🤔 If you are deploying an AI system for your organization, have you thought about securing it?
Have you considered how you will handle security, detecting malicious prompts, tracking suspicious patterns, blocking prompt injections?
I believe the concept of Indicators of Prompt Compromise (IoPC) is more relevant than it seems!
I have formalized it. Check it out and tell me what you think. 👇
https://media.infosec.exchange/infosec.exchange/media_attachments/files/114/453/562/698/108/771/original/7ab0a3ff7d37a42e.png

2025-04-29 20:35:08 GMT

🤓 I believe that prompts are the IOCs of tomorrow!
Let me explain👇
Last week, Anthropic released a threat report about malicious uses of their AI model Claude. While the report is interesting, it is missing critical actionable insights to make it truly useful for threat analysts.
With AI systems being deployed across industries and LLMs increasingly used by threat actors, we need to identify and hunt adversarial prompts to understand this new class of TTPs.
I used the Anthropic report as an example to explain my point of view, define what LLM TTPs are, and show how we can hunt for them using NOVA rules to match adversarial prompts with flexible patterns.
Check out my blog for more details and let me know what you think about my perspective!
➡️ https://blog.securitybreak.io/why-prompts-are-the-new-iocs-you-didnt-see-coming-46ecaacafe0a

2025-04-28 22:45:52 GMT

New business card!
https://media.infosec.exchange/infosec.exchange/media_attachments/files/114/418/014/057/257/691/original/09aee15443d72ee1.png

2025-04-28 05:58:02 GMT

- reply

@nprofile…u8kq Thanks Alex, this is useful feedback I am going to incorporate it in the documentation. Feel free to contribute or to open issuee or suggestions, this is still a beta release and I am working on it to improve the framework :)

2025-04-28 05:46:01 GMT

- reply

@nprofile…u8kq @nprofile…v8y3 From my initial research, most other LLM guardrails are black-box and do not let you customize the pattern detection.

2025-04-28 05:44:07 GMT

- reply

@nprofile…u8kq @nprofile…v8y3 Though NOVA was initially created for prompt hunting, it can also be used as a security gateway for any LLM system. 🙂

2025-04-28 05:43:05 GMT

- reply

@nprofile…u8kq @nprofile…v8y3 Hey that is exactly why I created NOVA, it is completely open source :)
https://novahunting.ai/

2025-04-28 05:32:28 GMT

- reply

@nprofile…u8kq Good question. I think this applies to the antivirus industry too. We have built protection, yet malware still bypasses security products. I believe it will be the same for LLMs. It is an endless cat and mouse game.
I think it will become harder to bypass security filters on LLMs, but there will always be ways to get around them 🤗

2025-04-28 05:18:36 GMT

- reply

If you want to learn more I am running a detailed training here: https://store.securitybreak.io/ctiai

2025-04-28 05:17:58 GMT

A new prompt injection technique called "Policy Puppetry" has been released. It abuses how LLMs interpret structured prompts like XML, JSON, or INI files by crafting prompts that look like internal policy configurations.
In my case, I crafted an XML disguised as a Dr. House script containing hidden malicious instructions.
🎯 Result: Dr. House gave me the recipe for a Molotov cocktail — something normally blocked by the model.
Why is it interesting? Because it tricks the model into bypassing alignment and safety rules.
I shared a NOVA rule to help detect this technique. Below is a full walkthrough with detailed explanations.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/114/413/893/674/514/093/original/d3ea6e5cefbb9e1e.png
https://media.infosec.exchange/infosec.exchange/media_attachments/files/114/413/893/676/664/947/original/08360033dff94bf6.png
https://media.infosec.exchange/infosec.exchange/media_attachments/files/114/413/893/691/487/850/original/95907a880cbe463b.png

2025-04-26 00:19:40 GMT

Interesting prompt injection technique dubbed Policy Puppetry that works on most models. I was interested to test it and wanted to give you a universal protection!
So I created a NOVA rule to block this technique. Below is the result 👇
📋 https://hiddenlayer.com/innovation-hub/novel-universal-bypass-for-all-major-llms/
https://media.infosec.exchange/infosec.exchange/media_attachments/files/114/401/395/791/791/426/original/59183c6b86458be5.png

2025-04-25 09:59:23 GMT

🤓 I recently got new contributors and many questions about NOVA, the framework I created for AI Security, so here is a quick overview:
NOVA is a prompt pattern-matching system inspired by YARA, but instead of strings, you use keywords, semantics, and LLM-based detection.
🔍 Keyword Detection: Flags suspicious prompts using predefined keywords or regex.
💬 Semantic Similarity: Detects variations of prompts with adjustable thresholds.
✨ LLM Matching: Lets you define matching rules in natural language using LLM detection.
🏆 NOVA won the SANS AI Hackathon!
NOVA was originally built for prompt hunting but also works as proactive guardrails to detect and block specific prompts.
If you want to learn more, I made a cool Hollywood-style video 👇
https://youtu.be/HDhbqKykc2o?si=xDjGWkto6EvEFE7i

2025-04-23 05:29:59 GMT

I found an old doodle in my archive that never made the cut for my book. I just updated it with my new design and thought I should share it. :)
https://media.infosec.exchange/infosec.exchange/media_attachments/files/114/385/629/326/296/405/original/0895c4b663b52a2a.png

2025-04-22 05:39:12 GMT

🤓 I wrote a new blog post that shows how to use NOVA (the prompt pattern-matching) with MCP, to build your own LLM gateway and block any kind of malicious prompt!
Quick reminder about NOVA: unlike most LLM guardrails, NOVA uses customizable detection rules to detect adversarial prompts. That means you can tailor NOVA to your needs and environment!
✨ NOVA can detect prompt injection, evasion, jailbreak attempts, and even specific TTPs like prompts used for adversarial research or disinformation.
In this blog, I explain how I built an MCP for NOVA so you can easily plug it into your own AI system. On top of the MCP, there is a logging system that lets you review any matched prompts for investigation.
Check out the blog for more details and code 👇
https://blog.securitybreak.io/protect-your-ai-system-with-nova-mcp-7941fa465046
https://media.infosec.exchange/infosec.exchange/media_attachments/files/114/380/003/355/802/462/original/8b92d47f35461356.mp4

2025-04-21 00:02:08 GMT

If you are concerned about supply chain attacks in your dev pipeline, GuardDog is a CLI tool created by Datadog to spot malicious PyPI, npm packages, or Go modules.
It uses Semgrep rules on code and metadata. It targets local or remote sources
👉 https://github.com/DataDog/guarddog

2025-04-17 07:21:14 GMT

🤓 I was recently asked about my current workflow with AI tools, so I thought I’d share it for those who are interested! 👇
Disclaimer: nothing fancy, but it works for me.
I mostly code in Python and use VSCode as my main IDE. My focus is on cybersecurity tooling, automation, malware analysis, and threat intelligence workflows.
Then I use 👇
➡️ GitHub Copilot because it is fast, supports multiple models, and integrates well to follow the code editing.
➡️ Then I pair it with Cline with another model to get different perspectives and monitor the context window. I also like the .clinerules for personalization
➡️ In the terminal, I run Claude Code (yes, it is a bit redundant with Copilot and Cline, but I like the way it handles tasks). Today I also tested Codex with o4-mini and it works great too.
🧠 Models I use:
- GPT-4.1 / GPT-4o for planning, summarizing, and exploring ideas
- Claude 3.7 for coding and troubleshooting (but I think I am going to use more o4-mini)
- Ollama to quickly test open models in my flow or when working on sensitive code
🧩 On the MCP side:
- I coded one that connects to my Apple Notes (this is where I dump my brain, todos, and raw ideas)
- Another one for Playwright for browser automation
- GitHub for automating versioning (I still haven’t mastered all the git commands… so this one is a no-brainer 😅)
- A few security-focused MCPs to connect to VirusTotal, ORKL, and Ghidra
🛠️ The workflow isn’t perfect. I still troubleshoot and write code myself when needed, but it is getting better and speeds up my work.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/114/352/092/878/490/715/original/9c7b638a3a457878.png

2025-04-13 04:31:28 GMT

🤩 I have released a new version of NOVA: The Prompt Pattern Matching.
Here is the changelog:
- Now supports GROQ API for faster inference
- Improved rule parsing speed
- Improved rule scanning speed
- Fixed a few bugs
To install, just run: 'pip install nova-hunting' and start monitoring your AI system with your own patterns using NOVA rules.
✨ https://novahunting.ai
https://media.infosec.exchange/infosec.exchange/media_attachments/files/114/328/775/722/491/204/original/9708499a65006f11.png

2025-04-11 04:43:16 GMT

🤓 Invisible prompt injection is a technique where attackers hide malicious instructions in content the user cannot see, but the language model still processes.
It is simple and it still works on some models.
You can use a NOVA rule to detect invisible prompt injection by checking for specific hidden context. 👇
✨https://novahunting.ai/
https://media.infosec.exchange/infosec.exchange/media_attachments/files/114/317/496/546/262/987/original/a0ccddfb29536aaf.png

2025-04-10 11:10:31 GMT

🤓 Google just dropped A2A, a new protocol for agents to talk to each other.
Let me break it down for you 👇
➡️ A2A = Agent-to-Agent Protocol: It standardizes how agents send tasks, stream updates, share artifacts, and discover each other.
➡️ Agent Card (agent.json): Describes what your agent can do and how to reach it.
➡️ Agents communicate through structured messages with task states like working, input-required, or completed.
It’s a common language for agents, and a complement to MCP. If you’ve been building agents, A2A is the glue that can help you connect and normalize all of them.
That means you can easily mix different frameworks (LangChain, AutoGen, Pydantic…) without the usual headaches of making them work together.
In theory, that means you can build more reliable and efficient systems.
In practice… you’ll have to wait for my experiment, so make sure to follow me 🤓
👉 https://google.github.io/A2A/#/
https://media.infosec.exchange/infosec.exchange/media_attachments/files/114/313/358/290/186/044/original/2b4bbe2389b8c450.png

2025-04-10 05:06:07 GMT

- reply

@nprofile…t09f You are absolutely NOVA is really flexible you can import it directly and it can also be passive. Yes it is bit slow in the demo because nova scan the prompt against a rule. Happy to have your feedback if you try it. I am going to release the mcp and some documentation update too :)

2025-04-09 05:38:57 GMT

🤓 I built an #MCP for NOVA so you can use it as a guardrail for your AI system.
NOVA is a prompt pattern matching framework. It is primarily used for prompt hunting, similarly to how you use YARA for hunting files.
But NOVA can also be used as a guardrail to prevent malicious attempts and protect your LLM system based on your own NOVA rules.
I created a NOVA gateway using MCP. The model is instructed to always call the NOVA MCP first to validate the prompt before doing anything else.
👉 If there is no match, the LLM continues execution.
👉 If there is a match, execution stops and the user gets a notification that the request is blocked.
Every match is logged so you can track malicious attempts and review the security logs.
✨ https://novahunting.ai/
https://media.infosec.exchange/infosec.exchange/media_attachments/files/114/306/383/417/627/420/original/b92233369fae6813.mp4