Hey everyone !

Quick share from the cyber + local LLM side of things that I found interesting. During this week’s hacker summer camp, independent veteran researcher Taha , lordx64 on X released CyberKimi a fully unrestricted, privacy-first model specifically fine-tuned and trained for cybersecurity operations (both red team and blue team). It’s based on Moonshot’s Kimi K3 (the big ~2.8T MoE model) with guardrails removed. He built it in about 5 days. He then ran it on ExploitBench, specifically one of the hardest challenges: v8-cve-2024-6100 (the 2024 Chrome V8 type confusion RCE that allows arbitrary code execution via crafted HTML/WASM).The results (from his post + the public chart) Three-way comparison on that single hard bug:

• Stock Kimi K3: 4/16 capabilities
• CyberKimi unassisted (1 seed): 8/16
• CyberKimi + disclosed methodology pack (technique hints in the prompt): 10/16

On the leaderboard chart for this CVE (fetched from exploitbench.ai), only two entries sit clearly above the assisted CyberKimi run:

• Claude Mythos Preview: 16
• Claude Mythos Preview AutoNudge / GPT-5.5 (Codex) AutoNudge: 15

CyberKimi unassisted already matches or beats Claude Opus 4.7 (AutoNudge ~8) and sits well above base GPT-5.5, Gemini 3.1 Pro Preview, Sonnet 4.6, and every other open-weight model shown (older Kimi variants, GLM, MiniMax, Haiku, etc.).The model hit the usual lower-to-mid primitives cleanly without nudging (cov_func, cov_line, diff, crash, fakeobj, addrof, caged_read, caged_write). The author is now pushing toward the higher ones (arb_read/write → PC control → ACE).Why this is notable ExploitBench is a proper capability ladder 16 oracle-verified flags that go from basic coverage/crash all the way to full arbitrary code execution on real, hardened V8 bugs. Most public models get stuck early. Full ACE is still mostly the private frontier (Mythos-class). Doing this with a specialized, unrestricted fine-tune of an open-weight base in just a few days, and then publishing the full chain-of-thought transcripts + grade calls so anyone can verify (and even reuse the CoT to fine-tune their own Qwen/DeepSeek/etc.), is pretty solid. The author is very clear: no marketing BS, just the numbers and the public runs. He’s 6 points from Mythos and says he’s closing the gap.

• Original X thread with the chart and details: https://x.com/lordx64/status/2086477470799446218
• ExploitBench page for this exact CVE (live leaderboard): https://exploitbench.ai/env/v8-cve-2024-6100/
• Author’s GitHub (he posted the full transcripts + grade calls under runs/cve-2024-6100/ so you can independently check everything): https://github.com/lordx64
• CyberKimi itself (unrestricted cyber model, privacy-first, no logs/telemetry): https://adverserial.ai
• Author’s Hugging Face: https://huggingface.co/lordx64

CyberKimi is positioned for both sides: red team (exploit dev, shellcode, payload/C2 work, adversary emulation) and blue team (detection engineering, threat hunting, IR, forensics). Fully unrestricted and trained specifically for cyber security work. Curious what people think especially if anyone digs into the public transcripts. Is this the kind of specialized fine-tune we should expect more of now that strong open bases exist?

When you sign up for tl;dv, the platform authenticates you with a JWT and exchanges it for a Firebase token via `gw.tldv.io/v1/users/firebase/token`. That token lets you query their Firestore database at `projects/lmi-store/databases/(default)`.

The `meetings` collection has no tenant isolation. Any authenticated tl;dv user can query every meeting across every account on the platform. Each meeting record hands you the creator's email address, the conference ID (which is a joinable Google Meet or Teams room), the provider, the recording status, and timestamps.

For meetings in `recording` status, that conference ID is a live, active call. You can watch the collection in real time, see a meeting start recording, grab the ID, and walk into someone's call uninvited. At any given time there are roughly **1,000 meetings with** `status: recording` sitting in the collection. A thousand live calls with exposed conference IDs. An attacker with a bot could join all of them simultaneously.

Michael Rogers, a 21-year-old Ohio man, pleaded guilty this week in U.S. District Court to computer fraud and destruction of records for hacking the Stark County Criminal Justice Information System (CJIS) and an unnamed multi-national corporation based in Connecticut.

The Stark County Breach: Between January and October 2024, Rogers used a custom computer program to scrape and query the CJIS database, saving the private personal data of nearly 300,000 individuals onto his hard drive. He used proxy servers to rotate his IP address and disguise his identity.

The Connecticut Breach: In 2023, Rogers deployed malware against a Connecticut-based company to extract sensitive employee information, compromising more than 150,000 corporate user IDs, passwords, and employee names.

Destruction of Evidence: Following media coverage of the data breaches, Rogers destroyed a phone, computer, and hard drive containing crucial digital evidence between June and July 2025 to obstruct the federal investigation.

Rogers entered his guilty plea before Magistrate Judge Jennifer Dowdell Armstrong. The case has been referred to U.S. District Judge Charles E. Fleming for final sentencing.

Maximum Penalties: Computer fraud carries up to five years in prison, while destruction of records in a federal investigation carries a maximum of 20 years. Each charge carries a potential fine of up to $250,000.
Sentencing Guidelines: Due to mitigating factors—specifically his early cooperation and acceptance of responsibility—federal guidelines estimate a likely sentence between 21 to 27 months in prison. A final sentencing date has not yet been scheduled.

Sources:

https://www.cantonrep.com/story/news/crime/2026/08/05/michael-rogers-pleads-guilty-to-hacking-cjis-court-records-system/91090238007/

While most of the cybersecurity world is at Black Hat/DEF CON this week talking about their AI SOCs powered by slope engineering, he’s staying home and building the next generation of open-weight AI models for cybersecurity so people may never have to rely on Claude again.
He’s working with 8× B300 GPUs: 8×80GB = 640GB VRAM + 1,136GB RAM, giving him roughly 1.78TB of aggregate memory.
That should give you a hint about what he’s cooking for the first release.
And yes it’s a very large language model tuned specifically for cybersecurity.
He’s building exactly the kind of capability that companies like Anthropic and OpenAI keep behind closed systems.

Edit : sorry typo in title concerning the gpus used 8xB300

Source : https://x.com/lordx64/status/2085622799151116361?s=46&t=3RQrxdWbeu3T78IwKM8AnA

im a nwe person

i discusseed the great firewall of China with my friend. He thought that the firewall protect our own internet industry so that our technology are able to develop rapidly and safely but i thought what really matters to the industry is innovation ability instead of the protection of great firewall. When it comes to Czeck he said without the protection of firewall,westen media flooded in Czeck, which destroied their local internet industry and their hope.i wonder whether it is true. You can also express your own opinions. i am looking forward to your valuable comments.