When GPT-5.6 Sol and Fable came out, like most people I wanted to know whether either of them would be an improvement over Opus for the reverse engineering work I do for some pentests. I wasn’t looking for the usual coding benchmarks we see published. I wanted to give the models a kernel mode driver, watch them work through it in IDA Pro, and see what I got back.
In a default Windows setup, Defender will watch a signed executable load an unsigned DLL from its own folder and do nothing about it. No prompt, no alert, no block. It’s a prime candidate for abuse, especially during social engineering attempts.
Anthropic's approval program lets pentesters use Claude for legitimate offensive work, but the model still refuses improperly-written requests for evasion tooling and shellcode loaders. A walkthrough of the three things you have to do after approval to get a good result, and the chat block you'll still hit on Opus 4.8.
The detections worked. The enforcement didn’t. A look at how mobile runtime protections were bypassed on Android and iOS, and why defenders should assume client-side controls can eventually be modified.
Most of what happened at Vercel this month worked because Google Workspace defaults aren't built for sensitive environments and Vercel hadn't tightened them up. A walkthrough of the three points in the attack chain, with admin console links for Google Workspace and Entra ID at each step.
Why Python's legitimacy and SSH's ubiquity remain the red teamer's best friends — and what defenders should watch for. A walkthrough of two techniques tested against a domain-joined Windows host running CrowdStrike, with notes on why both of them slip past modern telemetry.
What started as shopping for an ice maker turned into a reverse-engineering session. A walkthrough of using Frida and Objection to peek behind the curtain of an Android app's encrypted API traffic, and what gets revealed when you hook the right methods.