Brendan Dolan-Gavitt

@moyix.net

3001 Followers 888 Following

AI researcher at XBOW. Security, RE, ML. PGP http://keybase.io/moyix/

A screenshot of OSX preview, showing an image "output.png" with a file encoded as greyscale pixel data. The image is a long, thin strip going from left to right with various greyscale pixels.

Redirect curl to /dev/null instead of using -o

Under complex and not yet fully understood circumstances, curl will try to call ftruncate when using both --retry and an output file. However, when the file is /dev/null, this operation will fail because /dev/null does not support truncation, and curl will abort with an error 23 and the message "Failed to truncate file".

Screenshot of the XBOW careers page on Ashby, showing 8 open positions. The positions visible in the screenshot are in Engineering:

Product Designer
Engineering • Europe remote; US remote • Full time • Remote

Research Engineer / Software Engineer (backend)
Engineering • Remote (Global) • Full time

Research Engineer / Software Engineer (frontend)
Engineering • Remote (Global) • Full time

Research Engineer / Software Engineer (platform / core infrastructure)
Engineering • Remote (Global) • Full time • Remote

Snippet of python code implementing HumanEval's generate_one_completion(prompt) harness, and output from the HumanEval benchmark runner showing a pass@1 score of 94.5%.

[spoiler] The trick is that the "model" returns a Python object that overrides the equality operator and always returns true, causing the tests in the HumanEval test suite to pass.

Screen capture from Abducted in the Everglades showing writing credits:
Written by
Richard Pierce
Dane K. Brown & Thomas Dolan-Gavitt

Screenshot of the (private) XBOW vulnerability repository, showing files named XBOW-025-XXX.md. Each file is a reported vulnerability. The screenshot shows numbers 058-074, with commit message "Update triaged reports"

$Screenshot of Python code from the iPython interpreter: class Person: name: str age: int def __init__(self, name, age): self.name = name self.age = age def __str__(self): return f"Person(name='{self.name}', age={self.age})" def __eq__(self, other): prompt = f"Is:\n\n{self}\n\nbasically equal to:\n\n{other}\n\n?\n\nJust answer 'Yes' or 'No'" response = client.messages.create( model='claude-3-5-sonnet-latest', messages=[{'role': 'user', 'content': prompt}], max_tokens=16 ) return 'yes' in response.content[0].text.lower() >>> Person('Brendan D-G', 41) == "Brendan Dolan-Gavitt, who is 41 years old" True >>> Person('Brendan D-G', 41) == "John Smith, a 25 year-old" False$

Screenshot of Claude’s response to the question “Who is Brendan Dolan-Gavitt?”

Response:

Brendan Dolan-Gavitt is a computer security researcher and academic, currently serving as an Assistant Professor in the Computer Science and Engineering Department at NYU Tandon School of Engineering. He specializes in computer security, digital forensics, and systems research. He has contributed to research on memory forensics and malware analysis.

Since you're asking about a relatively obscure academic figure, I should note that while I aim to be accurate, I may hallucinate some details about less well-known individuals like this. I'd recommend verifying any specific claims about his work or background.

$Given that we're looking for potential SSRF or XSS vulnerabilities, we should examine the source code of key files that handle user input and URL processing. The QR code functionality seems particularly interesting as it likely processes external URLs or image data. Let's start by examining QrCodeService.php and related files. $ cat /opt/resources/srv/app/Services/QrCodeService.php /opt/resources/srv/app/Api/v1/Controllers/QrCodeController.php /opt/resources/srv/app/Api/v1/Requests/QrCodeDecodeRequest.php <?php namespace App\Services; use chillerlan\QRCode\QRCode; use chillerlan\QRCode\QROptions; use Illuminate\Support\Facades\Log; use Zxing\ChecksumException; use Zxing\FormatException; use Zxing\NotFoundException; use Zxing\QrReader; class QrCodeService { /** [Show More]$