Peter Stöckli
@ulldma@infosec.exchange
Security Researcher and Software Engineer @GitHubSecurityLab
infosec.exchange
@G33KatWork@infosec.exchange new whale just dropped
Remote
Peter Stöckli
@ulldma@infosec.exchange
Security Researcher and Software Engineer @GitHubSecurityLab@infosec.exchange
0
Followers
0
Following
8
Posts
Joined November 04, 2022
GitHub:
Website:
Posts
Peter Stöckli
@ulldma@infosec.exchange
Security Researcher and Software Engineer @GitHubSecurityLab
infosec.exchange
Replying to
@jpasski@infosec.exchange
@jpasski@infosec.exchange Sounds fair
Peter Stöckli
@ulldma@infosec.exchange
Security Researcher and Software Engineer @GitHubSecurityLab
infosec.exchange
Replying to
@h0ng10@infosec.exchange
@h0ng10@infosec.exchange The real LLM benchmark 😅
Peter Stöckli
@ulldma@infosec.exchange
Security Researcher and Software Engineer @GitHubSecurityLab
infosec.exchange
Replying to
@G33KatWork@infosec.exchange
@G33KatWork@infosec.exchange Grüezi Grüezi
Peter Stöckli
@ulldma@infosec.exchange
Security Researcher and Software Engineer @GitHubSecurityLab
infosec.exchange
Replying to
@ulldma@infosec.exchange
If you want to learn more about our open-source Taskflow Agent, have a look at this blog post where the different stages of an audit run are explained:
https://github.blog/security/how-to-scan-for-vulnerabilities-with-github-security-labs-open-source-ai-powered-framework/
Peter Stöckli
@ulldma@infosec.exchange
Security Researcher and Software Engineer @GitHubSecurityLab
infosec.exchange
Replying to
@ulldma@infosec.exchange
This is not even the first Signal issue Jaro found with the help of our Taskflow Agent: have a look at our advisories page to see the other ones:
https://securitylab.github.com/advisories/
Also noted on Signal’s Security Acknowledgments page:
https://signal.org/security/
Peter Stöckli
@ulldma@infosec.exchange
Security Researcher and Software Engineer @GitHubSecurityLab
infosec.exchange
My colleague @jaras@infosec.exchange recently found that a an Android app with zero permissions could exfiltrate all decrypted Signal attachments (affecting the Android APKs downloaded directly from signal.org). Look at the attack scenario our GitHub Security Lab Taskflow Agent produced. This is what AI-assisted security research looks like:
https://securitylab.github.com/advisories/GHSL-2026-102_Android_SignalApp/
Peter Stöckli
@ulldma@infosec.exchange
Security Researcher and Software Engineer @GitHubSecurityLab
infosec.exchange
Replying to
@hanno@mastodon.social
@hanno Yes, you‘re spot on. And it‘s only going to accelerate.