impulsive (@weezerOSINT)

Pinned post

I just reverse engineered the YellowKey BitLocker bypass

Microsoft shipped code that checks for a flag called "FailRelock" in every Windows 11 recovery image. When it's set to 1, after recovery unlocks your BitLocker drive, it never relocks it. All you need is a USB stick.

This code only exists in the recovery environment. Not in normal Windows. They left an entire debug testing framework in production.

impulsive Verified account @weezerOSINT May 12

The userland demon is about to drop again.

View quoted post on X

impulsive @weezerOSINT 4h

do we have polymarket odds of the divorce yet?

impulsive @weezerOSINT 9h

Who’s got the bigger cheating scandal this year?

Ethan Klein 8
Jensen Huang 21

impulsive @weezerOSINT 20h

- 2025: DOGE kids (Kliger, Farritor, Elez, Stein) get detailed across agencies with broad access.
- Feb 6 2025: Elez resigns after racist posts surface. Had write access to Treasury payments. He is rehired after.
- Feb 27 2026: Trump tells agencies to drop Anthropic. Hegseth blacklists them.
- Mar 6 2026: Kliger made Pentagon Chief Data Officer days later.
- Apr 2026: All four leave government.
- May/Jun 2026: Cathedral founded in stealth.
- Jul 22 2026: Their new company Cathedral raises $160M at $1.4B valuation.
- Before Oct 26: Cathedral AI agents reach Anthropic internals via third-party software. Access cut same day.
- Oct 26: Washington Post runs the story.
- Nov 7: Anthropic emails customers calling it unauthorized access. Company certified it deleted the data.

So the same DOGE kids who was involved in getting Anthropic blacklisted, later on found a company then instantly get funded and breach Anthropic.
The only proof the data is gone is a written certification from a company that didn’t exist a year ago.

impulsive Verified account @weezerOSINT 1d

This security company cathedral basically breached Anthropic saved customer PII (idk why) and then gave a pinky promise that they deleted it? am i misunderstanding something here?
View quoted post on X

impulsive @weezerOSINT 1d

This security company cathedral basically breached Anthropic saved customer PII (idk why) and then gave a pinky promise that they deleted it? am i misunderstanding something here?

Jamieson O'Reilly Verified account @theonejvo 2d

What actual f*ck @DarioAmodei / @boris / @TheAmolAvasare

Let me get this straight - I get this email telling me:

1. A cybersecurity "research" company gets into your internal systems while... *checks notes*

"conducting a security testing exercise on its own initiative and without our authorisation"

2. You "cannot confirm whether any particular person’s information was viewed," then in the same email say "we have no reason to believe you are at heightened risk."

3. You also try to reassure by saying "the cybersecurity firm has certified in writing that it has deleted the accessed data and will not use it."

Translation - they pinky promised they deleted everything they gained unauthorised access to.

I've been hacking companies for 15+ years, so let me spell it out.

Accessing systems without authorisation has a name -hacking. Calling it a "security testing exercise" doesn't change that.

Honestly, the access itself doesn't bother me much. The irony does.

I’ve spent over $50k on API credits in the last six months and contributing to CVP by accepting logging.

On top of that, I've reached out to your teams to collaborate on security research (actual research - not the kind that has you send out privacy notices to your customers) and heard nothing.

I'm getting deeply unserious security vibes and considering moving all my (and my clients) token spend to @OpenAI if I don't see material change here.

View quoted post on X

impulsive

Latest posts 5