Faan Rossouw (@faanross) 's Twitter Profile
Faan Rossouw

@faanross

| threat hunting researcher @ActiveCmeasures + educator @Antisy_Training | building aionsec.ai | panta rhei |

ID: 2001684784377196544

linkhttp://www.faanross.com calendar_today18-12-2025 16:03:51

104 Tweet

46 Takipçi

233 Takip Edilen

Faan Rossouw (@faanross) 's Twitter Profile Photo

I used to give agents really detailed security instructions. Step 1, query this. Step 2, filter that. Step 3, export here. The agent would follow them perfectly. And still miss what I actually needed. The problem: my steps assumed things about the system that weren't quite

ᴅᴀɴɪᴇʟ ᴍɪᴇssʟᴇʀ (@danielmiessler) 's Twitter Profile Photo

Super hyped to announce PAI 2.3!!! A complete rewrite of the PAI system focused around: - USER, WORK, and SYSTEM data isolation - A Continuous Learning system based on hook-based Sentiment gathering - User-based Skill Personalization ...

Faan Rossouw (@faanross) 's Twitter Profile Photo

Your CLAUDE.md is probably too big... My CLAUDE.md file just hit 570 lines. Session startup checks, skill routing tables, notification configs, troubleshooting guides. Everything I'd taught Claude about my workflow, accumulated over weeks. It worked.

Your CLAUDE.md is probably too big...

My CLAUDE.md file just hit 570 lines. Session startup checks, skill routing tables, notification configs, troubleshooting guides. Everything I'd taught Claude about my workflow, accumulated over weeks.

It worked.
Faan Rossouw (@faanross) 's Twitter Profile Photo

I'm building a memory system for my Claude Code conversations - search, analytics, eventually voice queries. The goal is to leverage months of conversation history to work more effectively. For Phase 4 I added semantic search using LanceDB. I wanted to do a friction analysis -

I'm building a memory system for my Claude Code conversations - search, analytics, eventually voice queries. The goal is to leverage months of conversation history to work more effectively.

For Phase 4 I added semantic search using LanceDB. I wanted to do a friction analysis -
Active Countermeasures (@activecmeasures) 's Twitter Profile Photo

Malware doesn't scream; it whispers in a rhythm. Faan Rossouw simulated and analyzed C2 traffic to decode these hidden heartbeats. Recognizing the pattern is how you find the breach. Read here: activecountermeasures.com/malware-of-the…

Faan Rossouw (@faanross) 's Twitter Profile Photo

Join me this Friday for an awesome hands-on 4-hour workshop hosted by Antisyphon Training where we'll be creating a modular command handling system for a C2 system in Golang. It all culminates in implementation of a reflective shellcode loader and popping calc.exe on a hapless

Faan Rossouw (@faanross) 's Twitter Profile Photo

AI coding assistants don't replace you. They change what you do. The effective approach is deliberate partnership. Each side contributes strengths. You bring: - Direction (agent doesn't know what to build) - Judgment (you decide what's right) - Accountability (you own the

AI coding assistants don't replace you. They change what you do.

The effective approach is deliberate partnership. Each side contributes strengths.

You bring:
- Direction (agent doesn't know what to build)
- Judgment (you decide what's right)
- Accountability (you own the
Active Countermeasures (@activecmeasures) 's Twitter Profile Photo

The adversary hides in the encryption you provide. When DNS goes dark, defenders go blind. Faan Rossouw simulated and analyzed the traffic to find the signal. activecountermeasures.com/malware-of-the…

Faan Rossouw (@faanross) 's Twitter Profile Photo

I'm building courses with Claude Code. Had a big idea, outlined it, told Claude to generate everything. Within an hour - dozens of lessons drafted. Then I started reviewing. Found a flaw. Fixed it. Another flaw. Each fix rippled through everything. The whole thing lost shape.

I'm building courses with Claude Code. Had a big idea, outlined it, told Claude to generate everything. Within an hour - dozens of lessons drafted.

Then I started reviewing. Found a flaw. Fixed it. Another flaw. Each fix rippled through everything. The whole thing lost shape.
ᴅᴀɴɪᴇʟ ᴍɪᴇssʟᴇʀ (@danielmiessler) 's Twitter Profile Photo

Just remember: The smarter and more capable your AI gets....with more and more tools, and more and more autonomy, the nastier it'll be when it gets prompt injected.

Just remember: 

The smarter and more capable your AI gets....with more and more tools, and more and more autonomy, the nastier it'll be when it gets prompt injected.
Faan Rossouw (@faanross) 's Twitter Profile Photo

Sharing another little covert channel I finally got around to documenting properly. Combining two ideas - DNS<->HTTPS dynamic transition (inspired by SUNBURST), and Z-flag misuse (inspired by DNS Sandwich). As is the case, built in Go. Z-flag abuse is technically a clear RFC

Kevin Xu (@imkevinxu) 's Twitter Profile Photo

Gave Clawdbot access to my portfolio. "Trade this to $1M. Don't make mistakes" 25 strategies. 3,000+ reports. 12 new algos. It scanned every X post. Charted every technical. Traded 24/7. It lost everything. But boy was it beautiful.

Gave Clawdbot access to my portfolio.

"Trade this to $1M. Don't make mistakes"

25 strategies. 3,000+ reports. 12 new algos.

It scanned every X post. Charted every technical. Traded 24/7.

It lost everything.
But boy was it beautiful.
Faan Rossouw (@faanross) 's Twitter Profile Photo

I've been speedrunning Jevon's Paradox in my own life these past few weeks... Claude Code + Obsidian have massively expanded what I thought was possible. When the cost of execution drops by an order of magnitude - the filter breaks. Your sense of what's "within reach" expands

I've been speedrunning Jevon's Paradox in my own life these past few weeks...

Claude Code + Obsidian have massively expanded what I thought was possible.  When the cost of execution drops by an order of magnitude - the filter breaks. Your sense of what's "within reach" expands
Faan Rossouw (@faanross) 's Twitter Profile Photo

Claude Code wants to run: rm -rf ./logs/ Allow? (y/n) Claude Code wants to run: ls -la Allow? (y/n) Permission requests can either save you from certain doom, or be a constant source of superfluous friction - it all depends on context. Needless to say - it's a non-negotiable

Claude Code wants to run: rm -rf ./logs/

Allow? (y/n)

Claude Code wants to run: ls -la

Allow? (y/n)

Permission requests can either save you from certain doom, or be a constant source of superfluous friction - it all depends on context.

Needless to say - it's a non-negotiable
Faan Rossouw (@faanross) 's Twitter Profile Photo

I asked Claude to build a Zeek parser so I can harmonize logs forwarded by Filebeat to a universal schema for my receptor. My prompt spec said: `Map id.orig_h→src_ip` Claude built it. But before moving on I ran a unit test using actual Zeek data. The test failed: ```

I asked Claude to build a Zeek parser so I can harmonize logs forwarded by Filebeat to a universal schema for my receptor.

My prompt spec said:

`Map id.orig_h→src_ip`

Claude built it.

But before moving on I ran a unit test using actual Zeek data.

The test failed:
```