Teri Radichel
@teriradichel.bsky.social
2nd Sight Lab. Cloud, AI Assisted Pentesting. Security and Technology Research. AWS Security Hero . Author on Amazon. . Burp Champion. Former IANS, SANS faculty. GSE. Masters Software & Infosec.
Hanging out with my fellow AWS heroes from around the world this week! builder.aws.com/community/he...
Heroes | Community | AWS Builder Center
AWS Heroes are technical experts building innovative solutions on AWS. They make a valuable impact in the community through their enthusiasm for sharing their knowledge and expertise with builders glo...
builder.aws.com
Chinese Threat Actor Uses Leaked DarkSword Kit to Deploy GHOSTBLADE on iOS …threat actor running more than 100 web properties, most of which are fake Amazon Web Services (AWS) sign-in pages on a domain that also hosts the exploit toolkit. thehackernews.com/2026/08/chin...
Chinese Threat Actor Uses Leaked DarkSword Kit to Deploy GHOSTBLADE on iOS
An unknown Chinese threat actor runs leaked DarkSword across 100-plus web properties, using fake AWS and Apple logins to deploy GHOSTBLADE on iOS.
thehackernews.com
Since when did security breaches become marketing campaigns?
5 days ago on X I predicted the package manager involved in OpenAI / Hugging face breach was JFrog. Turned out to be correct. I suggested people should monitor network traffic if using that tool. Monitoring network traffic is how I stopped a breach and got into security. medium.com/cloud-securi...
How network traffic got me into cybersecurity
Also — being paid by a large hosting company to go away after reporting a security incident, and other strange events.
medium.com
SSH Key on a Yubikey ~ Almost Protecting credentials from rogue AI agents and malware on your laptop and how Apple makes it difficult teriradichel.substack.com/p/ssh-key-on...
SSH Key on a Yubikey ~ Almost
Protecting credentials from rogue AI agents and malware on your laptop and how Apple makes it difficult
teriradichel.substack.com
AWS announces aws-bench, an open-source benchmark for AI agents on AWS You can use so many different models in Amazon Bedrock and now AWS has a tool to benchmark them aws.amazon.com/about-aws/wh...
AWS announces aws-bench, an open-source benchmark for AI agents on AWS - AWS
Discover more about what's new at AWS with AWS announces aws-bench, an open-source benchmark for AI agents on AWS
aws.amazon.com
Revisiting the Bastion Host In Light of AI Agent Escapes A bastion host adds a point of inspection for potential rogue traffic teriradichel.substack.com/p/revisiting...
Revisiting the Bastion Host In Light of AI Agent Escapes
A bastion host adds a point of inspection for potential rogue traffic
teriradichel.substack.com
I had to take a break from AI development to do some paying work but I have a plan to try to deal with the problems I was experiencing and maybe try some new models. I have a lot more info on X because I haven’t had time to post everywhere and was too long for this platform.
Using gpt terra: deleted time files like Anthropic did. Messed up multithreaded code. Deleted files. Tried to restore from 5 day old backups. Chinese characters in response. github.com/2ndSightLab/...
github.com
This is so awesome and a great reason to use Kiro CLI (@kirodotdev Kiro.dev) Now you can select from Anthropic and OpenAI models in Kiro. Just type /model and select the model to use. I use to compare different models on same prompt. AWS Wishlist item granted! Thank you 🧡
Kiro: Move beyond AI coding to agentic engineering
Kiro helps developers and teams do their best work: turn prompts into executable specs, validate code correctness to find bugs unit tests miss, and build across large codebases with parallel agents th...
kiro.dev
Before you have a heart attack, the number on your AWS billing console is a bug. Monitor the AWS health dashboard for updates. health.aws.amazon.com/health/status
I’m moving over posts from my old blog to new as I need them or as time allows, but they will be paid subscriber only. Subscribers get access to all the archives. The more paid subscribers I have the faster I’ll get it done. For now old and new blogs are still in two different places.
No time to blog but here's this: Visual ~ can write scripts to deploy resources on AWS with any method I want including an agent without giving access to deployment mechanisms. Can rearrange my org structure, rename, move things around.
Multi-threaded programming is hard. I would say AI 🤖 models are bad at it based on how long this took and I had to figure out how to solve some of the core blockers myself, but …see any other social media platform where I can write more in a single post for key insights. No time.
Tracker diagram works. Now I can deploy in parallel and see what got deployed or failed. And I can rearrange and redeploy. More than this deployed but I deleted my tracker file and started over to methodically fix bugs. Models painfully slow and dense but faster than me alone.
How AI 🤖 models could burn less tokens. 💰 some things I’ve seen repeatedly from the start. infosec.exchange/@teriradiche...
Teri Radichel (@teriradichel@infosec.exchange)
A few core things that would help AI 🤖 models burn less tokens. 💰 Yesterday was all manual. The agents were just pounding on some things and not fixing certain bugs so I turned it off and dug into th...
infosec.exchange
Teri Radichel@teriradichel.bsky.social · last mo.Managing an AWS Organization With AI Generated Code A new take on the AWS Control Tower concept teriradichel.substack.com/p/managing-a...
🥲 Today felt like a waste of time mostly. The models were so slow and made so many mistakes I had to walk them through every little thing. Though the ability to rearrange and get a diagram of your AWS Org and everything in it is pretty cool. Almost. Today’s pain… infosec.exchange/@teriradiche...
Teri Radichel (@teriradichel@infosec.exchange)
🥲 Today felt like a waste of time mostly. The models were so slow and made so many mistakes I had to walk them through every little thing. They reverted bug fixes I made manually. Another $200 burne...
infosec.exchange
File this under good things to track in your AI metrics - as long as humans are creating the bugs and verifying they are legit.
Teri Radichel@teriradichel.bsky.social · 4w ago1123 bugs fixed this week. 🐞🐛🐜🦟🪲🪳🕷️ By My AI agents. 🤖🤖🤖🤖🤖🤖🤖🤖🤖 But Kiro/Anthropic going so S-L-O-W 🥱 right now. The bug counts will not move as fast as a result. Opus 4.8. Kiro CLI. infosec.exchange/@teriradiche...
More to come on the blog when time allows. Hope the agents have all the bugs fixed by the time I’m back from running errands. Blog: ✍️👩💻🤖🔒 teriradichel.substack.com
Teri Radichel :: Security and Technology Research | Substack
Security, AI and Software Research. Click to read Teri Radichel :: Security and Technology Research, a Substack publication. Launched 5 months ago.
teriradichel.substack.com
1123 bugs fixed this week. 🐞🐛🐜🦟🪲🪳🕷️ By My AI agents. 🤖🤖🤖🤖🤖🤖🤖🤖🤖 But Kiro/Anthropic going so S-L-O-W 🥱 right now. The bug counts will not move as fast as a result. Opus 4.8. Kiro CLI. infosec.exchange/@teriradiche...
I wrote about the fake bots following me on social media in some tweets a while back and I tagged Elon Musk. I guess they are finding them finally. I just lost like 200 followers last night. builder.aws.com/content/3EaZ...
Beware of Fake Engagement On Social Media Platforms | AWS Builder Center
Taking a look at how my account and some others may have been targeted by a bot army and what you should look out for on social media platforms.
builder.aws.com
The loudest and most reprimanding voices are not always the most right voices. I’m just over here writing about what I experience when I actually use AI models and reposting other’s empirical evidence, not hot takes, opinions, or other such noise. Choose wisely. Do your own research.
Most cybersecurity workers have been told to conceal a breach report finds. -Cybersecurity Dive www.cybersecuritydive.com/news/data-br...
Most cybersecurity workers have been told to conceal a breach, report finds
Security firm Bitdefender also found that U.S. companies were simultaneously more confident and more strained on cyber defense than foreign peers.
cybersecuritydive.com
It’s July 1st and I’ve used up all the tokens in a $200 plan this month already. So that’s how it’s going. Fable came out. Opus is dumber and slower. Happens every time a new model comes out even when it’s not available yet. Though new version of sonnet came to AWS.
Managing an AWS Organization With AI Generated Code A new take on the AWS Control Tower concept teriradichel.substack.com/p/managing-a...
Managing an AWS Organization With AI Generated Code
A new take on the AWS Control Tower concept
teriradichel.substack.com
Finally. Another blog post. If you’re a subscriber you already got it. More tomorrow.
Although I’m exploring different ways to track AI projects in this GitHub repository the main point is to complete a decent project with a complex architecture (as opposed to a simple script or maintenance nightmare.) github.com/2ndSightLab/...
github.com
I created some VPC Endpoints to keep traffic to AWS services on private networks. I didn’t even create as many as I wanted. As you can see here it is my second highest cost. I shut them down for now. Network layer controls are not the same as application layer controls.
