After ~300,000 messages and an estimated ~3,700 collective hours, someone broke through all 8 levels. However, a universal jailbreak has yet to be found...

We challenged jailbreakers to try to break a prototype version of the system to test its robustness. After thousands of hours of red teaming, not one participant found a reliable jailbreak that extracted detailed information across a set of 10 harmful questions.

Key Learnings: - Deleted secrets live forever in Git history. - The biggest risks aren’t always cutting-edge—they’re often basics - Much of Web3 often runs on Web2 infra - with cryptocurrency sprinkled on top 👉 For the full details, see

🚨 Last month @DaneSherrets and I hacked @virtuals_io, a $4.6B platform for deploying AI agents and their associated cryptocurrency earning a $10,000 bounty. Here’s how we uncovered a major vulnerability that could’ve rewritten how these agents think and behave. 🧵👇

On the MetaMask point. MetaMask is and always has been concerned. I’ve personally been targeted by DPRK since 2017. We have multiple attempts against our team members every single day. We track DPRK carefully because they are the single largest threat to crypto companies. We also track every other crypto threat actors bc DPRK is largest but not the only threat. MM is a massive target with a really crazy diverse attack surface. We literally have to build shit to protect our supply chain, for example. It’s no joke. We don’t rely on luck or education or twitter though. We don’t pray or put our faith in some external unnamed security partner or claim we “take security seriously.” We do the fucking work. Every single moment of every single day. We have fucking hard ass controls and robust separation of concerns and monitoring and detection up and down every single layer of the stack. On devices, in infra, on accounts, wallets, contracts everythjng. We iterate constantly and examine our attack surface, our risks, our failings, and improve it. We have multiple security teams. Countless people who care and spend all day every day learning about the threats, mitigating them, and building systems to detect and prevent them from compromising anything of value. We do this all in-house. We also work with products and security folks across the entire web2 and web3 ecosystem to share intel and lessons and mitigate risk. We do this for our employees, and our users, and our product, and the wider ecosystem. In this adversarial environment there is simply no other way to do it. You will die if you don’t. Maybe people don’t like me. Or my tone of voice. That’s fine. I respect that. I don’t like that HL willfully stood up a system that allows for $2 billion dollars to be exfiltrated in a single transaction with no controls on team member devices and then ignored, laughed, and insulted the people who told them they were at risk of having that $2 billion stolen. Hopefully you can respect that, too.