This week I moved a lot of things around in my home setup. It didn't take me long, thanks to Claude for that.
I also tested OpenAI's new models and what a slap. It's pretty wild, and it changes the game quite a bit, especially in our field.
Home setup
On my NAS I run Proxmox, and it was starting to get messy. I had a TrueNAS VM with my HDDs for cold data. I had aituhome for Docker stuff like my photos and other things. Aituwork for I'm not even sure what, a few dockers, some blind XSS, some SSRF, and another VM with a lot of RAM for my agents.
It was too much and the setup was getting complicated. I cut it all down to just TrueNAS and one work VM with 40 GB of RAM, enough to actually do things.
It feels good to shrink all that and have a simple, efficient setup. That VM runs all my recon tools, my Claudes, Codex, and it's much easier to find my way around.
Until now most of my agents ran directly on my Mac. It worked, but it wasn't viable. It opened Chromes everywhere, I couldn't do anything else on the side, it ate a lot of resources, and worst of all, when I was traveling I couldn't leave everything running. I needed a solution.
I had built a whole setup with an orchestrator that spins up Claude agents on demand, a really polished thing, nice UI, even an iOS app, top class.
I love doing that kind of thing, spending time on it, only to use it for two days and drop it, but you're probably starting to know me.
So I decided to build the simplest setup possible, with low friction but that works all the time and doesn't need me to keep tinkering with it.
A simple tmux on my VM, that's it, nothing more nothing less. From the Mac I manage all my agents easily with tmux tabs, like I used to but on my VM. And on mobile I just use Termius, SSH into the VM, and everything works perfectly.
All my machines are connected through Tailscale and everything is well segmented. I also have Mullvad directly through Tailscale, so it's super handy to have several IPs and switch location for certain tests.
Basically a setup we could have built back in the 2000s, but that works and always will.
Obviously I'm not safe from yet another urge to build the perfect lab setup, so don't take all this at face value. For now this setup works well and lets me work efficiently from anywhere in the world, and I like that.
Goodbye Claude
As you probably saw a few days ago, GPT 5.6 Sol solved a math problem that had been open for 80 years, and also happened to find a preauth RCE on WordPress ( https://slcyber.io/research-center/exploit-brokers-pay-500000-for-a-wordpress-rce-i-found-one-with-gpt5-6/ ).
It's insane if you think about it for five minutes. A preauth RCE on the most used framework in the world, no plugin, nothing, just a well-written prompt and a 200 dollar subscription.
We live in a fascinating world. So I decided to give it a shot too, and take the subscription to test on my targets. And it didn't take long. In one day I burned through the week's tokens, but I found a good number of vulnerabilities that Opus hadn't found on the same targets, and also managed to prove things I knew existed but couldn't PoC before.
So pleasantly surprised on my end, and I'll keep experimenting with it. That's two 200 dollar subscriptions now, but it pays for itself pretty well.
Motivation
Even though I found the motivation to hunt and look for bugs again, it's still a different job than it was six months ago. We wait for our agents, we point them at leads, we make them build PoCs.
On one side it's super exciting because I've never found so many crits and crazy bugs, and it makes money, no point hiding it. But at the same time, when you find the crit, you don't get that "yes, I'm the one who found it" feeling you used to have. Nor the satisfaction of finding a bug.
I think it must be the same for everyone, and even hash_kitten who found the preauth RCE on WordPress probably didn't think "wow, this is the bug of my life" when before the satisfaction would have been so much sweeter.
And even more so with the new models finding even more things even faster. Might as well make the most of it while we still can, building things, finding bugs, moving forward, all while knowing deep down that in a few years the landscape of this job will be drastically different.
I'm not really worried, no stress. You have to live with your time and know how to reinvent yourself, that's the whole point of entrepreneurship and that's why we do all this in the end, for the freedom to do what we want. We'll find something that excites us elsewhere.
On that note, I'm off to enjoy the beach for a few days while my friends Claude and Codex work for me. Have a great end of the week everyone!
Comments