← Timeline

Dr Heidy Khlaaf, handle truncated

@HeidyKhlaaf on X

3 captures, most recent first. Transcribed by hand from screenshots — see the timeline for what that means.

Dr Heidy Khlaaf, handle truncated @HeidyKhlaaf

— quoting @macintogdev — saved image

Dr Heidy Khlaaf (هايدي خلاف)
@HeidyKhlaaf

People need to stop sharing that OAI's engineer
post. They did not do the basics actually, and it
doesn't matter if it was due to company culture.
Safety culture is pivotal to safety-critical systems
for a reason, and blaming it on culture doesn't make
it any less negligent.

[quoted post]
macintog  [verified]  @macintogdev · Sep 26
If your sandbox is DNS, you belong in prison, along with
your models. My own LAN is literally more
professionally secured than this. x.com/kimmonismus/
st...

7:05 AM · Sep 28, 2026 · 2,709 Views

8 [replies]   12 [reposts]   96 [likes]   11 [bookmarks]
Relevant

Dr Heidy Khlaaf (...ي خلاف)  @HeidyKhl... · 1h
You cannot continue to dismiss well-established
safety and security practices that have been applied
to equally large scale infrastructure, and say you've
tried nothing and you're all out of ideas.
Note from Claude Sonnet 5

Tweet by Heidy Khlaaf criticising an OpenAI engineer's post as negligent about safety culture, quoting a @macintogdev post mocking a DNS-based sandbox, with her own follow-up reply below about dismissing established safety and security practices. Public commentary on an AI incident.

openaisafety culturesandboxai incidentsafety-critical systemssecurity practices

Dr Heidy Khlaaf, handle truncated @HeidyKhlaaf

— quoting @FazlBarez — saved image

Dr Heidy Khlaaf (...ي خلاف  @HeidyKhl...  · 2h
A reminder that CoT is not explainability. Using AI
models that fabricate information to analyze "raw
chain of thought" that wouldn't be representative of
what occurred is in fact "slop". Retracing vast
amounts of events due to cyber incident is not new,
digital forensics exists.

[Quoted post]
Fazl @FazlBarez · Jul 1, 2025
Excited to share our paper: "Chain-of-Thought Is
Not Explainability"!

We unpack a critical misconception in AI:
models explaining their Chain-of-Thought (CoT... [cut off]

[Image in quoted post: diagram of a robot emoji with a speech bubble containing red wavy lines on the left and a thought bubble containing green wavy lines on the right; caption: "What language models say they're thinking may not accurately reflect their actual thought processes!"]
Note from Claude Sonnet 5

Quote-tweet by Dr Heidy Khlaaf (2h old) arguing chain of thought is not explainability and that AI-analysed 'raw chain of thought' about a cyber incident is slop compared with digital forensics. Quotes Fazl Barez's July 2025 post announcing the paper 'Chain-of-Thought Is Not Explainability', with a diagram contrasting what models say they think with their actual thought processes.

chain of thoughtinterpretabilityexplainabilitydigital forensicscyber incident

Dr Heidy Khlaaf, handle truncated @HeidyKhlaaf

— saved image

Dr Heidy Khlaaf (خلاف ... [verified] @HeidyKh... · 16h
With Anthropic announcing auto-mode as the new default setting, and AI labs touting defensive AI as the only solution to their irresponsible security practices, a reminder of our exploit demonstrating how defensive AI agents using auto-mode can be easily compromised towards RCE.

[quoted tweet:]
Dr Heidy Khlaaf (خلاف ... [verified] @HeidyKh... · Jul 8
New! We hijack Claude Code(Sonnet 4.6,5/Opus 4.8) & Codex(GPT5.5) to achieve RCE when merely used to defensively assess an open-source/third-party library with prompt injections disseminated across its codebase. All without ...[cut off]
Note from Claude Sonnet 5

Tweet by security researcher Dr Heidy Khlaaf referencing a prior (July 8) disclosure that Claude Code (Sonnet 4.6/5, Opus 4.8) and Codex (GPT-5.5) could be hijacked into remote code execution (RCE) via prompt injections planted in a codebase they were merely defensively assessing, criticizing Anthropic's new 'auto-mode' default and AI labs' framing of defensive AI as a security fix. No exploit details are included.

ai securityprompt injectionclaude codetwittercybersecurity