# thick (blogs) — RSS Amplifier Recent posts from the 1 feeds in the RSS Amplifier directory that cover thick. Page: Feed: --- ## [Brain the Size of a Planet: Are LLMs Thonking too Hard?](https://parsiya.net/blog/llm-thonking/) _2026-06-17 · Hackerman's Hacking Tutorials_ It looks like higher reasoning effort (and even later models) are not always better for triaging security results. I continued Kurt's experiments from Needles and haystacks: Can open-source & flagship models do what Mythos did? with 26 distinct claude-4.6/4.7 and gpt-5.4/5.5 combinations with different context window sizes and reasoning efforts. ## [Harnessing the Wayward Machine-God, 1: Manual Markdown Cleanup Is a Bug](https://parsiya.net/blog/machine-god-1/) _2026-04-21 · Hackerman's Hacking Tutorials_ LLMs regularly ignore my Markdown instructions. As the I part of (A)I , I got tired and created some deterministic automation to format the output to my preferences. I will discuss the problem, our solutions, bugs, lessons learned, and the final product. I am going to try a new format here. This blog has the important stuff that I care about. This is for humans. All the AI discussions and the… ## [AI Borked my Keyboard - Reversing the Aula F108 Pro Software](https://parsiya.net/blog/ai-borked-keyboard/) _2026-04-13 · Hackerman's Hacking Tutorials_ I used GPT-5.4 and Claude Opus 4.6 to reverse engineer the Aula F108 Pro keyboard's software using Ghidra MCP. This is how I did it, what setbacks I had, and how (A)I borked the keyboard's screen despite constant supervision and review. A common issue with the keyboard is that it ACKs bad messages, then silently drops them. Did Gene Wolfe write this firmware? I also introduce the novel wording of… ## [Manual Context is a Bug](https://parsiya.net/blog/manual-context-is-a-bug/) _2026-03-31 · Hackerman's Hacking Tutorials_ I wake up and read the news. Daniel Miessler has only declared my job dead three times this week. Another frontier lab has found a bazillion bugs. Half of LinkedIn is "SAST is dead." The war is, well. Welcome to the age of AI. In this blog I reflect on "Manual Work is a Bug" and on how AI has changed my workflow. I introduce the (not so novel concept) of "AI-Docs." A knowledge base for both humans… ## [AI-Native SARIF](https://parsiya.net/blog/ai-native-sarif/) _2025-12-12 · Hackerman's Hacking Tutorials_ The "radical" idea to add prompts and code context directly to SARIF files for AI triage. ## [WTF is ... - AI-Native SAST?](https://parsiya.net/blog/wtf-is-ai-native-sast/) _2025-10-31 · Hackerman's Hacking Tutorials_ Ladies and gentlemen, my name is Parsia and I'm here to ask and answer one simple question: WTF is AI-Native SAST? (RIP TotalBiscuit). Spoiler: It's SAST+AI. But that doesn't make it useless. Quite the opposite, I'll make the case for passing all your code to AI while tokens are cheap. Don't believe the marketing, though. Current LLMs need serious hand-holding to go beyond surface-level bug… ## [So You Wanna Use Your Own LLMs in GitHub Copilot Chat](https://parsiya.net/blog/litellm-ghc-aad/) _2025-09-03 · Hackerman's Hacking Tutorials_ We want to use custom OpenAI compatible API LLMs with GitHub Copilot Chat in VS Code without API keys. We will use LiteLLM as a proxy for authentication and use the Azure AI model support in Chat as a hack. Problem Statement GitHub Copilot Chat in VS Code (moving forward, called Chat 1 ) allows custom LLM deployments, but only supports API keys and not AAD/Entra ID. API keys are icky and not cool… ## [Kusto Detective Agency: Echoes of Deception - 0-8 Solves](https://parsiya.net/blog/2025-kda-echoes/) _2025-09-02 · Hackerman's Hacking Tutorials_ Kusto is important at my current employer and one of my work besties does SecOps. So, I've decided to learn more Kusto. Solves for the first eight tasks for Kusto Detective Agency challenge Echoes of Deception. It turns out Kusto is not just a better looking SQL, it does a lot more. E.g., it can make a graph and find paths (yes, as I've just searched, T-SQL can also do this). It makes me wonder if… ## [How Burp AI Works](https://parsiya.net/blog/2025-08-15-how-burp-ai-works/) _2025-08-15 · Hackerman's Hacking Tutorials_ This is a quick peek inside Burp AI. I'll show how to proxy its requests, what actually happens when you trigger a feature. This knowledge allows us to redirect Burp AI to your own AI instance. As far as I know, this is not publicly documented. I covered a shorter version in my DEF CON 33 Bug Bounty Village talk The Year of the Bounty Desktop: Bugs from Binaries . See the extended slides (pages… ## [Kusto-Mice: Optimizing Kusto joins](https://parsiya.net/blog/kusto-mice-join-optimization/) _2025-05-18 · Hackerman's Hacking Tutorials_ A few weeks ago I wrestled with a complex Kusto query. I shared what I learned at work in a presentation. In this blog, I'll use a public example to walk you through it. ## [AI QA that opens fix PRs (Sponsored)](https://crawlproof.com/a/r7P53JVk4aXq) _2025-05-18 · **Sponsored**_ Run a browser QA from plain-English instructions; get GitHub issues and optional fix PRs. ## [Steam's 'Open in Desktop' Button](https://parsiya.net/blog/steam-open-desktop/) _2024-09-20 · Hackerman's Hacking Tutorials_ This is not a bug, but some notes about the new Steam "Open in Desktop" button. I am going to show how to look for bugs in these kinds of browser-to-desktop interactions.