Sign in

Nick Frichette

@frichetten.com
1.6K followers 245 following 372 posts

Staff Security Researcher @datadoghq | DEF CON/Black Hat USA main stage speaker | he/him | OSCP OSWE | I turned hacking AWS into a career | Tweets are my own | Created hackingthe.cloud

PostsRepliesMedia
Nick Frichette @frichetten.com · 16/07/2026
It’s amazing to think there was a time when I considered some vulnerability classes too tedious to manually validate, test, and report. Now I can encode the workflow as a skill, run it against a dataset of endpoints I've gathered, and get back findings.
020
Nick Frichette @frichetten.com · 09/06/2026
I’m so excited to share what we’ve been working on: AI Guard for Coding Agents. Months ago Datadog Security Research, saw the risk posed to coding agents like Claude, Cursor, Codex and more. We knew we needed a solution to help secure these important agentic tools.
441
Nick Frichette @frichetten.com · 02/06/2026
@fwdcloudsec.org has been incredibly inspiring. So many talented researchers, so much great work, and the energy here made me want to go chase down some AWS ideas I've been sitting on. Love this community.
020
Nick Frichette @frichetten.com · 01/06/2026
Good morning fwd:cloudsec!! The best cloud security conference on earth is happening today and tomorrow! Didn’t manage to get a ticket? Join remotely! All talks are live-streamed to the official YouTube channel.
030
Nick Frichette @frichetten.com · 27/05/2026
Looks like the latest version of Codex has a required review/trust system for hooks. This is a great way to protect developers as threat actors have started to abuse hooks more and more.
041
Nick Frichette @frichetten.com · 05/05/2026
Bummer, it looks like Anthropic removed the ability to DoS their models with the magic string. This was a fun technique that had some security ramifications where you could kill an inference session. It was fun while it lasted!
182
Nick Frichette @frichetten.com · 04/03/2026
😬
020
Nick Frichette @frichetten.com · 13/02/2026
Professional communication
020
Nick Frichette @frichetten.com · 09/02/2026
Just got my ticket to @fwdcloudsec.org! Looking forward to the best cloud security conference in the world!
020
Nick Frichette @frichetten.com · 28/01/2026
Houses are bullshit
130
Nick Frichette @frichetten.com · 26/01/2026
I'm skeptical of the claim that 1,000 Clawdbot instances are publicly facing on the internet. If you look at the Shodan output, most of those boxes don't have port 18789 exposed (default Clawdbot port). The references to 18789 are from mDNS. Take this one for example:
030
Nick Frichette @frichetten.com · 24/01/2026
Hmmm, even with sudo access Clawdbot has some sandboxing/protections. In a real environment that's good but I kinda intend for him to have full access to this VM. Gotta change that.
010
Nick Frichette @frichetten.com · 24/01/2026
Okay, this is kind of amazing. I wanted to give him a browser so he could surf the net but ran into an error. I was going to fix it myself but said, "Hey man, there is a dpkg in your home directory. Go ahead and install it. You'll have some errors but you'll manage", and he did!
100
Nick Frichette @frichetten.com · 24/01/2026
Dang, I should have created clawdbot his own host user. I'll have to take care of that later. Suppose this is a good warning if that's something you want to avoid!
100
Nick Frichette @frichetten.com · 24/01/2026
He's alive!
100
Nick Frichette @frichetten.com · 24/01/2026
I don't know what skills are exactly, but these seemed useful.
100
Nick Frichette @frichetten.com · 24/01/2026
Initial install is easy, there's even an option for integrating with Tailscale which I already setup in the VM.
110
Nick Frichette @frichetten.com · 16/12/2025
I’m running behind on PRs, DMs, the Hacking the cloud EoY report, etc. I will catch up in time, I’m just trying to rest and heal this horrible fever.
120
Nick Frichette @frichetten.com · 03/12/2025
Currently backed myself into a corner by ignoring my own advice: When researching vulns in a cloud service, learn how the service works BEFORE you start hunting. Do it in the reverse order and you’ll end up with a vuln you can’t tie to real impact, because you never learned how harm could occur.
051
Nick Frichette @frichetten.com · 02/10/2025
Ah yes, the alloy known as '<span class="no-text-formatting">white gold</span>'
060
Nick Frichette @frichetten.com · 01/10/2025
Today in weird things family members say about technology, this is “the weird internet frisbee”.
1101
Nick Frichette @frichetten.com · 18/09/2025
Added a new challenge coin to the display today, in recognition of my contributions to the AWS Vulnerability Disclosure Program. I’m excited to continue pushing the boundaries of AWS security and helping to build a more secure cloud!
1100
Nick Frichette @frichetten.com · 18/09/2025
@fwdcloudsec.org Europe 2025 was incredible! Amazing talks, amazing research, and amazing people. There is no other conference I would recommend for cloud security people. Looking forward to next year!
080
Nick Frichette @frichetten.com · 15/09/2025
Good morning @fwdcloudsec.org! If you would like exclusive, limited edition, holographic stickers, come find me!
050
Nick Frichette @frichetten.com · 13/09/2025
Looking forward to seeing everyone in Berlin! Safe travels! @fwdcloudsec.org
040
Nick Frichette @frichetten.com · 07/09/2025
While not explicitly stated, I do want to stress: Cloud security people aggressively preach not storing long lived AWS access keys in CI/CD pipelines, and that you should instead use things like OIDC. However, that isn’t a silver bullet. In addition…
1131
Nick Frichette @frichetten.com · 29/08/2025
AWS’s commitment to this host name template is incredible. It’s everywhere!
000
Nick Frichette @frichetten.com · 19/08/2025
Meet my enemy of the day. A piece of metal (razor blade) in my tire.
120
Nick Frichette @frichetten.com · 05/08/2025
I’m skipping out on summer camp this year. Hope everyone has fun! Stay hydrated and shell responsibly! I’m in our New York office this week, and you could be too! We have over 170 open positions across engineering. careers.datadoghq.com/all-jobs/?pa...
071
Nick Frichette @frichetten.com · 01/08/2025
It’s a month and a half away but I’m already super excited for @fwdcloudsec.org EU! If you’ll be there in Berlin, come find me for limited edition, holographic, @hackingthe.cloud stickers!
041
Nick Frichette @frichetten.com · 30/07/2025
After *checks notes* 18 years of running Linux on the desktop in one form or another, I’m going to give Mac a try.
250
Nick Frichette @frichetten.com · 25/07/2025
We're headed back to @fwdcloudsec.org EU! This time we're breaking down AWS honey tokens: how they work, tradeoffs of different types, and how they can even defeat AWS 0-days!
061
Nick Frichette @frichetten.com · 13/07/2025
An interesting undocumented API just hit my automation. Looks like AWS is planning a Vector DB for S3? Or some kind of storage Vector storage offering? Operations include: - QueryVectors - PutVectors - PutVectorBucketPolicy - ListVectors - ListVectorBuckets
2272
Nick Frichette @frichetten.com · 10/07/2025
Cool to see AWS notifying customers of misconfigured OIDC trusts which are vulnerable!
182
Nick Frichette @frichetten.com · 04/07/2025
This wasn’t a joke btw. It works. You’d be surprised how much uwu breaks guardrail implementations.
11371121
Nick Frichette @frichetten.com · 01/07/2025
It’s a packed house over at @siigil.bsky.social talk on Azure Service Principals, a history on backdooring them, and more!
030
Nick Frichette @frichetten.com · 30/06/2025
Fam, let’s not get kicked out. Save your shells for day 2.
070
Nick Frichette @frichetten.com · 30/06/2025
If you want a Hacking the Cloud sticker, and you’re at @fwdcloudsec.org, you’re in luck! You might notice some littered around the common area.
000
Nick Frichette @frichetten.com · 30/06/2025
GOOD MORNING @fwdcloudsec.org !! The best cloud security conference of the year is just getting started! If you’re here, come say hi. I want to hear about what you’re working on in the cloud or with AI and LLMs!
011
Nick Frichette @frichetten.com · 29/06/2025
Me when I see long lived access keys.
051
Nick Frichette @frichetten.com · 23/06/2025
Updated the core switch today! Now to plug more things into the home server rack (and do some better cable management)
140
Nick Frichette @frichetten.com · 19/06/2025
What
130
Nick Frichette @frichetten.com · 02/06/2025
A little over a year ago I published research on how you could leverage non-production AWS API endpoints to enumerate permissions without logging to CloudTrail. A year later...I'm still finding them. Red Teamers, these can be super useful and really up your game!
152
Nick Frichette @frichetten.com · 10/05/2025
To renew or not renew…
000
Nick Frichette @frichetten.com · 29/04/2025
Wanna learn how Datadog’s Security Research org fuels our detections? Come visit us at booth 1735. We’re here until 6PM today.
030
Nick Frichette @frichetten.com · 28/04/2025
👀 See the future of cloud security, in person!
050
Nick Frichette @frichetten.com · 24/04/2025
Come see me at RSA! I'll be speaking about common threat actor techniques seen in AWS intrusions, and why they're terrible! It'll be a Gordon Ramsey-style critique of cloud threat actors. In addition, we'll talk about how you can attack AWS environments better!
020
Nick Frichette @frichetten.com · 04/04/2025
Every time I open the Stocks app the drop gets bigger and bigger. Are we winning yet?
040
Nick Frichette @frichetten.com · 27/03/2025
Something something…bandwagon…something something. Hey did you know the CFP for @fwdcloudsec.org is open now? Submit your innovative cloud security talks now through April 11th!!
072
Nick Frichette @frichetten.com · 26/03/2025
….this might indicate there’s a bubble.
161