Research & Experiments
Security research, studies, and technical experiments. Novel and interesting findings I dig into on my own compute: vulnerability and red-team writeups, model supply-chain and MCP security studies, benchmarks, and build logs, written up for anyone who finds them useful.
14 writeups
The Empty Boss Chairfirst-caller-wins in privileged setup code
A recurring structural flaw where permissionless setup steps let any first caller claim permanent privileged control — what it is, its famous precedent, how we hunt it, and how to close it.
Pattern class; live instances in coordinated disclosure
The Effort Knob Is a Cost KnobTurning Reasoning Effort Low-to-Max Moved No Security Number on glm-5.3
Turning reasoning effort from low to max on glm-5.3 moved reasoning tokens 86x and latency 2.7x, and moved no security number: injection resisted at every level, gate evasions 0/420.
0 / 420 gate evasions; effort moved cost, not security
Which Zip Tools Are Actually Dangerous in WordPressA Fixture-Verified Extractor Matrix (And What 1,800 Plugins Told Us About Who Ships the Dangerous One)
Six traversal-shaped entries through every PHP zip family a WordPress plugin can reach: ZipArchive and PharData held, PclZip wrote outside the root. Then 1,824 plugins checked for who ships it.
PclZip escaped the root; 1,824 plugins checked
Twin Fixtures, One VerdictPinning Scanner Coverage to the Payload Class
A QA note, not a discovery: the same malicious pickle through two ingestion paths fires ModelAudit rule S201 both times. What twin fixtures prove about adapter-independence, and what they don't.
Detection follows the payload, not the adapter
MCP Excessive Agency in the Wild9 Real Servers, 5 Detection Classes, Zero Exploitable Bugs
Discovery-only audits of nine real MCP servers. No exploitable vulnerability, but two new excessive-agency classes, one env-dump pattern, and two precision fixes. The honest lesson: MCP metadata alone cannot prove a tool safe or dangerous.
9 real servers, 5 detection classes, 0 exploitable bugs
MCP Audit Research Series, Batch 2Community Servers, and Why Recall Isn't Enough
Discovery-only audits of three community and reference MCP servers: one real env-dump pattern, one safe-implementation non-finding, and a false positive that reframes the tool. Precision is next.
False positives are the next frontier, not recall
MCP Audit Research Series, Batch 1Six Real Servers, Two New Classes
Discovery-only, deterministic audits of six real MCP servers (fetch, git, filesystem, sqlite, time, shell): no exploitable bug, and two new real-world-derived excessive-agency classes.
6 real servers, 2 new detection classes
Chat-Template SSTIThe Inference-Time Supply-Chain Risk in Modern Model Files, and Testing Scanner Coverage
GGUF chat templates are inference-time code paths. This corrected research note explains why raw fixture counts are insufficient evidence for scanner precision or a security finding.
GGUF path matched standalone; two gadget families missed
The ML Model-File Supply ChainWhat Runs When You Load a Model, and How Scanners Hold Up
Loading a model can execute code. Which model-file formats run code and why, then a defensive test of whether repackaging a known-bad file evades a mature scanner. Zero false negatives across 11 vectors.
11 evasion vectors, zero false negatives
The Wrong Lock on an Agent's AuthorityA Keyword-Evasion Hole in Our Own Dispatch Gate
We audited the single gate that decides whether one AI agent's task auto-runs with real authority. Eight approve-required asks, rephrased off-keyword, all classified safe. Found in our own harness, patched, corpus added.
8/8 rephrased approval asks bypassed the gate; all closed
What a Crash Oracle Can't SeeFuzzing Real CPython Parsers for Exception-Contract Bugs
Coverage-guided fuzzing of real zipfile and gzip parsers surfaced three exception-contract robustness classes, plus the more useful lesson: a clean crash-fuzz report is not a clean-parser report.
3 exception-contract robustness classes
The MCP Trust Boundary Includes the SchemaWhy Description-Only Audits Miss Excessive Agency
A tool with an honest description and an unconstrained path schema slipped past a description-only MCP judge. A deterministic scorer caught it, and a schema-aware judge recovered the miss 10/11 to 11/11.
Schema-aware judge recovered the miss, 10/11 to 11/11
AgentDojo Prompt InjectionA Correction — Both GLM Generations Resisted
Correction: our harness read AgentDojo's security flag backwards. No transcript from GLM-4.6 or the glm-5.3 retest shows the injection executing, so the original 'agent defeated' claim is withdrawn.
Both GLM generations resisted; 10/10 in the glm-5.3 retest
Independent TurboQuant Benchmarks on Consumer GPUs
First published benchmarks of Google's TurboQuant at 7B scale on RTX 4080. 45 data points, 4 models, real VRAM measurements.
45 data points, 4 models, real VRAM measurements