Improving the world’s security at Google. Opinions are mine.
Zurich, Switzerland
Joined September 2014
- Tweets1.2K
- Following284
- Followers11.3K
- Likes924
Introducing PageBreak, an agentic vulnerability discovery tool using deterministic validation to achieve a near-zero false positive rate.
How it works: blog.google/security/agentic…
For real-world vulnerabilities PageBreak has discovered 👇
bughunters.google.com/blog/p…
@[email protected] retweeted
“And no, AI isn't perfect. But Christ, anybody who points to the problems at AI had better be looking in the mirror and pointing at themselves at the same time.
Because it's not like natural intelligence is always all that great either.”
lore.kernel.org/linux-media/…
@[email protected] retweeted
Have been working on agentic vulnerability discovery for a while now, happy to share about CodeMender! 🚀🚀
While AI is helping us tackle big challenges, it also poses new potential security risks. That’s why we’re focused on building tools that keep the broader ecosystem safe — like CodeMender, a code security agent that automatically finds and fixes critical software vulnerabilities.
Today, we’re inviting a select group of experts to test a new CodeMender API, and we’ll be launching it more broadly soon.
#GoogleIO
ALT Text reads "CodeMender" over an abstract pink and blue grid illustration.
@[email protected] retweeted
Why the "Agents Rule of Two" is flawed
shhnjk.substack.com/p/why-ag…
@[email protected] retweeted
Cross-Site ETag Length Leak
blog.arkark.dev/2025/12/26/e…
I just posted the author writeup for impossible-leak in SECCON CTF 14 Quals. As far as I know, this is a new XS-Leak technique! The ETag header can become a side channel :)
@[email protected] retweeted
We launched a redesigned Project Zero website today at projectzero.google !
To mark the occasion, we released some older posts that never quite made it out of drafts.
Enjoy!
Interested in the security of AI Agents 💁🛡️?
Then you've likely heard of "prompt injection", but do you know what "task injection" is? If you're curious, check out our latest post for a description and some real-world examples we discovered.
bughunters.google.com/blog/4… bughunters.google.com/blog/4…
@[email protected] retweeted
my new blogpost is out!!
this one talks about a new web vulnerability class i discovered that allows for complex interactive cross-origin attacks and data exfiltration
and i've already used it to get a google docs bounty ^^
have fun <3
lyra.horse/blog/2025/12/svg-…
@[email protected] retweeted
JavaScript’s lexer ambiguity in action. Might fool you and some weak parsers.
Demo: jsfiddle.net/yo0a24dj/
@[email protected] retweeted
We published a blogpost about SafeContentFrame - a library for rendering untrusted content inside an iframe. The library is a big party of what I've been up to in the few last years! Check out the blog and take a slice of my birthday cake 🎂!
bughunters.google.com/blog/6…
Rendering untrusted web content is fraught with security risks 🕸️ 🛡️.
Read how SafeContentFrame, a new TypeScript library, offers a robust solution for isolating web content and protecting against threats like XSS and side-channel attacks.
goo.gle/3K5DRQJ
@[email protected] retweeted
I'm happy to release a script gadgets wiki inspired by the work of @slekies, @kkotowicz, and @sirdarckcat in their Black Hat USA 2017 talk! 🔥
The goal is to provide quick access to gadgets that help bypass HTML sanitizers and CSPs 👇
gmsgadget.com/
1/4
@[email protected] retweeted
It started!
pV!
Celebrating 15 years of password hacking 💻 🔑, Swiss Army knives (and sometimes even chainsaws or swords) included! 😲
Discover how Google's security teams turn employee farewells into security tests.
bughunters.google.com/blog/6…
@[email protected] retweeted
Pewien inżynier bezpieczeństwa musi zadbać o bezpieczeństwo dosłownie tysięcy aplikacji. 💥 Jak to osiągnąć?
Michał Bentkowski pokaże kilka rozwiązań, które pozwolą upewnić się, że każda nowonapisana aplikacja zachowuje wysoki poziom bezpieczeństwa.
🎟 omhconf.pl
Do you want to learn more about the various Vulnerability Reward Programs offered by Google? Or you're looking for inspiration? Check the video below in which @kkotowicz and @SecurityMB talk about Google VRPs!
youtube.com/watch?v=R2qMd4PZ…
@[email protected] retweeted
Very nice presentation about web security at a scale by @SecurityMB. Finally, web security is solved for good.
🚫 DOM XSS, begone! 👋 Discover how we used Trusted Types to protect AppSheet, and how that can inform your own web application's journey to a safer security posture where DOM XSS vulnerabilities are a thing of the past.
bughunters.google.com/blog/6…
@[email protected] retweeted
I didn't manage to solve postviewer v1 in 2022, really close to solve v2 in 2023, but this year finally solve v3 💯
It's my writeup to the GoogleCTF 2024, almost all web challenges are client-side, so I really like it lol
blog.huli.tw/2024/06/28/en/g…
