Stefan Nagy (@snagycs) header
Stefan Nagy (@snagycs) profile picture

Stefan Nagy

@snagycs

Faculty @uutah. My lab hunts bugs: https://teapawt.org/t.co/R74Wl128A9. Mastodon: [email protected] Bluesky: https://teapawt.org/t.co/6sKvEYpXMF

 Salt Lake City, UT
cs.utah.edu/~snagy
Joined August 2018
  • Tweets1.3K
  • Following1.6K
  • Followers1.3K
75Media
Photo by Stefan Nagy (@snagycs)Photo by Stefan Nagy (@snagycs)Photo by Stefan Nagy (@snagycs)Photo by Stefan Nagy (@snagycs)Photo by Stefan Nagy (@snagycs)Photo by Stefan Nagy (@snagycs)Photo by Stefan Nagy (@snagycs)Photo by Stefan Nagy (@snagycs)Photo by Stefan Nagy (@snagycs)Photo by Stefan Nagy (@snagycs)
Super proud of the FuTURES³ Lab and everything we accomplished in 2025, and excited for what’s ahead in 2026! Check out our work at futures.cs.utah.edu. 😃
Image from Stefan Nagy (@snagycs)
2
5
644
Stefan Nagy retweeted
Sean Heelan (@seanhn) profile picture
Sean Heelan
@seanhnOct 30
haha, so apparently OpenAI are about to start training on your Daybreak Blue sessions, with no way to opt out. Literally stealing people's private work, as they do it, is cartoonishly evil. It also will presumably kill Daybreak usage by security researchers. Or at least, it should. The thing OAI have had to swear they are not doing to math researchers, they are now explicitly about to start doing to security researchers. Yet another reminder of the importance of open models.
87
191
74
1,395
174,205
Stefan Nagy retweeted
Low Level (@LowLevelTweets) profile picture
Low Level
@LowLevelTweetsSep 10
very excited for mythos to tell the sysadmins that exposing the PLCs to the internet is bad
POLITICO (@politico) profile picturePOLITICO
@politicoSep 10
EXCLUSIVE: Sam Altman met with top power utilities to discuss ways to secure the electrical grid. He also offered one possible solution to the cybersecurity risks: OpenAI’s own cyber services. politico.com/news/2026/09/10…
Sam Altman pitches utilities on AI grid defense

Sam Altman pitches utilities on AI grid defense

politico.com
16
19
3
441
19,382
Stefan Nagy retweeted
Ana Marasović (@anmarasovic) profile picture
Ana Marasović@anmarasovicSep 9
ELI5 why corporate AI companies get to run cyber attacks on real-world systems with zero consequences
2
6
486
Stefan Nagy retweeted
roddux (@roddux) profile picture
roddux@rodduxJul 20
We need to break 1000/day, only then will security be achieved
Brad Spengler (@spendergrsec) profile pictureBrad Spengler@spendergrsecJul 19
434 Linux kernel CVEs published today, FYI
1
1
9
1,850
En route to Montreal 🇨🇦 @FSEconf! On Wednesday, FuTURES³ Lab researchers @yeaseen_, @yangzaocn, and @gabe_sherman6 will present their three papers on invariant-guided binary fuzzing, LLM-driven transpiler testing, and Python auto-harnessing. Papers/code: futures.cs.utah.edu
Image from Stefan Nagy (@snagycs)
3
266
Stefan Nagy retweeted
gabe sherman (@gabe_sherman6) profile picture
gabe sherman@gabe_sherman6Jul 6
Love Python but loathe its libraries' bugs? This Wednesday at @FSEconf, I’ll be presenting my latest work in collaboration with @snagycs, "SnakeCharmer: Automatic Fuzzing Harness Generation for Pure and Hybrid Python Libraries"!
1
3
4
328
Stefan Nagy retweeted
Sanjay Rawat (@tosanjayr) profile picture
Sanjay Rawat@tosanjayrMay 31
Dyn Taintflow Analysis (DTA) - one of the main components of VUzzer (NDSS 2017) - finally got the re-engineering I'd been postponing for years. Several ideas had been stuck in my notebook ever since. 1/n
1
4
20
2,557
Stefan Nagy retweeted
Samuel Groß (@5aelo) profile picture
Samuel Groß@5aeloApr 20
The fuzzer that found project-zero.issues.chromium… (and a number of issues prior to that as well) is now open-source: crrev.com/c/7580844 It uses pkeys, trap-handling and single-stepping to intercept and mutate in-sandbox reads (see trap-fuzzer.h). Definitely had fun writing it!
4
95
1
479
40,332
Stefan Nagy retweeted
Scott Bauer (@ScottyBauer1) profile picture
Scott Bauer@ScottyBauer1Apr 19
I have a job opening on my team. If you're interested in incident response & software security across a wide range of industries (Laptops, Auto, Mobile, Datacenter) while working with very talented people please apply. DMs are open for questions*. careers.qualcomm.com/careers…

Careers at Qualcomm

Careers site

careers.qualcomm.com
9
29
1
110
14,723
Stefan Nagy retweeted
Alex Plaskett (@alexjplaskett) profile picture
Alex Plaskett
@alexjplaskettMar 14
ZeroDayBench: Evaluating LLM Agents on Unseen Zero-Day Vulnerabilities for Cyberdefense arxiv.org/pdf/2603.02297
Image from Alex Plaskett (@alexjplaskett)
Image from Alex Plaskett (@alexjplaskett)
Image from Alex Plaskett (@alexjplaskett)
3
41
2
188
19,382
Stefan Nagy retweeted
chrisrohlf (@chrisrohlf) profile picture
chrisrohlf
@chrisrohlfFeb 5
cset.georgetown.edu/article/…
AI and the Software Vulnerability Lifecycle | Center for Security and Emerging Technology

AI and the Software Vulnerability Lifecycle | Center for Security and Emerging Technology

AI has the potential to transform cybersecurity through automation of vulnerability discovery, patching, and exploitation. Integrating these models with traditional software security tools allows...

cset.georgetown.edu
Thomas H. Ptacek (@tqbf) profile pictureThomas H. Ptacek@tqbfFeb 5
Replying to @tqbf
I think vulnerability research might be THE MOST LLM-amenable software engineering problem. Pattern-driven. Huge corpus of operational public patterns. Closed loops. Forward progress from stimulus/response tooling. Search problems.
3
1
43
14,159
Awesome to see @yeaseen_'s work on transpiler testing recognized by the Go2Hx dev community! community.haxe.org/t/go2hx-w… 😁 Interested in improving transpilers? Check out our fuzzer TeTRIS! Paper: futures.cs.utah.edu/papers/2… Slides: futures.cs.utah.edu/papers/2… Code: github.com/FuturesLab/TeTRIS
Go2hx Work in Progress

Go2hx Work in Progress

@back2dos Thanks for the kind words! Your points are well reasoned, I think it is indeed paradoxically less ambitious. Though go2hx already use’s Go’s frontend, building a Go backend first to...

community.haxe.org
2
4
252
TeTRIS uncovered 16 translation bugs across real-world transpilers—12 of them completely new!
Image from Yeaseen Arafat (@yeaseen_)
1
3
228
Transcompiler lost in translation? Let TeTRIS uncover all its syntax frustrations! Happy to share my @ACSAC_Conf paper w/ @snagycs: "TeTRIS: General-purpose Fuzzing for Translation Bugs in Source-to-Source Transpilers"! PDF:futures.cs.utah.edu/papers/2… Code:github.com/FuturesLab/TeTRIS
Image from Yeaseen Arafat (@yeaseen_)
1
2
10
339
Crashing calculators and CAD editors? GUIFuzz++ is finally here to help make them better! 🔥 Come see my undergraduate student @trowlett0's very first paper "GUIFuzz++" at #ASE25 this Wednesday. Also now integrated in AFL++! 😃 github.com/AFLplusplus/AFLpl…
Image from Stefan Nagy (@snagycs)
Image from Stefan Nagy (@snagycs)
2
6
394
Stefan Nagy retweeted
Gabriel Synnaeve (@syhw) profile picture
Gabriel Synnaeve
@syhw9 Oct 2025
This is an excellent history of LLMs, doesn't miss seminal papers I know. Reminds you we're standing on the shoulders of giants, and giants are still being born today. gregorygundersen.com/blog/20…
10
111
7
679
128,395
#FUZZING'26 CALL FOR PAPERS ────── ✨After 5 years, we will be again co-located with NDSS! 🔗 fuzzing-workshop.github.io 📅 11. Dec (Submission) //cc Marcel Böhme (@mboehme_; MPI-SWS), @RuijieMeng (CISPA), Rohan Padhye (@moarbugs; CMU), László Szekeres (@lszekeres; Google)
Image from Yannic Noller (@yannicnoller.bsky.social) (@yannicnoller)
1
7
2
25
5,097
Super psyched to unveil GUIFuzz++: our grey-box fuzzer for desktop GUI applications, led by FuTURES³ Lab undergraduate researchers Dillon Otto and @trowlett0. Coming soon to @ASE_conf'25! futures.cs.utah.edu/papers/2… github.com/FuturesLab/GUIFuz…
Tanner Rowlett (@trowlett0) profile pictureTanner Rowlett@trowlett024 Sep 2025
Fuzzing GUIs shouldn’t be harder than fuzzing files. That's why I am excited to share my first paper (w/ fellow undergrad Dillon Otto + @snagycs) "GUIFuzz++: Unleashing Grey-box Fuzzing on Desktop Graphical User Interfacing Applications" at #ASE25.
15
1,379
GUIFuzz++ is the first general-purpose fuzzer for desktop GUI software! Fuzzing by translating AFL++ random input into user interaction with GUIs, leading to the discovery of 23 new bugs! Paper: futures.cs.utah.edu/papers/2… Source: github.com/FuturesLab/GUIFuz… Go test some GUIs!
Image from Tanner Rowlett (@trowlett0)
1
5
23
1,259
Load more