autonomous AI security agents that audit your codebase, prove exploitable vulnerabilities, and deliver fixes your team can ship.
San Francisco
Joined December 2023
- Tweets49
- Following1
- Followers2.3K
- Likes50
winfunc retweeted
CVE-2026-112512!
We discovered a 0-day in macOS that lets you trivially bypass Gatekeeper checks for any app.
A gatekeeper bypass that requires no extra interaction, with quarantine bit intact, and passes the Safari download flow.
Essentially checks off all the criteria required for a complete Gatekeeper bypass on macOS, which according to Apple is worth $100K? We shall wait and see.
Will def do a write-up on this soon!
winfunc retweeted
I have been thinking about "AI defense" and "safeguards" for a while now @winfunction.
Just wrote an essay to put my thoughts into words.
Titled: Cyber guardrails tax the defender, not the attacker.
Link in the replies.
winfunc retweeted
as of recent, i've been obsessed with formal verification, specifically on breaking them.
out of curiosity, i ran winfunc on lean4 and it discovered the following UAF (use-after-free): github.com/leanprover/lean4/…
got quickly pached too! :)
winfunc retweeted
Introducing ENDGINX - 5 CVEs in NGINX with open models.
We let loose GLM 5.1 and 5.2 by @Zai_org on the NGINX codebase.
The work resulted in six fixed vulnerabilities across five CVEs: CVE-2026-28755, CVE-2026-42926, CVE-2026-9256, CVE-2026-42055, and CVE-2026-42533.
First of our open-model vulnerability research series.
winfunc.com/research/endginx
winfunc retweeted
We discovered the same vulnerability too. :)
And @winfunction discovered 4 more remote RCE primitives in NGINX soon to be publicly disclosed.
Anywho, we're hiring security researchers with a knack on taming LLMs.
If you're interested in novel vulnerability research and autonomous exploitation with language models, DM me and I'll send you a fun CTF to solve. :)
Introducing nginx-poolslip, a fresh RCE for the the latest nginx release 1.31.0.
nginx-rift has been patched, but our security agent Vega has found a new 0 day.
We will release the full technical writeup with ASLR bypass 30 days after the patch on nebusec.ai.
winfunc retweeted
We're doing an experiment with open models @winfunction to see how far we can push them to find vulns in hardened targets. So far:
- $4.5K in bounties from Chrome VRP with a few more pending, with the scans costing less than $100.
- 2 CVEs in NGINX (CVE-2026-28755 & CVE-2026-42926). And watch out for the next release!
- And 60ca500faea0fc70816bb9c53af3815e2af3e6c962b4b4ea63c33c62ebb4240d 👀
We're writing a blog on this soon.
