Security research, studies, and technical experiments. Novel and interesting findings I dig into on my own compute: vulnerability and red-team writeups, model supply-chain and MCP security studies, benchmarks, and build logs, written up for anyone who finds them useful.
Chat-Template SSTI: The Inference-Time Supply-Chain Risk in Modern Model Files, and Testing Scanner Coverage
GGUF chat templates are inference-time code paths. This corrected research note explains why raw fixture counts are insufficient evidence for scanner precision or a security finding.
Read experiment →MCP Excessive Agency in the Wild: 9 Real Servers, 5 Detection Classes, Zero Exploitable Bugs
Discovery-only audits of nine real MCP servers. No exploitable vulnerability, but two new excessive-agency classes, one env-dump pattern, and two precision fixes. The honest lesson: MCP metadata alone cannot prove a tool safe or dangerous.
Read experiment →MCP Audit Research Series , Batch 1: Six Real Servers, Two New Classes
Discovery-only, deterministic audits of six real MCP servers (fetch, git, filesystem, sqlite, time, shell). No exploitable bug, two new real-world-derived excessive-agency classes, and a clean method for grading metadata-invisible constraints.
Read experiment →MCP Audit Research Series , Batch 2: Community Servers, and Why Recall Isn't Enough
Discovery-only audits of community + reference MCP servers (duckduckgo, calculator, everything). One real env-dump pattern, one safe-implementation non-finding, and a precision problem that reframes the tool: false positives are the next frontier, not recall.
Read experiment →The ML Model-File Supply Chain: What Runs When You Load a Model, and How Scanners Hold Up
Loading a model can execute code. A walk through which model-file formats run code and why, then a defensive test of whether a mature open-source scanner can be evaded by repackaging a known-bad file. Zero false negatives across 11 evasion vectors.
Read experiment →The Wrong Lock on an Agent's Authority: A Keyword-Evasion Hole in Our Own Dispatch Gate
We audited the single gate that decides whether one AI agent's task auto-runs with real authority. Eight approve-required asks, rephrased off-keyword, all classified safe. Found in our own harness, patched, corpus added.
Read experiment →What a Crash Oracle Can't See: Fuzzing Real CPython Parsers for Exception-Contract Bugs
Coverage-guided fuzzing of real zipfile and gzip parsers surfaced three exception-contract robustness classes, plus the more useful lesson: a clean crash-fuzz report is not a clean-parser report.
Read experiment →The MCP Trust Boundary Includes the Schema: Why Description-Only Audits Miss Excessive Agency
A tool with an honest description and an unconstrained path schema slipped past a description-only MCP judge. A deterministic scorer caught it, and a schema-aware judge recovered the miss 10/11 to 11/11.
Read experiment →AgentDojo Prompt Injection: Reproducing a GLM Agent Failure
AgentDojo prompt injection replay against or-target-glm reproduced security=False, utility=True in an LLM red-team harness.
Read experiment →Independent TurboQuant Benchmarks on Consumer GPUs
First published benchmarks of Google's TurboQuant at 7B scale on RTX 4080. 45 data points, 4 models, real VRAM measurements.
Read experiment →