Things we build, break, and learn.
Research and field notes on agent security, infrastructure, identity, and the systems underneath.
- Agent security
- Exploit development
- Cloud & identity
Original research · Coordinated disclosure · Working PoCs
- CISSP
- AGENT SECURITY
- OSWE
- EXPLOIT DEV
- OSCE
- CLOUD & IDENTITY
- CRTO
- SUPPLY CHAIN
- OSCP
- ZERO DAYS
- CEH
- RED TEAM
- AWS
- AGENT SECURITY
- CCSP
- EXPLOIT DEV
- SEC+
- CLOUD & IDENTITY
- NVIDIA AI
- SUPPLY CHAIN
- GPEN
- ZERO DAYS
- OSED
- RED TEAM
Research and field notes from offensive security practitioners.
One Slash Away From the Whole AI Account
An unsanitized ID parameter let a low-privilege user drop a single ../ into an in-app AI assistant and turn a thin OpenAI proxy into full read/write/delete access to a company's entire OpenAI organization.
- Written byMatthew Keeley
- Published
- TopicAI · 9 min read
Picked from the archive. The newest posts are right below.
Read the write-upExploits, deep dives, and field notes.
- Engineering
Just One More Day
What Pokémon and Stardew Valley have in common, why being almost finished keeps us going, and what happens when businesses borrow the same ideas.
Matthew Keeley11/01/20264 min read - Engineering
Lean 4 and the Suspiciously Fast Website
Caching can make a website absurdly fast. It can also make a private draft absurdly public. A practical look at using Lean 4 to put a precise security contract around a performance optimization.
Matthew Keeley10/30/20268 min read - Vulnerability Research
Critical Use-After-Free in GraphQL-Ruby's C Parser
One unauthenticated query could crash a Ruby server and leak a live heap address. Nobody wrote this bug, which lived in the space between three correct decisions.
Connor Laidlaw08/04/20268 min read
Keep reading