rethinking threat models when the cost is tokens not time
another by-product of anatomy of a frontier lab agent intrusion: a technical timeline of the july 2026 incident is that the adversary …
Security research, field notes, and practical experiments
Writing
Independent technical notes by Willis Vandevanter, published in reverse chronological order.
Recent writing
Bespoke C2 - LLM era
After reading the most recent hugging face incident report (Anatomy of a Frontier Lab Agent Intrusion: A Technical Timeline of the July …
MCP list caching and tool poisoning
The 2026-07-28 Model Context Protocol specification is out. One interesting addition for application security:
List results are …
Exploiting GraphQL Secondary Context Attacks
Misconfigured GraphQL implementations can allow for attackers to bypass authorization and access internal APIs. These “secondary context attacks” exploit the gap between GraphQL’s frontend interface and backend REST services, often turning …
Pulling Specific Files from the Trickest Inventory (or any Github project)
The @trickest Inventory project is an interesting resource. It has a …
Building on an AppSec Pipeline with Burp Suite data - Part 2
In this two part series we are going to take Burp Suite Project files as input from the command line, parse them, and then feed them into a testing pipeline.
The series is broken down into two parts:
- Getting at the Data (i.e. from the CLI to feeding the …
Building on an AppSec Pipeline with Burp Suite data - Part 1
In this two part series we are going to take Burp Suite Project files as input from the command line, parse them, and then feed them into a testing pipeline.
The series is broken down into two parts:
- Getting at the Data (i.e. from the CLI to feeding the …
SSRF Protocol Smuggling in Plaintext Credential Handlers : LDAP
SSRF protocol smuggling involves an attacker injecting one TCP protocol into a dissimilar TCP protocol. A classic example is using gopher (i.e. the first protocol) to smuggle SMTP (i.e. the second protocol):
1 …odle ruby gem: piping security data
I recently (May 2018) published odle which is a Ruby gem and binary that takes XML data from various security tools and outputs their JSON equivalent. The goal is …