Security research, field notes, and practical experiments
Independent technical notes by Willis Vandevanter.
first, i think this is such a good post and i highly recommend reading it.
Before 2026, I kept a record of many of my CVE numbers, and every vulnerability represented a train of thought to me. In 2026, I stopped keeping a complete record of them, …
I was reading Cloudflare’s recent Introducing Adaptive Intelligence. the idea is a bot detection engine that continuously retrains …
Quote
“The Zero-Day Rate is now just under 87%, with a median time to exploit at just one day . . . but projected to reach 1 minute sometime next year.”
Quote
“This normally takes a few days and a release within a week or two is reasonable. Within about ten minutes (!) this website was fielding probes for percent-encoded traversal sequences, indicating that automated watchers are keeping an eye on public …”
Quote
“[Sama] estimates they’ll declare AGI achieved internally by December 2026.”
this is a great read by Christian Catalini. i have been enjoying recent discussions on where we see the economy/policy move for closed vs …
Quote
“We challenge these constraints by demonstrating that token-level iterative optimization can succeed without gradients or priors. We introduce RAILS (RAndom Iterative Local Search), a framework that operates solely on model logits. … Crucially, by eliminating …”
in previous posts we have looked at guardrail triggers, token burn, hostname beacons, malicious skills, context bombs, exploding search space, service sandbagging, GCG attacks, and making a working attack expensive to maintain. this time: coordination poison. …
in previous posts we have looked at guardrail triggers, token burn, hostname beacons, malicious skills, context bombs, exploding search space, service sandbagging, and making a working attack expensive to maintain. this time I want to ideate on a potential …
in previous posts we have looked at guardrail triggers, token burn, hostname beacons, malicious skills, context bombs, exploding search space, GCG attacks, and making a working attack expensive to maintain. this time: service sandbagging.
active defense is …