All Posts
BUILDING AN AUTONOMOUS SOC FOR FUN AND PROFIT
How I turned an academic paper into an Elastic Security-backed machine that investigates alerts, argues with itself, closes false positives and, most importantly, knows where the big red stop button is.
Incidents Are Free Eval Data
A Practical Ingestion Model for Agentic Pentesting Platforms
Two hackers got 5.5 years. OpenAI's agents got a press statement.
**Same conduct. Same statutes. Wildly different outcome. I run offensive AI operations for a living, and this is the asymmetry that should worry every practitioner doing the same.**
Million Dollar Fail Bonds: Trumps hackers for hire
The President just turned private companies into government-sanctioned cyber mercenaries, and the price of failure is a paltry $1 million
if ya know, ya know
Hacking needs a hiphop style 4 elements. Cracking, phreaking,???????
We Are Doing Agentic Offensive Security Wrong
The offensive security industry is attempting to build autonomous systems by wrapping human-oriented tools in model-friendly interfaces. That solves connectivity, but not cognition. Agentic offensive security requires a different design: token-aware outputs, typed facts, persistent graph memory, explicit uncertainty, structural isolation of target-controlled content, asynchronous execution, and scope enforcement below the model.
What It's Actually Like to Watch an AI Build a Real ML Project
There's a gap between the demos and the truth. Most AI agent showcases feature tightly scoped tasks, cherry-picked outcomes, and narrators who keep a careful distance from anything that might go sideways. What you rarely see is a multi-hour build session, with a real problem, real messiness, and real decisions, observed without a script.
The New Malicious
The most interesting malicious webpages of the AI era don't look malicious. They may not ask for a password. They may not drop malware. They may not redirect you to a phishing kit or exploit a memory bug. They sit quietly in plain sight: a portfolio page, a research page, a landing page, a joke, a manifesto, a demo. To a human visitor, nothing happens. To an AI system, everything happens.
The ad is the weapon
Most security researchers think about surveillance in terms of exploits. Someone compromises a device, intercepts traffic, or breaches a database. There is a victim, a vulnerability, and an attacker who crossed a line. The ad-tech surveillance surface does not work like that. Nobody crosses a line. Nobody breaks anything. The data flows exactly as designed, and that is precisely the problem.
40 Years of Encoding Flexibility: How BER Breaks Firewalls
In 1984, the International Telegraph and Telephone Consultative Committee published ITU-T X.690, a specification for encoding structured data on heterogeneous computer networks. The systems of that era were wildly different: mainframes, minicomputers, early personal computers. Memory was expensive and implementations were constrained. So the specification's authors made a pragmatic choice: they would allow the same piece of data to be encoded in multiple valid ways. A tag identifying a field could occupy one byte or five. A length value could be expressed in short form, long form, or not expressed at all. The goal was interoperability in a world of scarcity. They called it ASN.1 Basic Encoding Rules. BER.
Data Slavery: How Tech Giants Turn Us into Products
“Surveillance capitalism” is not just creepy ads following you around the web. In Shoshana Zuboff’s framing, it is a business model that treats human experience as raw material: companies capture behavior, turn it into data, use that data to predict what you will do next, and increasingly shape what you do next. Harvard’s summary of Zuboff’s work describes it as a “global architecture of behavior modification,” while WIRED’s coverage of her argument stresses that this system claims “the stuff of human nature” the way industrial capitalism claimed nature’s raw materials. That is the core point: the goal is not merely to observe people, but to render behavior legible, predictable, and profitable.
Psychological Warfare & AI
Examining how AI-tuned algorithms and specific UI frameworks like TikTok's are used as social manipulation tools to exploit user consumption and attention spans.
The syscall shaman, and the gospel of Exploit Pack
A deep dive into the creation and philosophy behind Exploit Pack, a raw and practical offensive security framework developed by Juan Sacco through years of botnet dissection and kernel research.
The Fragile Genius of Australia’s AI Defence Revolution
In the race to build a new AI-driven military, Australia’s tech wunderkinds are moving fast and breaking things. But what if the enemy is already inside the machine? A journey into the paranoid heart of the new digital frontline.