Archive.
This index collects my projects, writing, talks, interviews, and press coverage.
Projects
- Hacker Spirit Scholarship$2,500 annual scholarship at my alma mater for students who fix things they're not supposed to.
- iVerifyiOS/Android compromise detection. Incubated at Trail of Bits, spun out as a standalone company.
- Algo VPNPersonal VPN server you can stand up in 15 minutes. Recommended by The New York Times.
- Empire HackingI started this NYC security research meetup in 2015, with meetings every two months.
- CTF Field GuideOpen-source training material for security competitions, adapted from training Trail of Bits ran for the US military service academies.
- THREADS Research ConferenceAnnual security research conference I organized at NYU CSAW from 2012 to 2014.
Press
- How to Get from AI-Assisted to AI NativeTim O'Reilly's Ai4 keynote draws on our approach to AI adoption at Trail of Bits.
- Cybersecurity experts say AI giants are shutting them out of safety plansAs AI labs turn to METR for oversight, I challenge their framing of cybersecurity failures as AI misalignment.
- AI as an Enterprise Operating SystemTim O'Reilly examines how we rebuilt Trail of Bits around AI.
- How OpenAI's human mistake led to the AI-powered hack on Hugging FaceI discuss the containment failure that let OpenAI's models attack Hugging Face.
- Ordinary Engineers, Not Heroic InventorsTim O'Reilly draws on our experience to explain how companies can put AI to work.
- OpenAI Launches Full-Scale Effort to Patch Open-Source Bugs as It Takes on Anthropic's MythosCoverage of Patch the Planet, the open-source security initiative I lead with OpenAI.
- The Hacker Sent by Anthropic to Calm the Government's Nerves About AI SafetyTrail of Bits helped Anthropic process the hundreds of bugs its Mythos model found.
- NYU Tandon Celebrates Alumni at Inaugural SummitReceived the Professional Achievement Award.
- Your iPhone Gets Stolen. Then the Hacking BeginsThe underground economy that turns locked phones into unlocked ones.
- Attack of the killer script kiddiesOn AIxCC and the AI agents that find and patch bugs at scale.
- Anthropic Races to Contain Leak of Code Behind Claude AI AgentWhy the Claude Code leak is embarrassing but not dangerous.
- Trail of Bits wins big at DARPA's AI Cyber Challenge$3M for second place in DARPA's AI Cyber Challenge.
- DARPA's AI Cyber Challenge reveals winning models for automated vulnerability discovery and patchingTrail of Bits placed second at DARPA AIxCC, $3M prize.
- Hackers abuse Zoom remote control feature for crypto-theft attacksCoverage of the ELUSIVE COMET attack and how we caught it.
- Zoom's Remote Control Feature Exploited in ELUSIVE COMET AttacksThe social engineering attempt against me became our published research.
- How the Biggest Crypto Hack Ever Nearly Destroyed BybitWhy blind-signing crypto transactions did Bybit in.
- CSAW turns 21 ... with powerful partnerships and new programmingNYU's anniversary profile on my long history with CSAW since 2003.
- DARPA competition shows promise of using AI to find and patch bugsOn what it actually takes to compete in DARPA's AIxCC.
- Twitter's encrypted DMs are missing basic security features
- Cryptocurrency tech is vulnerable to tampering, a DARPA analysis findsOur DARPA report on how concentrated Bitcoin and Ethereum infrastructure really is.
- It's Time to Stop Paying for a VPNWhy most people don't need a commercial VPN, and why Algo works.
- Zoom Hires Security Heavyweights to Fix Flaws
- Audit finds severe vulnerabilities in Voatz mobile voting app
- This App Will Tell You If Your iPhone Gets HackedLaunching iVerify, a consumer tool for detecting compromised iPhones.
- The Hacking Box That Led to a Golden Age of iPhone Investigations
- AMD Has a Spectre/Meltdown-like Security Flaw of Its Own
- How I Made My Own VPN Server in 15 Minutes
- What's Really at Stake in the Apple Encryption Debate
- Apple's FBI Battle Is Complicated. Here's What's Really Going On
- Newer Phones Aren't Easy to Crack
- Trail of Bits: An Alliance of Infosec Heavyweights
- A Brooklyn Lab's Deviant Magic
Talks
- 200 Bugs/Week/Engineer: How We Rebuilt Trail of Bits Around AI
- The State of AI/ML Security: Myths vs RealityCutting through the hype on AI/ML security.
- Financial industry exposure to AI-enabled cyberattacksBriefing the CFTC's Technology Advisory Committee on AI threats to financial markets.
- What Blockchain Got RightWhat's worth keeping from a decade of crypto.
- Understanding crypto markets securityBriefing the CFTC TAC on how crypto markets get compromised.
- High-Assurance Code Reviews: How Consulting Works When the Risks Are High (Keynote)
- Securing Value on the Ethereum Blockchain
- Modern iOS Application Security
- The Smart Fuzzer Revolution (Keynote)
- The Exploit Intelligence Project Revisited (Keynote)
- The Mobile Exploit Intelligence Project
- The Exploit Intelligence Project
- So You Want To Train An Army Of Ninjas
Podcasts & Interviews
- A Playbook for Going AI NativeThe O'Reilly encore of my [un]prompted talk, plus 40 minutes of audience Q&A.
- Sponsored: Trail of Bits and OpenAI patch the planetI talk with James Wilson about how Patch the Planet helps open-source maintainers.
- Dan Guido, Trail of BitsDerek Hsue got the Trail of Bits story out of me: eight months without revenue, the DAO hack, and hiring for mastery.
- Risky Business #835: WhatsApp private AI inferenceOn private AI inference and our audit of WhatsApp's setup.
- Sponsored: Trail of Bits going all-in on AIOn rebuilding Trail of Bits around AI agents.
- Mic Drop: The ego exploitHow a mundane Zoom feature became a hacker's best friend.
- Sponsored: Trail of Bits on post-quantum cryptography
- What the hell are the blockchain people doing & why isn't it a dumpster fire?
- DeFi and Memecoins: The Fastest, Riskiest Way to Get Rich in Crypto
- Q&A with Trail of Bits Co-Founder Dan GuidoLong-form on running Trail of Bits, blockchain audits, and where the bugs come from.
- Fixing Software, Not Bugs
- Meet Algo, your personal VPN in the cloud
- Interview with Ed Amoroso
- Attacker Math and Exploit Intelligence
- Interview with Dan Guido
Writing
- 1Password's AI patching benchmark is misleadingWe show why bad instructions and faulty grading make 1Password's headline unfit to guide defenders.
- How we made Trail of Bits AI-native, so farWhere we are after a year of rebuilding the company around AI agents.
- Trail of Bits' Buttercup wins 2nd place in AIxCC ChallengeSecond at DARPA AIxCC, $3M prize. Autonomous bug-finding works.
- The Unconventional Innovator Scholarship
- Mitigating ELUSIVE COMET Zoom remote control attacksAnatomy of the social engineering attempt against me.
- The $1.5B Bybit Hack: The Era of Operational Security Failures Has ArrivedThe biggest crypto heist in history wasn't a smart contract bug.
- Trail of Bits Advances to AIxCC FinalsTop 7 of 39 in the AIxCC semifinal.
- Trail of Bits' Buttercup heads to DARPA's AIxCCOur AI cyber reasoning system enters the DARPA competition.
- iVerify is now an independent company
- How AI will affect cybersecurity: what we told the CFTC
- What we told the CFTC about crypto threats
- Our full report on the Voatz mobile voting platform
- Introducing iVerify, the security toolkit for iPhone users
- Trail of Bits donates $100,000 to support young researchers through Summercon
- The smart fuzzer revolution
- Meet Algo, the VPN that works
- Why I didn't catch any Pokémon today
- The DBIR's Forest of Exploit Signatures
- Apple can comply with the FBI court orderThe post that coined "FBiOS" during the San Bernardino standoff.
- Why we give so much to CSAW
- Empire Hacking
- Education initiative spotlight: CSAW summer program for women
- A Case Study of Intelligence-Driven Defense