M.S. Computer Science · University of Illinois Urbana-Champaign
Agentic security and cyber benchmarks for frontier models.
I build AI agents that find real vulnerabilities and benchmarks that measure the cyber capabilities of frontier models — from agentic vulnerability discovery in production Windows binaries (DeepBinary) to long-horizon security evaluation (SEC-bench Pro, CyberDual), now used by OpenAI, Google, DeepSeek, and NIST. This work grows out of Windows kernel vulnerability research at Enki WhiteHat (2024 — 2026).
Preprint · arXiv 2026
Agents act as attackers that embed exploitable vulnerabilities in open-source code changes and as reviewers that try to catch and repair them; re-running the attacker's proof of concept decides whether the exploit survives. 1,088 valid attacks from six attackers against three agentic reviewers.
Benchmark · 2026
Benchmarks AI agents on real Windows system binaries, scoring findings by executable evidence, security impact, and estimated bounty. Every zero-day found through this work has been reported to MSRC.
Preprint · arXiv 2026
Long-horizon security tasks in million-line systems — V8, SpiderMonkey, and the Linux kernel — including vulnerabilities with over $1 million in cumulative bounties. Adopted for frontier-model evaluation by OpenAI (GPT-5.5-Cyber, GPT-6 Astra), Google (Gemini 4 Carbon), DeepSeek, and NIST CAISI.
* Equal contribution
OffByOne 2025 · Singapore
COM as an under-reviewed Windows attack surface: the bugs behind AppContainer and Adobe Acrobat sandbox escapes, from discovery to working local privilege escalation.
Challenges authored for national competitions.
Highest-severity disclosures. 90 in total across Microsoft, Apple, and open source.
| CVE | Component | CVSS |
|---|---|---|
| CVE-2026-97814 | Windows Text Shaping — Remote Code Execution | 9.8 Critical |
| CVE-2026-70306 | Microsoft Office SharePoint — Spoofing | 9.3 Critical |
| CVE-2026-45504 | Microsoft Exchange Server — Elevation of Privilege | 8.8 High |
| CVE-2026-102225 | Windows Text Shaping — Remote Code Execution | 8.8 High |
| CVE-2026-70571 | Microsoft Exchange Server — Remote Code Execution | 8.1 High |
| CVE-2026-33840 | Win32k — Elevation of Privilege | 7.8 High |