Research

Zero Sum: 937 Bytes Stop sudo's Audit Log Server Forever

An unvalidated username field in sudo_logsrvd drives a line-wrapping budget to exactly zero, and one unauthenticated packet spins the root daemon forever.

21 Sept 2026Stanisław Kwiatkowski

Sixty-eight models agree, and none of it is the bug

sixty-eight open code models converge on a representation of vulnerable functions that does not contain the vulnerability

7 Sept 2026Maciej Cichoń

Reads the code but not the vulnerability

an unfitted reader of model activations cannot tell a vulnerable function from its own fix

15 Aug 2026Maciej Cichoń

Code written to be misread by an LLM

prompt injection, invisible unicode and adversarial rewrites aimed at the model reading your code

3 Aug 2026Maciej Cichoń