Week Notes 2026-29
Date Published: 2026-07-20
🕒 Current
I'm searching for a security or software engineer role! If you know of or have an opening that fit my skills, feel free to reach out
I've been working through the Lakera Gandalf Password Reveal AI hacking challenge. It's been really fun! I'm on level 7 of 8, and will publish a writeup once I'm done.
📚 Read
Companies Are Throttling Employees’ AI Use Because It’s Too Expensive
Anyone who has listened to me talk about AI in the last couple of months will know my views on the AI "bubble" and how I think (and hope) It will pop. This is the first step that we could all see coming. AI models are getting too expensive, so all those layoffs related to AI are now becoming less cost effective. Not only that, the companies will eventually find that AI work is not high enough quality when compared to human work. We will get there, we just need to get through it now.
🎥 Watched
NahamSec - How I Made $30,000 Hacking Broken Access Control
Broken Access Controls are definitely my strongest area when it comes to hacking. This video is a good reminder to not stop as soon as you find a bug, and keep going and see if you can chain bugs together to get to account takeovers or mass PII exposure.
NahamSec - This Hacker Got Paid $50,000+ to Break Frontier AI Models
I love hacking AI and getting them to violate their guardrails. This video has some great techniques I've not seen before. One of the best things I learned was that LLMs typically trust their own output over user input. This means if you can get it to commit things you want to know about that are behind guardrails to it's context, it'll be more likely to provide them.
NahamSec - I Made an AI Agent That Reverses CVEs While I Sleep
CVE Reversing is a new concept to me, but definitely one that sounds right up my alley. Essentially, you check the latest CVEs (in this example he was specifically targeting Wordpress), examine them, and create a working POC you can use on bug bounty programs. Whether it's manual or using AI like in the video, this seems like a good entry point for me into the bug bounty space, given my experience as a software engineer.
🆕 Misc
Red Team & Blue Team book bundle
I grabbed this Red/Blue Team book bundle from Humble Bundle. There are a lot of really good books in here I can't wait to dive into! I'm particularly interested in the books on threat hunting, digital forensics, offensive agentic AI, and incident response.
I'm not able to make it to Defcon this year due to financial reasons, but this seems like a good resource and I'll definitely read through what they have when I go next year!
Jason Haddix and Arcanum Security set up this site with 71 free AI hacking labs! I'm very interested in prompt injection and general AI hacking, so this sounds fantastic! I will be working on these and doing writeups as I go.
I really don't like where Google is going with this decision. The gist is that in 2027 Android will block any apps that aren't "verified", including open source applications installed via other means such as the open source software in F-droid, or anywhere else you get apps other than the play store.
I've been slowly working on de-googling and this is a good reason to ramp that up. I plan to switch as many of the apps I use to self-hosted or open source alternatives — a process I've already started. The biggest change I plan to make is switching to a non-google version of Android, Graphene OS. These changes can only be enforced on their stock ROM, so using a different one prevents Google from controlling what you can and can't install.