Deep reconnaissance and adversarial research across your entire attack surface: the exposed infrastructure, AI and agent systems, supply chains, and cloud-native targets others miss. Deep manual work. Quiet output.
A few of the companies whose products we've broken, reported, and helped fix.
Apple
Grab
Tools for Humanity
Amazon
Visa
inDrive
PayPal
Yahoo
deptofdefense U.S. Dept Of Defense
AT&T
Recorded Future
T-Mobile
Microsoft
META
We don't run a scanner and hand you the output. We map what's reachable, read the code, understand the logic, and reason our way to impact.
Finding what you don't know is exposed. We map your entire internet-facing footprint with deep reconnaissance, surfacing forgotten subdomains, shadow IT, staging and admin panels, exposed APIs, and misconfigured services that were never meant to be reachable, then prove what an attacker does with them.
Breaking models and the agents around them. Prompt-injection into tool-calling chains, agent privilege escalation, jailbreaks that reach real systems, and trust boundaries no one ever drew on the diagram.
Compromising the thing that builds the thing. Dependency and build-pipeline attacks, artifact tampering, and the quiet trust every CI system extends to code it never really read.
Where the logic bends, we push. Business-logic flaws, multi-tenant isolation breaks, IDORs that chain to account takeover, and cloud misconfigurations that hand over the keys.
Vulnerability research, exploitation writeups, and notes from the field. New posts most weeks.
There's no single best way to do research with Claude. There are three. Here's the honest breakdown of when each one actually wins, and the research skill I built to make Claude Code the most rigorous of all.
Mehr lesen →First writeup after years of silence. The story of one bug on a small exchange that changed how I hunt, and opened the door to many vulnerabilities across the biggest names in tech.
Mehr lesen →If you're a vendor we tested or a researcher with a coordinated-disclosure question, send it over PGP. We respond within 24 hours.