Drinor was awarded $150,000 for CVE-2026-20685 targeting Apple's Private Cloud Compute, the inference backbone of Apple Intelligence capabilities. This work is my contribution to Sentry's AI Security research initiative, run through SARC, the Sentry Applied Research Center. Our SARC focuses on evaluating systems that carry

How pwn.ai turned a routine client pentest into multiple ImageMagick zero-days. By autonomously researching the product’s internals for days, it found a path from a single image upload to file leaks, security policy bypasses, and remote code execution across a wide range of default and real-world configurations.

After a long week, the Eye Security Research Team thought it was time for a small light-hearted distraction. So we rooted Copilot.

For decades, many bug hunters and security pros have used manual testing, static analysis, and fuzzing to find vulnerabilities. Enter the age of AI. Many are skeptical, but when I look around I see more and more evidence that it's not "going to be" a...

Recently I ran an experiment where I built agents on top of Opus 4.5 and GPT-5.2 and then challenged them to write exploits for a zeroday vulnerability in the QuickJS Javascript interpreter. I adde…