I visited Seoul in South Korea to take part in Google’s AI Bugswat LHE. I spent the entire event on a team with STÖK and Busfactor. We came 2nd overall, which was much better than we expected to do, and we also got Most Creative (STÖK’s bug) and Most Novel Prompt Injection (my bug). This is busfactor and I’s second consecutive 2nd place (first was Mexico in October), and we beat some hackers that I never thought we’d beat in a million years, so I’m surprised and really happy by how it went. We’ll be writing up some of our bugs.

Next up for Busfactor and I is another Google event in June, in Dublin! It’s weird to me to see a LHE come to home turf (Ireland), but it’s also very exciting for me. I’ve been planning out what I need to do in preparation for that event. The scope will probably be a lot more technical, so I have a lot of work to do beforehand.

I’ve been watching Karpathy’s Zero to Hero playlist for neural networks, and it’s been really interesting. Understanding how it works mathematically is satisfying. I’m trying to fill in the blanks in my knowledge of ML and LLMs, and it all starts from the basic building blocks. Somehow I’ve been enjoying the calculus as well. I tried to study neural nets when I was a teenager, but only now do I have the knowledge and skillset to truly appreciate them and study them properly.

I’ve been implementing his LLM wiki blueprint using Claude. I don’t use AI nearly enough day-to-day. I’m focusing more on self-augmentation now than replacing what I do. I refuse to turn myself into a copy and paste monkey that just transfers AI-completed work between various LLMs. So far, it’s been very impressive - the wiki is an Obsidian repository residing on my password-protected portable SSD, and I have a simple Go-based CLI utility for updating it and linting the contents.

I’m putting my entirely separate bug bounty wiki (with the same codebase for interacting with it - a CLI and Claude Code commands) on Obsidian Sync so I can access it from anywhere. Opus 4.6/4.7 is very good at managing the wiki linting and such. Yes, I could implement something like Obsidian Sync myself, but they make it so easy to sync everything, so I just paid up for the sheer convenience.

I’ve gotten a fixed desk in Edinburgh’s main tech startup hub. I moved one of my monitors into it. I’m hoping to move to a new apartment a bit closer to the office soon. My current place is alright, but it’s too expensive and it’s quite far from the city centre. I’m really enjoying having my own office, it forces me to be productive. The next step for my startup is to talk to as many people as I can.

How I Got Into Starbucks' Internal Network using a non resolvable hostname: A bizarre behaviour with absolute URIs led to SSRF in Starbucks.

The Agentic Hacking Era: Ramblings and a Tool: rez0’s notes on agents.

Zero Days, Zero Truths: Brutelogic’s article on the validity of the Mythos model’s cybersecurity capabilities. It’s very well written and well sourced. A fantastic read - we don’t see articles of this quality too often.