John Daniel Kearney

I’m John Daniel Kearney, a frontier AI security and evaluation researcher in San Francisco. I find failures in the software used to judge, secure and deploy AI, then turn those findings into reproducible tests and accepted upstream fixes.

My work follows the trust boundary: what happens when a system lets untrusted input influence its own verdict, permissions or execution? I investigate that question across AI evaluations, agent infrastructure and hardware designs.

I founded AUTHENSOR and am a SPAR fellow working with Sampura Research. My work through AUTHENSOR has received support from the Foresight Institute and the Survival and Flourishing Fund.

Independent CVE discovery. CISA-cited research.

MLflow’s published advisory credits me as an independent finder of CVE-2026-64849, a webhook server-side request forgery vulnerability. CISA’s Known Exploited Vulnerabilities catalog cites my public disclosure and the maintainer’s fix. Read the finding, credit and CISA source record.

My reports and patches have also led to accepted fixes in NVIDIA garak, the UK AI Security Institute’s evaluation tools, SWE-bench, Promptfoo (now part of OpenAI), Google’s Agent Development Kit, and Presidio, originally developed at Microsoft. Inspect the reports, authored patches and maintainer implementations.

rtsilicon & hardware security

I built rtsilicon, an RTL security scanner for Verilog, SystemVerilog, VHDL, and Chisel/Migen. It flags patterns such as missing security-register resets, unsafe DMA address handling, and conflicting nonblocking assignments, with source locations, CWE mappings, and repair guidance.

My hardware work includes accepted contributions to Yosys, NEORV32 and PULP’s RISC-V Debug, covering formal proof obligations, CPU-stall behavior and debug-command correctness. I’m building 15 Research Lab for AI-assisted hardware research and physical AI safety testing.

Source · Detection rules · Tests · Hardware-security field guide

Selected contributions

• SWE-bench: printed PASSED lines could conceal failing tests. I contributed the initial fix; the maintainer refined and merged a check against the test command’s actual exit status. Fix and review.
• UK AISI / Inspect Evals: a fake verdict echoed from an agent’s history could displace the rater’s final verdict. I authored the parser correction. Merged fix.
• Promptfoo: missing grader verdicts could silently pass. I authored the correction: use a valid numeric score or return a grader error. Merged fix.
• NVIDIA garak: Unicode variants could evade literal detector matching. My report led to configurable normalization of detector triggers and model output. Report · Accepted change.
• Yosys: formal exporters could silently drop proof obligations in unlowered $check cells. My report led to rejecting those cells explicitly. Report · Accepted fix.
• NEORV32: an unmapped access could stall the CPU permanently when the external bus was disabled. My RTL review led to a maintainer fix that terminates the access. Report · Accepted fix.

More accepted work, with reports, patches, and merge receipts.

Research interests

• Evaluation integrity. Scoring errors, benchmark exploitation, and judges that can be persuaded to reward the wrong thing.
• Agent security. Prompt injection, tool permissions, and the gap between an agent’s instructions and what it can execute.
• Hardware and physical AI safety. AI-assisted review of hardware designs, formal tooling, and experiments that test how AI systems behave in the physical world. This is the venture I’m building at 15 Research Lab.
• Research infrastructure. Reproducible experiments and evaluation software whose results survive independent checks.
• Automated research. Agents that run experiments, test their own work, and produce improvements another researcher can reproduce.

At SPAR, I’m working with Sampura Research on datasets for evaluating the accuracy and robustness of human and AI safety judges.

Papers, research reports, and public tools, including The Evaluator Trust Boundary, Five Hops Through MCP, and rtsilicon.

Who is John Daniel Kearney?

John Daniel Kearney is an AI security and evaluation researcher in San Francisco. He founded AUTHENSOR, which works on AI evaluation integrity, and 15 Research Lab, for AI-assisted hardware research and physical AI safety testing. His papers are published as John Kearney under ORCID 0009-0008-1382-5139. He is a different person from the Daniel John Kearney credited in film and from others named John Kearney.

Contact

johndanielkearney { @ } gmail