AI security research and contributions

The public record

My research produces findings maintainers can reproduce and fixes that reach upstream. The record includes independent-finder credit for MLflow CVE-2026-64849, a public disclosure cited by CISA, and accepted changes across AI evaluation software, agent infrastructure, privacy tools and hardware.

I conduct AI evaluation and agent-security research through AUTHENSOR, alongside my separate hardware work. Some changes are patches I authored; others were implemented by maintainers after my report or proposed fix. Each entry links to the upstream evidence and explains my role.

AI evaluation, privacy, security and software

• Promptfoo, now part of OpenAI: rubric grading

  I authored a fix so missing grader verdicts no longer silently default to passing: usable numeric scores determine the result, while missing or malformed scores produce a grader error.

  Merged PR #10611 · About Promptfoo

  Technical note: missing verdicts, numeric scores and grader errors.

• SWE-bench: forged test results

  I identified a way for printed PASSED lines to conceal failing tests and contributed the initial fix. The maintainer refined and merged a check against the test command's actual exit status.

  Merged PR #620

  Technical note: why a PASSED line is not a passing test.

• UK AI Security Institute / Inspect Evals: oversight verdict parsing

  I authored a fix for the GDM Stealth strategic-rule-breaking evaluation so an earlier fake verdict echoed from agent history does not override the rater's final verdict.

  Merged PR #1992

• UK AI Security Institute / ControlArena: chain-of-thought boundaries

  I authored a change that wraps and escapes the monitored model's reasoning, preventing its closing tags from breaking the monitor prompt's structural boundary.

  Merged PR #810

• UK AI Security Institute / ControlArena: tool-call boundaries

  I reported and patched unsafe formatting of agent-generated tool arguments. My code was adopted into a maintainer PR that serializes arguments as JSON and escapes text inside monitor tags.

  Report #791 · My patch #795 · Accepted #798

• UK AI Security Institute / ControlArena: suspicion-score parsing

  I authored the fix for prose ratios such as 3 out of 10 being read as 10 instead of 3; the maintainer adapted it into the main branch.

  My PR #825 · Main-branch landing #885

• UK AI Security Institute / Inspect AI: grade-marker correctness

  My report and proposed patch led to a repair that distinguishes GRADE from words such as downgrade, tolerates common invisible formatting characters and normalizes default-parser verdicts.

  Report #4283 · Accepted #4297

• UK AI Security Institute / Inspect Evals: SimpleQA scoring

  I authored a fix allowing the optional original scorer to recognize decorated grades such as B. instead of treating them as “not attempted,” with explicit parsing modes and preserved raw grader output.

  Merged PR #1812

• UK AI Security Institute / Inspect Cyber: checkpoint scoring

  I authored a fix that scores checkpoints by position so duplicate names cannot erase recorded progress; the regression preserves a half-completed score of 0.5 instead of collapsing it to 0.0.

  Merged PR #114

• Meridian Labs / Inspect Scout: validation metrics

  I authored a correction to per-label confusion matrices for dictionary-valued targets, using each label's actual truth value rather than treating the entire nonempty dictionary as positive.

  Merged PR #473

• NVIDIA garak: Unicode evasion

  My report led to a merged option that normalizes detector triggers and model output using NFKC, optionally removing invisible format characters. The capability is configurable rather than enabled by default.

  Report #1867 · Accepted #1884

• Google Agent Development Kit: inbound message roles

  I reported and proposed a fix for caller-controlled message roles. The accepted implementation wraps incoming messages as user turns, preserving the caller's object and supporting frozen content types. The final implementation landed through a maintainer commit.

  Report #7142 · My patch #7143 · Landed commit

• MLflow: CVE-2026-64849, webhook DNS rebinding / SSRF

  Research case study: independent discovery, upstream repair and CISA citation.

  The published advisory credits me as an independent finder under @AUTHENSOR. I independently discovered and publicly reported the vulnerability; the advisory assigns original discovery priority to freeman-bb.

  My report led to a maintainer-implemented fix by PattaraS that validates the actual connected peer’s IP before sending webhook traffic, closing the gap between an initial DNS check and a later connection to an internal address.

  CISA added the vulnerability to its Known Exploited Vulnerabilities catalog on August 19, 2026. The catalog entry cites my report #24179 and the maintainer’s fix #24258.

  Advisory and independent-finder credit · My disclosure #24179 · Maintainer fix #24258 · CISA KEV catalog · CISA source data

• Presidio, the Microsoft-origin privacy toolkit: IBAN coverage

  I authored recognition formats and tests for bank-account identifiers from Egypt, Iraq, Libya, Saint Lucia, Seychelles and Ukraine.

  Merged PR #2078

• Presidio, the Microsoft-origin privacy toolkit: internationalized email

  I authored a pattern correction so email addresses with punycode domains, including xn-- forms, are detected.

  Merged PR #2077

• Presidio, the Microsoft-origin privacy toolkit: Spanish identifiers

  I authored a fix that normalizes NIF/NIE identifiers before checksum validation, allowing valid lowercase forms to be detected.

  Merged PR #2076

• Presidio, the Microsoft-origin privacy toolkit: sample exclusions

  I authored a recognizer correction separating invalid-prefix checks from exact sample-SSN exclusions, preventing an incomplete sample literal from suppressing a broader family of SSN-shaped strings.

  Merged PR #2074

• EleutherAI / Delphi: interpretability labels

  I authored a parser fix that selects the explainer's final explanation line instead of absorbing an earlier echoed or injected marker and the remaining reasoning.

  Merged PR #179

• EleutherAI / LM Evaluation Harness: sample-count reporting

  My report and reproduction harness led to order-independent effective sample-count reporting and warnings about mismatched metric counts. This accepted change improves reporting without changing aggregate scoring.

  Report #4062 · Accepted #4068

• Fabric: command injection

  I authored a fix that shell-quotes extension input values before they are inserted into commands, treating shell metacharacters in supplied content as data.

  Merged PR #2152

• Instructor: structured-output parsing

  I contributed the parser repair adopted into a maintainer consolidation: select the final complete top-level JSON candidate rather than an earlier echoed or injected object.

  My patch #2424 · Accepted #2434

• ComfyUI: credential logging

  My report and proposed patch led to redaction of Authorization and X-API-KEY request headers in API logs.

  My patch #14732 · Accepted #14774

• ModelScope / EvalScope: verdict extraction

  My report led to stricter AIME Yes/No parsing and AIR-Bench score-line parsing, with visible parse failures instead of treating arbitrary words or numbers in the judge's prose as the verdict.

  Report #1578 · Accepted #1588

• ModelScope / EvalScope: evaluation reliability

  My follow-up report led to single-pass judge-template substitution, isolated seeded bootstrap randomness, explicit metric-failure handling and complete-answer matching.

  Report #1697 · Accepted #1702

• OpenCompass: deceptive return values

  My report led to type-aware comparisons in code evaluators, preventing model-returned objects from earning credit merely by overriding equality to return true.

  Report #2535 · Accepted #2565

• AG2: approval and context boundaries

  My report and initial A2A patch led to filtering of reserved control keys across four agent transports, preventing remote peers from pre-setting approval-bypass or tenant state.

  Report #3255 · My patch #3256 · Accepted #3286

• Blender MCP: safe-mode enforcement

  My report led to updated restrictions covering Blender's current script-directory collection and extension-installation operations, closing specific gaps left by an outdated property blocklist.

  Report #365 · Accepted #368

• x402 Foundation: payment attribution controls

  My report led to TypeScript and Go changes rejecting undeclared or mismatched server-owned app attribution. The Go change covers the resource server; direct facilitator calls remain a separate boundary.

  Report #3299 · TypeScript #3313 · Go #3302

• Vercel AI SDK: fail-closed policy decisions

  My report led to rejection of unsupported non-null OPA policy results, preventing malformed decisions from silently bypassing a protected tool's approval gate. Nullish and explicitly not-applicable decisions retain their documented behavior.

  Report #19978 · Accepted #19981

• Vercel AI SDK: MCP tool metadata

  My report led to preservation of MCP safety annotations during tool conversion, plus an application-level approval example. The accepted change exposes the metadata; it does not automatically enforce approval from server hints.

  Report #20184 · Accepted #20287

• CopilotKit: debug exposure and authorization guidance

  My report led to tightening of debug-event access so an unset or arbitrary non-production environment no longer enables it, alongside documentation of application authorization responsibilities. Explicit debug mode and the development environment remain permitted.

  Report #7198 · Code #7210 · Documentation #7214

Hardware, RTL and formal tooling

These contributions to hardware design, RTL and formal tooling are part of my personal engineering work. I’m building 15 Research Lab for AI-assisted hardware research and physical AI safety testing. More on the research page.

• YosysHQ / Yosys: Verilog expression semantics

  I authored a correction making exponentiation right-associative, matching the Verilog language standard.

  Merged PR #6140

• YosysHQ / Yosys: signed-net metadata

  I authored a JSON-reader fix that preserves signed internal-net metadata through export and reimport, with a roundtrip regression.

  Merged PR #6141

• YosysHQ / Yosys: formal proof obligations

  My report led to SMT2 and BTOR exporters rejecting unlowered $check cells instead of silently dropping their proof obligations.

  Report #6108 · Accepted #6117 · Case study

• NEORV32: VHDL array consistency

  I authored a maintenance change normalizing non-memory bus and list array ranges to descending order.

  Merged PR #1622

• NEORV32: remaining array conversions

  I authored the follow-up converting remaining list arrays and positional aggregates to named associations while preserving instruction-decoder search order.

  Merged PR #1632

• NEORV32: unmapped-access CPU stall

  My RTL review report led to a maintainer fix ensuring unmapped accesses terminate when the external bus is disabled, avoiding a permanent CPU stall.

  Report #1633 · Accepted #1634

• PULP Platform / RISC-V Debug: hart-selection consistency

  My report led to binding abstract debug commands to the hart selected when the command is admitted, with restrictions on selection changes while busy and multi-hart regression coverage.

  Report #203 · Accepted #204

Other software

• BoTTube: Atom and RSS feeds

  I authored an Atom 1.0 feed and RSS blueprint refactor, which the maintainer credited and cherry-picked into a replacement PR.

  My patch #151 · Accepted #154

  The repository was unavailable at the October 13 check, so both links go to Internet Archive copies of the pull requests from May 30, 2026.