I Built an AI Coding Harness Because I Got Tired of Paying the Smart Model to Type
A Claude Fable + GPT-5.5 Codex harness that spends Fable on judgment, Codex on execution, and the repo as memory.
AI security research / offensive engineering / statistical systems
A Claude Fable + GPT-5.5 Codex harness that spends Fable on judgment, Codex on execution, and the repo as memory.
Five years of building an open-source UFC prediction model, weights, database, and a pile of lessons about leakage, validation, calibration, and odds.
Watch unhinged AI play games, wager on who will win, influence the outcome with prompt injection, clip funny moments, and build your own multiplayer games.
A simple Kalshi mention-market bot, real PnL, the data behind it, and why I stopped.
Current-form fighter outliers, adjusted by division norms and fight logs.
Fight variables, ensemble modeling, feature pruning, validation, and confidence.
Training windows, recency weights, validation splits, and market drift.
Security automation, exploit research, Python tooling, AI systems, and old-school offensive utilities.
Featured project
Kalshi autotrading system and analysis pipeline for finding and trading prediction-market inefficiencies.
Autonomous LLM 0-day finder for Python codebases, centered on remotely exploitable vulnerability classes.
UFC fight predictor using a multi-model ensemble, Optuna tuning, SHAP-assisted feature pruning, and time-aware validation.
Collection of real-world AI/ML exploit material for responsibly disclosed vulnerabilities.
Wireless attack utility from the offensive tooling era: continuously jam Wi-Fi clients and routers.
Physical security bypasses and field stories with Justin Wynn.
2023-11-21AI security and the early shape of a new attack surface.
2024-10-25Finding 0-days with LLM-assisted research.
2024-02-13AI infrastructure vulnerability discussion covering Triton Inference Server and MLflow.
| Date | Talk | Notes |
|---|---|---|
| Security Weekly #416 - Python for Pentesters | Paul's Security Weekly technical segment. |
|
| NolaCon 2018 - Automahack | Python toolchain for automated domain admin. |
|
| Circle City Con - Automahack | Automating the path from zero to domain admin. |
|
| SAINTCON 2018 - Icebreaker.py | Gaining an Active Directory foothold from one compromised host. |
|
| BSidesSLC 2018 - Icebreaker | From internal jumpbox to domain admin in one command. |
|
| Coalcast Episode 5 | Conversation with Marcello Salvati and Dan McInerney. |
|
| How to Break into Commercial Buildings in America | Hackfort 2019 physical security talk. |
|
| ROOTCON - AI's Underbelly: The Zero-Day Goldmine | MLOps and AI tooling attack surface research. |
|
| AI/ML Bug Bounty Pro Tips | Practical guidance from AI/ML vulnerability triage. |
|
| I Hunt AI Engineers | Hackfort 2024 AI security talk. |
|
| Jailbreaking Gemini: Did We Just Uncover Data Leaks?! | Discussion of Gemini jailbreak behavior and possible data leakage risks. |
|
| AI Security: Vulnerability Detection and Hidden Model File Risks | Model file risk, vulnerability detection, and AI security discussion. |
|
| LLMs for Vuln Discovery | Finding 0-days with a click of a button, with Marcello Salvati. |
|
| SANS - Hacker's Perspective: Realistic AI Attack Scenarios | Practical AI attack scenarios for defenders and security teams. |
|
| Practical AI Security: Past, Present and Future | AI Talks appearance on the evolution of practical AI security. |
|
| Augmenting Your Offensiveness With AI | AI for offensive security with Marcello Salvati. |