Latest entry
October 11, 2026 - Lab notes - Findings - Kernel - updated October 15
Not the End of the World
We missed grsecurity and PaX, so we rebuilt the parts we loved — clean-room, on a current longterm kernel, as a stacking LSM plus modern mainline blockers. The fixed stack now passes 19 of 19 feature suites and 72 of 72 independent checks. Corrected fuzz campaigns add 20,000 structured mutations, 1.6 million concurrent policy writes, 900 randomized W^X sequences and more than 2.25 million Syzkaller programs with no reported kernel finding or crash — while preserving the limits the oracles could not settle.
Read full post
Lab notes
September 24, 2026 - Lab notes - RF - updated September 25
Fish Finder: Teaching FALCON to Find Its Own Towers
The follow-on to Fishing in an RF Ocean: FALCON becomes Falcon-GSG and learns to scan LTE bands for towers on a HackRF Pro, rank what it finds, and confirm each cell with two agreeing MIB decodes. The first live sweep found nothing, a second turned up a ghost at 2147.3 MHz that pruned away the real cell, and a crew of three AI agents kept running out of fuel along the way. Since then: a USB cable pulled mid-sweep, a band that could not make up its mind, and a Scan tab in the GUI whose first real clicks found two bugs the tests missed. The finder now returns exactly one cell, PCI 201, on a live GUI sweep.
Read full post
Lab notes
September 18, 2026 - Lab notes - RF
Fishing in an RF Ocean
The follow-on to A Peak Is Not a Decode: after the MIB recovery work hardened FALCON's HackRF receive path, the current build gets FalconEye on PCI 201 at 2147.5 MHz to MAC/RLC PCAP, paging S-TMSI CSV, and DCI-0 uplink-grant CSV. The line is now clear: downlink-derived grants are working; Msg3 waits on a second simultaneous uplink receiver.
Read full post
Live build log
September 15, 2026 - Live build log - updated September 17, 14:14 PDT
A Peak Is Not a Decode
The line finally moved twice. On a live 75-PRB LTE carrier at 2147.5 MHz, FalconEye acquired PCI 201, accepted two agreeing CRC-valid MIBs, processed PDCCH/DCI candidates across 3,715 real subframes, and reported six active-RNTI candidates through a HackRF Pro. Now FalconGUI reaches the same live path too: RF Args defaults to driver=hackrf, fixed gain is exposed, and the GUI has been verified reaching MIB decode, PDCCH/DCI tracking, changing RNTIs, live charts, and RB waterfalls. Gate 6 recovery is bounded but not closed; 19/19 focused tests pass, and known-grant DCI plus endurance remain open.
Read full post
Findings
September 11, 2026 - Findings
The Harness Already Had a Reader and a Writer
HourGlass's agent loop splits into a planner (acts) and an executor reviewer (reads, reasons, never acts) — and both had always defaulted to the same model on the same host, while the public API refused code-execution tools and loopback targets outright, three separate hardcoded ways, regardless of who asked. We turned the split on for real, gated by the request's actual network origin rather than anything it claims about itself, and ran it against a live target for the first time: same task, same budget, only the reviewer model differs. The small-model baseline got a broken socket call and repeated it five times until its round budget ran out. The stronger-reviewer arm caught the same failure once, changed approach, and got a real answer back in a quarter of the time. n = 1 per arm — a first signal, not yet a result.
Read full post
Findings
September 10, 2026 - Findings
Hands, Not Brains
Before pointing the harness at a real exploit-development benchmark, one question needed a straight answer: can a small local model actually do any of this? A 3B coder and a small reasoning model, measured against a self-grading difficulty ladder and real CVEs pulled from ExploitGym. The line came out clean: the coder transcribes exploit code fluently and reasons about the vulnerability not at all — it builds a ROP chain from an exact spec, then flattens an integer-overflow bug and a use-after-free both into “buffer overflow,” and never signals it has left its depth. Small models are the hands, not the brain.
Read full post
Findings
September 9, 2026 - Findings
Bounded Evidence: A Sealed Question for a Small Reader
We handed the small model a sealed evidence packet instead of a terse prompt over a raw transcript — AaronCTI’s bounded evidence-context idea, dropped onto our Phase 2 CTF harness. It fixed every read: model-parse success jumped from 16 of 36 to 36 of 36, zero fallbacks. And the objective score didn’t move a point, because the validation loop was already catching the misreads the packet prevents — the win is real, it just lands on the read metric, not the scoreboard. Preregistered, and run by two frontier models in separate lanes: Codex (GPT-5.5) on the A/B, Claude (Opus 4.8) on the harness.
Read full post
Live build log
September 4, 2026 - Live build log
Phase 2: The Chained CTF
Phase 1 was ten independent locks; Phase 2 is one chain — twenty rungs where every step rolls into the next: daemons, network pivots, a hash dump and break, ending at root on the final host. New machinery — a blackboard of validated facts and a validation/backtrack loop — drives it. The deterministic chain reaches root 20/20; handed to the frozen model, it reaches root in 4 of 6 runs, because a bad read is caught and retried instead of believed. A live build log, start to finish.
Read full post
Findings
Published September 4, 2026 - Work in progress
Teaching the Brush
Our small model clears the whole web-exploit ladder alone, then faceplants at binary exploitation — it charges in, fires an exploit with a made-up offset and the wrong address, and can't read the disassembly that holds both. Not knowledge, not safety — a hands gap. So we're trying to install that one narrow skill with a tiny per-rung adapter trained on actions, not prose, with the harness generating its own training traces. The full binary ladder falls (plain → canary → PIE → ROP → ret2libc → full-mitigation), then a true test: unseen binaries, one generic sentence. It solves 5 of 6 — and the eval caught a real overfit and pinned the ceiling to one thing: the harness’s procedure generalises, but the model’s read is the fragile link.
Read full post
Findings
Published September 4, 2026 - Findings
It Learned About Drawing But Can't Hold the Brush
A controlled result that fell out of the harness work: fine-tuning a small model on ~50 GB of security text made it more fluent about security and less able to do it. Same architecture, same size — the finetuned model loops and emits placeholders where its own stock base authors the exploit 3/3. Knowledge up, agency down, and invisible to any eval that only measures knowledge. A warning for “just finetune it on more domain data.”
Read full post
Findings
Published September 4, 2026 - Findings
The Authoring Boundary Scales
The wall for a small agentic model is authoring (constructing a novel input) versus routing (invoking a pre-built tool). Run the security ladder with all scaffolding off and that wall turns out to be a dial, not a small-model law: a stock 3B authors the web-exploit tier on its own, a 4B does it cleanly, and only the knowledge-finetuned 3B fails outright. Capability, not size, moves the line.
Read full post
Field note
Published September 3, 2026 - Field note
Self-Learning Security Harnesses with Small Models: Yay or Nay?
We put a small security-tuned model inside an agentic harness, gave it a real toolkit behind a scoped API, and pointed it at a sealed practice target with one textbook flaw. The first result said the model fabricates flags. It doesn’t — four stacked scaffolding bugs were hiding a sharper limit. Once the model was actually consulted, it picked the right tool and scanned correctly, then re-ran the identical scan four rounds running and never escalated. The ceiling isn’t tool skill or honesty; it’s that the model won’t read its own results into its next move.
Read full post
Programme III
Published August 26, 2026 - Programme III - corrected September 1 - updated September 3
Sounder: A Model That Knows When It Is Done
Forty-three experiments produced a set of external scaffolds — a chaining harness, a terminal token, an encoder gate — and each one turned out to substitute for a signal the model does not produce about itself. Sounder makes four of them trained outputs. Halfway through training, the verdict on whether the thinking costs more than it returns arrived, held for three days, and then reversed: it had been measured on text both models had already memorised. On text neither had seen, the sign flips. A data-loading bug caused both readings, and means neither one settles it.
Read full post
Series - Phases II through IV
Published August 25, 2026 - Programme II - updated August 27 - field note September 3
Ask It Twice: The One Step a Frozen Model Cannot Take
A detachable 9.68 MB adapter stores facts perfectly and cannot reason across them in one pass — ask twice and it scores 100%. Scaled ninefold, retrieval never missed a question and the adapter lost fifteen percent of its own corpus. It can describe itself, too — and the first version of that scored a perfect 1.0000 while carrying no information at all.
Read full post
Series - Phase I
Published August 22, 2026 - Experiment 0
Inference Should Learn: An Experiment in Dynamic Memory for Language Models
Testing whether a frozen reasoning model can write, recall, reason with, and forget synthetic knowledge after a detachable parameter update.
Read full post
Archive entry
Published April 4, 2026 - Pulse
Pulse: Municipal Data Ingestion and Correlation for City Oversight
Rewritten against the running system: twenty collectors feeding an 801 MB evidence corpus, a nine-rule detection engine, and a firewall that keeps the language model from ever deciding what a reviewer gets to see.
Read full post
Archive entry
Published March 15, 2026 - AEGIS
AEGIS: The App Suite Behind the Intelligence Platform
A detailed walk through the on-prem service stack, from Telegram and RSS ingestion to graph analysis, semantic search, alerts, and operator automation.
Read full post