Posts

2026

Manifold: Chaining Seven Proxy Layers Into a Single Transparent LLM Pipeline Jul 29 Every LLM proxy tool you install — a redactor, a router, a rate limiter, a cache — spins its own HTTP server. Each one speaks … 6 minutes llm-agents
DAEDALUS — A Security Research Control Plane for Apple's Container Runtime Jul 28 What is DAEDALUS? DAEDALUS is an open-source security-research control plane built on Apple’s container runtime. It exploits a unique … 8 minutes
Fake recruitment, remote JSON payloads, and function-inliner malware (analysis) May 19 Clone-and-run recruitment lures that pull obfuscated Node.js from jsonkeeper-style hosts: IOCs, SHA-256 hashes, a small fetch script, function-inliner teardown, MITRE mappings with links, and what to do if you already ran the artifact. 12 minutes
Local-Splitter: Cutting Cloud LLM Costs by Putting a Small Model in Front Apr 15 Cloud LLM tokens are expensive. Not in the “my AWS bill is high” sense — in the “I’m burning $0.015 per 1K … 4 minutes llm-agents
LLM-Redactor: What Leaves Your Prompt When You Talk to a Cloud LLM Apr 15 Every time a coding agent sends a prompt to a cloud LLM, the full content of that prompt — your code, your credentials, your customer … 5 minutes llm-agents
Resilient Write: Giving Coding Agents a Write Path That Doesn't Break Apr 12 If you’ve spent any time watching an LLM coding agent work, you’ve seen it happen: the agent generates a perfectly good file, … 5 minutes llm-agents
What Leaves Your Workstation When You Use an LLM Coding CLI Apr 11 TL;DR I put five LLM coding CLIs through a transparent TLS-intercepting proxy for about three and a half hours in a lab environment and … 17 minutes llm-agents
Ollama-Forge for Security Research: Local Models, Refusal Ablation, and Reproducible Pipelines Feb 16 Introduction Security work often involves prompts and data you cannot send to commercial APIs: malware descriptions, exploit drafts, … 7 minutes llm-agents
Unlocking the Vault: A Deep Dive into macOS ARM64 Trial Enforcement and Binary Patching Feb 1 Introduction In the course of analyzing a decompiled macOS productivity application—a calendar and meeting alert utility with a time-limited … 7 minutes

2025

Malicious Code Loading via Base64 Encoded .dex File Nov 10 Introduction In the course of analyzing a decompiled Java application, we encountered an unusual code segment that decodes a Base64 encoded … 2 minutes

Older posts →