Director of Research **Published:** Wednesday, 5 August 2026 at 19:30 UTC **Updated:** Wednesday, 5 August 2026 at 19:33 UTC Abstract We all know AI can find bugs. After a decade of research, I asked a harder question: can an autonomous system invent new attack techniques, and use them to hack […]

DoGNAVY is a joint AI security harness by deepsec@DARKNAVY and independent security researchers based in Shanghai. In a full CyberGym Level 1 evaluation, it passed 1,369 of 1,507 tasks (90.84%). ## Abstract This report presents DoGNAVY, an agentic system for vulnerability reproduction, and documents its evaluation on the complete CyberGym […]

# LLM Heist: Hijacking LiteLLM for Traffic Interception, Key Theft, and Tool-Call Injection LiteLLM is a popular AI gateway. It provides a unified interface to LLMs and simplifies governance. It also has access to the backend LLM provider keys. **All of that makes it a high-value target.** Not only for […]

Redirecting to https://www.darknavy.net/whitepaper/Embodied-AI-Security-Humanoid-Robots-2604.pdf. Securing Embodied AI: A Technical White Paper on Humanoid RobotsRedirecting to https://www.darknavy.net/whitepaper/Embodied-AI-Security-Humanoid-Robots-2604.pdf.

On May 14, 2026, security researcher Orange Tsai demonstrated a Microsoft Edge sandbox escape at Pwn2Own Berlin, one of the world’s premier hacking competitions. He was the only contestant to win the browser category, earning $175,000. The organizers later revealed that his exploit chained together four logic bugs rather than […]

# Escaping Linux Sandboxes via PipeWire (CVE-2026-5674) This post walks through a sandbox escape from a Flatpak application via PipeWire. The vulnerability was discovered using my automated research pipeline with `Claude Code` and `Opus 4.6` back in April 2026. It was an exciting find, as this was the first bug […]

# Exploiting Titan Quest Titan Quest is a hack-and-slash video game released in 2006. In 2016, THQ Nordic released an _Anniversary Edition_. In the version provided by GOG, several development tools are installed with the game. These allow for the creation of new maps, items, and effects. This article details […]

I recently ran into an interesting behavior on Windows that I found unintuitive so I figured other people may want to know about it too. An application can call `AddClipboardFormatListener` to register a callback that gets called whenever the clipboard contents change, like when you copy a file or some […]

# When AI Makes 0-Days Feel Like N-Days **Table of Contents** ## Introduction After my n-day analysis on net/tls bugs and exploit writing for a patched net/rxrpc bug, I moved on to 0-day bug hunting. With the help of AI, I found a UAF bug in net/sched, and went about […]

(c) WUNDERWUZZI 2018-2026 Disclaimer: Penetration testing requires authorization from proper stakeholders. Information on this blog is provided for research and educational purposes to advance understanding of attacks and countermeasures to help secure the Internet. | Privacy