The 2024 Linux kernel CNA created downstream consequences nobody fully anticipated — NVD enrichment strain, distribution-CNA friction, and an AI-assisted report flood. On May 15, 2026, the kernel community shipped its first comprehensive synthesized response. A reading of the new docs from the perspective of an AI-assisted researcher who shipped a patch into the same window.
A practitioner's field report comparing Codex CLI and Claude Code for vulnerability research. Claude Code excels at architecture and ideation, but Codex delivers more disciplined, trustworthy findings during active testing — with fewer false positives and less researcher time wasted on invalidation.
I spent a month auditing 9 AI agent frameworks using consistency analysis. 18 advisories filed across familiar bug classes — SSRF, auth gaps, path traversal — all rooted in the same pattern: abstractions constrain, but engines accept.
Independent security research on the Model Context Protocol ecosystem. Zero tool poisoning found in 1,139 servers, but 53% lack authentication, 16% access credentials beyond what they need, and 9% have path traversal patterns.
Fluxgate found 12–14 confirmed-exploitable pwn request vulnerabilities across the top 1,000 most-starred repositories on GitHub — and I had to retract several disclosures when my scanner's blind spots led me to overstate the severity.
A static analysis audit of the entire ClawHub registry using WAINGRO found 43 confirmed malicious skills — including a coordinated C2 campaign that VirusTotal rates as benign.