Where I write about software engineering, computer security, and everything in between.
Vibe coding is upon us, but it works best when the codebase has strong affordances — a concept in design that describes the possible actions an actor (in this case, a coding agent) can take, in relation to an object (in this case, the codebase): Affordance: a use or purpose that a thing can have, that people notice as part of the way they see or experience it. For a coding agent like Claude Code…
Anthropic published its Mythos Preview cybersecurity evaluation a few days ago, and a lot of people in cyber are spooked. Not because it reads like a scenario piece such as AI 2027 , but because the point is more immediate: if frontier models are already finding and exploiting serious zero-days across major software targets, cyber is changing right now. This is a prediction essay about what…
Offensive security seems to be getting its time in the sun again with the rise of AI-powered tools that promise fully autonomous penetration testing. But is it really all that different from the old days? The persistent failure of the penetration testing market is often framed as a technical problem: not enough talent, insufficient automation, immature tooling, or attackers moving faster than…
It seems like security folks never catch a break in December. 3 days ago, a critical remote code execution vulnerability in the React Server Components Flight Protocol was discovered and patched. This is still an ongoing story, but I'll try to break through the noise and share the technical details of the vulnerability, my thoughts on it, and how Hacktron responded by participating actively in the…
Can you execute arbitrary Python code from only a comment? This was the premise of a recent CTF challenge from UIUCTF 2025 which I found particularly interesting. The challenge was solved by only 11 teams, and I managed to solve it with the help of Hacktron and a bit of random inspiration at 7AM on a Sunday morning. This was my first time properly playing a CTF after almost a year in hiatus. This…
Someone asked me this question recently. Kinda morbid, but I think I was more surprised that I didn't have a good answer. Have I done enough to justify my existence? Have I been a net positive to the world? If someone erased my existence from the timeline, would the world look any different? Would people miss me? Would I have left a legacy? Temporal discounting I think the reason this question hit…
TL;DR In a few weeks, I'll be leaving Cambridge and working on Hacktron AI full-time. I am finishing up my second-year exams in June, after which I'll be taking time away from my studies. While I've wanted to intermit for quite some time for personal reasons, this will also allow me to focus on Hacktron AI, which I've co-founded with Mohan and Harsh . We're the first company to be backed by…
Last Friday, I was getting off the bus in downtown Houston when I received a rather alarming message from a friend in Singapore. That's not good... To set the context: my National Registration Identity Card (NRIC) number — what most will consider the equivalent of a Social Security Number in the United States, and the National Insurance Number in the United Kingdom — was on a public government…
I'll be honest — when I sat through my first-year Discrete Mathematics course, there were plenty of times when I wondered if I'd ever use any of it in the real world. I'm going to assume that a significant proportion of my audience is studying, has studied, or is about to study Computer Science, where discrete mathematics is a core part of the foundational curriculum. If you're in that boat, you…
When I interview for internships nowadays, one question that recruiters often ask me is "why not cybersecurity?". Funnily enough, I've stepped back from security since the start of this year, but many people still think I'm the "hacker" and competitive CTF player I used to be. Even my friends and family often ask me how things are going in the industry, and whether I'm still doing "hacking stuff".…