Notes on security research and graduate life.
AI agents are becoming general-purpose tools for everyday work, not just developer tools. People in many domains are starting to delegate research, writing, coding, data analysis, and operational work to agents, and agent capability is becoming a key part of individual and team competitiveness. An AI agent that runs on your own computer can be especially useful: hand it a task and it works like…
Last summer, during my internship at Meta, I heard security people saying that fully autonomous AI agents were still some time away. The fundamental security issues had not been solved, and the industry was being cautious. Then OpenClaw just dropped. It fetches external data and acts on user’s private data at the same time. It is indeed dangerous, but I tried it anyway, and I found it quite…
January has flown by in a blink of an eye! While 2025 is already into its second month, it’s lunar new year today, so I decided to write a review of 2024. Research 2024 was a year filled with deadlines after deadlines. From January 2024 to January 2025, I submitted three different papers a total of four times, went through four rebuttals, and had two papers accepted. The last one is currently…
This is a personal note for the ACM CCS 2024 I made after the event. CCS 2024 was held in Salt Lake City, Utah, USA. It was my second time attending CCS, but this time I had the privilege of presenting my work. Pre-Conference Trip The gifts from Zhejiang university students Before heading to CCS, some phd students from Zhejiang university reached out to me to hang out together when they stop over…
From August 5th to 12nd 2024, I attended Black Hat USA 2024 (and Defcon 32) in Las Vegas. I presented my research on Bypassing MTE with a side-channel attack . I returned to Korea this morning (luckily, no jet lag) and am writing this post to share my experiences from Las Vegas before I forget them. Black Hat USA 2024 First Black Hat experience I’ve never been to Black Hat before, so I was very…
It’s the end of 2023, and as I look back on the year, I can only say that it was a year full of research. I remember the days spent in front of the computer, reading papers, and conducting experiments. Of course, there were other events this year, including the creation of this blog (yay!). So, I decided it would be nice to write a review of 2023, to reflect on this year and to prepare for the…
Time flies in graduate school! Having spent 3.5 years as a PhD student, one thing I’ve learned is that I should be super-efficient in managing my time and energy. I’m not someone you’d label as “born productive”. I’m a typical “P”-type person according to Myers-Briggs Type Indicator (MBTI) –indicative of a spontaneous and flexible nature. As many P-type people do, I’m prone to distraction and have…
### Introduction In recent years, emerging technology in Machine Learning and Large Language Model (LLM) had led to the development of ML/LLM-powered applications. One of the popular service for ML/LLM application is Hugging Face . In this post, I would like to describe the potential security risks in current Hugging Face, especially in Spaces . Hugging Face Hugging Face is a AI community that…
Intro In the first year of my Ph.D, I ambitiously began a research on protecting the Linux kernel against data-only attacks. My research especially focused on protecting security-critical objects and pointers leveraging the ARM’s upcoming hardware security features ( PAC and MTE ). Building such a kernel hardening system required me to tackle several key issues: Cross-compiling the kernel (X86 ->…