Ph.D. @ Georgia Tech SSLab @SSLab_Gatech | Co-lead AIxCC @TeamAtlanta24 | System & Security Research | Tea Deliverers CTF Team | https://nitter.cf/t.co/xxZKG7HmTv
Atlanta, GA
Joined September 2014
- Tweets160
- Following2.8K
- Followers1.5K
- Likes335
Pinned Tweet
Excited to share that our team, Team Atlanta @TeamAtlanta24 , has just won the AIxCC Grand Final! 🏆 #AIxCC
Meet the team: team-atlanta.github.io/autho…
Hanqing Zhao retweeted
We successfully achieved an RCE on GitLab in its default configuration.
Historically, most GitLab RCEs have lived in the web or application-logic layers. This time, guided by the @depthfirstlabs spirit, we went deeper: into the low-level gem dependency chain beneath GitLab.
The result? By sending crafted JSON data, we could exploit memory-corruption vulnerabilities buried deep in that chain and take control of the GitLab application server.
@depthfirstlabs brings together some of the smartest people, and is building the best security AI agent. Follow our work, and come join us!
Read more about this in the comment...
We've been tracking public CVEs where AI-generated code introduced the vulnerability.
vibe-radar-ten.vercel.app
50k+ advisories scanned. Dozens of confirmed cases so far.
Claude Code, Copilot, Cursor, and others all show up. Common bug classes include XSS, command injection, SSRF, and path traversal.
And these are just the cases that leave metadata traces. The real number is almost certainly higher.
Open source, from Georgia Tech SSLab:
github.com/HQ1995/vibe-secur…
Hacker News Discussion:
Vibe Security Radar: Real CVEs where AI-generated code introduced Bugs
news.ycombinator.com/item?id…
Hanqing Zhao retweeted
Vibe coding tools are flooding software with new vulnerabilities, @GeorgiaTech researchers have warned.
I spoke to @hanqing, founder of the Vibe Security Radar @SSLab_Gatech, about the future of AI coding tool-induced vulnerabilities. @TeamAtlanta24
infosecurity-magazine.com/ne…
Hanqing Zhao retweeted
Breaking news! ❤️🔥 Our teammate Andrew Chin will present our AIxCC-winning system at Taiwan’s HITCON, Aug 15–16. hitcon.org/2025/en-US/ @HacksInTaiwan
Hanqing Zhao retweeted
Excited to share our latest blog post: “Hacking Redefined: How LLM Agents Took on University Hacking Competition.” Atlantis CRS discovered 10 vulnerabilities and crafted 7 robust patches at TKCTF 2024! Read more: team-atlanta.github.io/blog/… #AI #Cybersecurity #CTF @TeamAtlanta24
Thrilled to see the community tracking our @TeamAtlanta24 detailed work in DARPA AIxCC! Over recent months, we've completely revamped our system with new LLM-based approaches. Looking forward to showcasing these innovations in the #AIxCC.
news.ycombinator.com/item?id…
Hanqing Zhao retweeted
“Earlier this year at the DARPA AIxCC event, Team Atlanta discovered a null-pointer dereference in SQLite, which inspired us to use it for our testing to see if we could find a more serious vulnerability.”
Today @Google Project Zero and @GoogleDeepMind shared how they’ve used an LLM to catch vulnerabilities in real world code with their project “Big Sleep.” This is a huge step for using AI to assist today’s cyber defenders. googleprojectzero.blogspot.c…
Hanqing Zhao retweeted
Excited to see Project Zero's blog on their LLM-powered zero-day discovery! Glad that our Team Atlanta work is helping inspire new approaches in vulnerability research. We'll share more LLM-based bug finding techniques at AIxCC too! 🔍
Don't panic now, but LLM-based agent discovered a previously unknown real-world vulnerability. Details in googleprojectzero.blogspot.c…
Just wrote a new blog post discussing how we discovered and fixed a SQLite3 bug during #AIxCC! Dive into the details and see how our system tackled real-world challenges. Read it here: team-atlanta.github.io/blog/…
🚀 More insights on LLM and security!
Check out our latest blog on how our Cyber Reasoning System, Atlantis, autonomously discovered and patched a real bug in SQLite3 during the AIxCC competition!
Read it here: team-atlanta.github.io/blog/…
#AIxCC #Cybersecurity #LLM #sqlite
🚀 Our first #AIxCC blog by @tsgatesv is live! Stay tuned for the next one, diving into vulnerability details. 👀💻
Blogs on #AIxCC are dropping over the next several days! Get insights, debriefs, and vulnerability analysis—follow @TeamAtlanta24 and team-atlanta.github.io for all the updates!
Inside the government competition to create AI security tools trib.al/4dIc8oM
Hanqing Zhao retweeted
Welcome to my talk!!
@zhaiyizhuo will be presenting her work @USENIXSecurity today on automatically recognizing sanity checks (i.e., type checks), which are then used to prune redundant sanitizer checks and reduce runtime performance overhead from sanitizers. #usesec24 @laosong @rakingleaves
Hanqing Zhao retweeted
Here’s to changing the game!! Congratulations @TeamAtlanta24 !! 🎉🎉
THAT’S WHAT WE’RE TALKING ABOUT!!
🗣️🗣️🗣️ @TeamAtlanta24 @DARPA @defcon
#GaTech #WeCanDoThat #vulnerability #zeroday
Hanqing Zhao retweeted
Love the excitement for fixing real vulnerabilities 🎉🎉🎉
And nothing says critical code like SQLite which is in your browser, phone, computer, car, electric grid, and most likely the airplane that took you home from @defcon…
THAT’S WHAT WE’RE TALKING ABOUT!!
🗣️🗣️🗣️ @TeamAtlanta24 @DARPA @defcon
#GaTech #WeCanDoThat #vulnerability #zeroday