Every model has new ways to speak "AI Native". My hobby: Find them - through vulnerability research. That helps me, and Knostic, stay AI-relevant. I share five below. We live in the most interesting era of history. The first thing I tried? Convince Claude to find logic vulns. It kept pushing for IDOR, TOCTOU. I eventually told it: "If it has a name, I don't want it." Without clear definitions and a data set, it failed. But many ideas followed: 1. Asymmetry mapping: If two functions enforce a boundary check and the third doesn't, is that a bug? A table could have only two legs, but lean on a wall, which would be completely legit. Another example: Do the docstring and function match? This particular shape treats the code semantically - interesting on its own. Not a new idea, but every new models expands the boundaries of what's possible. 2. Agentic harness/loop bugs: Two example harness bugs are contradiction and chronology. These are generic, so why not turn them on code? That was fun. 3. Graph shapes: I've been trying to find ways to "walk" code graphically. I built a graph-querying system, where I can describe relationships between elements. Example, a "diamond shape": Function A calls B, B calls C, but C also takes data from A, breaking a trust boundary. 4. Code promises: Look at what the code Promises. Intent is forward-looking, promises look back. Use a ticket, docstring, readme, code semantics, to understand what the code should do. 5. Behavior gadget chains: Danny Geyshis and Tamir Isaschar here at Knostic map behavior gadget chains, then compare to intent. They find malicious MCP servers with low FPs (check their upcoming talk at [un]prompted!) Using that concept, I map behavior gadget chains, and compare them to the original promises. Here is an out-of-date (but interesting!) Claude artifact on using shapes for scanning: https://claude.ai/code/artifact/edaacd9b-f5e8-4317-bba9-169027e9647d So... (#1) staying relevant is hard. I think up concepts and test them on “exhausted” codebases. And, Knostic and I learn, and we stay relevant. So... (#2) as 0days are a commodity: 0days on their own are usually not interesting, unlike when it used to take months to find a new one. Zeroday machines/harnesses aren't either, anymore. Benchmarks are limited. Companies spend hundreds of thousands, and they wouldn't spend a fraction of that on actual customer code bases. ... what's interesting now? 1. Finding new vulnerability smells in well-audited code HD Moore built a critical exploit in OpenBMC based on the symmetry scanner output (CVE-2026-16140). 2. Show me how you managed to write a working exploit by using simplistic models Check out John Cartwright (and maybe me) at [un]prompted on exploitation with Haiku, based on auto-research loops and code understanding. We must find ways to stay relevant and understand the world. Mine is through innovating in vuln research. And, of course, if you want to secure your agents - message me.