No-Slop Research & Human Thoughts on Security

No-Slop Research & Human Thoughts on Security

Latest — 26 Oct 2026

A Security Constitution at Work

Models are good at what they are trained to do. The field taught machines what a security bug looks like by compiling vulnerability details into datasets such as BigVul and CVEfixes and training models on those patterns. That training is why Google's Big Sleep found a memory-corruption

More issues

No Permissions Required: Cross-Tenant Data Theft via BigQuery Data Transfer

Google Cloud customers who use the BigQuery Data Transfer Service as directed are at risk: an attacker with no permissions in their project can exfiltrate their private data. Google has no plans to fix it. If you use the service, shrink your exposure window. The network attachment can be used

The Docs Say It's OK: When Documentation Replaces a Fix in Vertex AI

What if the fix for a privilege-escalation bug were a sentence in the docs? Not a patched code path, not the missing check but a note on a reference page. That's not hypothetical. It's what Google shipped for two new privilege escalation paths in Vertex

The Two Mitigations for the Service-Account Confused Deputy in the Cloud

A confused deputy is nothing more than a privileged intermediary tricked into acting for a caller who lacks the authority itself. In the cloud, it has two distinct flavors, one leveraging a non-human identity (NHI) owned by you, the customer, and one leveraging a non-human identity (NHI) owned

An Optimistic Nihilist's View of the Vuln-apocalypse

Congratulations, everybody—we might be entering the outer bands of the Vuln-apocalypse storm. The traditional, polite security timeline where we had weeks to patch a vulnerability is dead, replaced by a hyper-accelerated, AI-fueled reality where the time to exploitation is essentially zero. Those massive, "keystone"

Can we afford to get lost anymore? Can we afford not to?

I remember life before phones and Google Maps. Even before MapQuest, we all used to get lost a lot more. Back then, I’d stop at random gas stations to ask for directions, and my knowledge of highways, city streets, and far-flung roadways was actually pretty decent. But of

The San Francisco Consensus

Last week at the [un]prompted conference in San Francisco, the question on everyone's mind was: What happens when Time-to-Exploit reaches zero? The Problem, As Told By The Clock The Zero Day clock project shows a single, collapsing trendline. In 2018, the median time between a

You are the Blackboard - AI Agent Assisted Bug Hunting

In vulnerability and CVE hunting, you have a search space problem. Your attack surface is seemingly unlimited, so much so that target selection is often considered the most important skill of a bug bounty hunter. In this article, I'll recount the process I used to narrow the search

GCP IAM 201 - OAuth Scopes

In the OAuth 2.0 specification, a scope defines the limits of an access token. When applied to Google APIs, a scope specifies which APIs and resources the token can access. If you only take away one thing about OAuth 2.0 Scopes for Google APIs, it is: do not

Working as Intended - The Unauditable, Unmanageable Keys in Google Cloud

This blog outlines three vulnerabilities with user-associated HMAC keys in Google Cloud. Vulnerability #1 - Insufficient Logging Vulnerability #2 - Unmanagable Long-Term Credentials Vulnerability #3 - Unauditable Long-Term Credentials TLDR; * HMAC keys serve a practical purpose. They can be used to create Sigv4 signed headers used to authenticate against the

About

No-Slop Research & Human Thoughts on Security

Thoughts, stories and ideas from a human in cloud and identity security research.

Topics

101

201

ai

aws

gcp

musings

research

vuln