Project Journal

Notes, experiments, and documentation

Checking Boxes on the Way to a Breach

Audit optimization in the era of AI is on every startup checklist — buy the badge, unblock the deal desk, and nobody in the room can tell you where your customer data actually lives. These tools generate audit evidence, not risk reduction. The scanner sees Log4j; it can't see the IDOR exposing your customers. And that compliance vendor? It's holding a pre-annotated map of exactly where you're weakest.

Read full article →

Train Yourself, Not the Models

ClickFix attack on LinkedIn

How the AI revolution is quietly outsourcing your brain — and what to do about it. From the ClickFix paste-and-run attack to hallucinating models that sound most certain when they're most wrong.

Read full article →

Setting Up ClawdBot (Moltbot) on Raspberry Pi 3

Setting up ClawdBot (also known as Moltbot) on a Raspberry Pi 3 — exploring AI API cost alternatives including Venice AI credit staking and Claude Pro subscriptions, and whether a Claude Code subscription can run the raptor personality to avoid churning raw API tokens.

The AI Bug Bounty Gold Rush — Are We Chasing the Wrong Bugs?

Traditional vulnerabilities still account for 78% of successful exploitations, yet bounty payouts for AI bugs have jumped 340%. Are researchers chasing money instead of risk?

Read full article →

Building an SAO for DEF CON — 555 Timer LED Chaser

SAO complete set

A purely analog Simple Add-On for DEF CON — a 555 timer driving a CD4017 decade counter that chases eight LEDs across a custom 60mm × 60mm PCB. No microcontroller, no firmware. Just power and ground.

Read full article →

Prompt Engineering & Vulnerabilities

A deep dive into prompt injection techniques, jailbreaks, and vulnerabilities — from basic instruction overrides to recursive multi-model exploits. Covers 12 attack patterns including role-play jailbreaks, context overflow, cognitive hacking, and the defined dictionary attack.

Read full article →