Hanqing Zhao

Ph.D. @ Georgia Tech SSLab @SSLab_Gatech | Co-lead AIxCC @TeamAtlanta24 | System & Security Research | Tea Deliverers CTF Team |

[Hanqing Zhao @hanqing]

Excited to share that our team, Team Atlanta @TeamAtlanta24 , has just won the AIxCC Grand Final! 🏆 #AIxCC

Meet the team: https://t.co/D7mCna29eB

[Yuhang Wu @wupco1996]

We successfully achieved an RCE on GitLab in its default configuration.
Historically, most GitLab RCEs have lived in the web or application-logic layers. This time, guided by the @depthfirstlabs spirit, we went deeper: into the low-level gem dependency chain beneath GitLab.
The result? By sending crafted JSON data, we could exploit memory-corruption vulnerabilities buried deep in that chain and take control of the GitLab application server.
@depthfirstlabs brings together some of the smartest people, and is building the best security AI agent. Follow our work, and come join us!

Read more about this in the comment...

[Hanqing Zhao @hanqing]

Hacker News Discussion:

Vibe Security Radar: Real CVEs where AI-generated code introduced Bugs

https://t.co/0LuzM1EgIJ

[Hanqing Zhao @hanqing]

We've been tracking public CVEs where AI-generated code introduced the vulnerability.

https://t.co/ENeLzSFfGx

50k+ advisories scanned. Dozens of confirmed cases so far.

Claude Code, Copilot, Cursor, and others all show up. Common bug classes include XSS, command injection, SSRF, and path traversal.

And these are just the cases that leave metadata traces. The real number is almost certainly higher.

Open source, from Georgia Tech SSLab:

https://t.co/6UES6ruuQc

[Hanqing Zhao @hanqing]

@Ryan_Jarv @thegrugq If you mean false negatives, definitely. I’m sure we’re missing many cases right now, especially ones without a clear fixing commit or without AI attribution signals like co-author trailers.

We’re actively updating the detection pipeline to improve coverage.

[Kevin Poireault @leekthehack]

Vibe coding tools are flooding software with new vulnerabilities, @GeorgiaTech researchers have warned.

I spoke to @hanqing, founder of the Vibe Security Radar @SSLab_Gatech, about the future of AI coding tool-induced vulnerabilities. @TeamAtlanta24

https://t.co/4ADH0uU2ck

[Hanqing Zhao @hanqing]

@chrisrohlf Thx, lemme check

[Team Atlanta @TeamAtlanta24]

Breaking news! ❤️‍🔥 Our teammate Andrew Chin will present our AIxCC-winning system at Taiwan’s HITCON, Aug 15–16. https://t.co/bkvzTVOGdB @HacksInTaiwan

[Hanqing Zhao @hanqing]

@xingxinyu @TeamAtlanta24 Thank you ❤️

[Hanqing Zhao @hanqing]

Excited to share that our team, Team Atlanta @TeamAtlanta24 , has just won the AIxCC Grand Final! 🏆 #AIxCC

Meet the team: https://t.co/D7mCna29eB

[Hanqing Zhao @hanqing]

@vv474172261 @TeamAtlanta24 ❤️

[Hanqing Zhao @hanqing]

@WangTielei @TeamAtlanta24 Thanks! ❤️

[Team Atlanta @TeamAtlanta24]

Excited to share our latest blog post: “Hacking Redefined: How LLM Agents Took on University Hacking Competition.” Atlantis CRS discovered 10 vulnerabilities and crafted 7 robust patches at TKCTF 2024! Read more: https://t.co/O18ddWU7Kx #AI #Cybersecurity #CTF @TeamAtlanta24

[Hanqing Zhao @hanqing]

Thrilled to see the community tracking our @TeamAtlanta24 detailed work in DARPA AIxCC! Over recent months, we've completely revamped our system with new LLM-based approaches. Looking forward to showcasing these innovations in the #AIxCC.

​​​​​​​​​​​​​https://t.co/S4j5zNqhUF

[Perri Adams @perribus]

“Earlier this year at the DARPA AIxCC event, Team Atlanta discovered a null-pointer dereference in SQLite, which inspired us to use it for our testing to see if we could find a more serious vulnerability.”

[Team Atlanta @TeamAtlanta24]

Excited to see Project Zero's blog on their LLM-powered zero-day discovery! Glad that our Team Atlanta work is helping inspire new approaches in vulnerability research. We'll share more LLM-based bug finding techniques at AIxCC too! 🔍

[Hanqing Zhao @hanqing]

Just wrote a new blog post discussing how we discovered and fixed a SQLite3 bug during #AIxCC! Dive into the details and see how our system tackled real-world challenges. Read it here: https://t.co/wSyzgIQD8p

[Team Atlanta @TeamAtlanta24]

🚀 More insights on LLM and security!

Check out our latest blog on how our Cyber Reasoning System, Atlantis, autonomously discovered and patched a real bug in SQLite3 during the AIxCC competition!

Read it here: https://t.co/MwvxN9xw1V

#AIxCC #Cybersecurity #LLM #sqlite