m0nd2y

Security researcher / Ph.D candidate KAIST HackingLab

[m0nd2y @m0nd2y]

@ipwning Thanks for sharing bro🥂

[m0nd2y @m0nd2y]

@gosasu1 Thanks!!

[m0nd2y @m0nd2y]

I'm pleased to share that 19 vulnerabilities I reported were assigned CVE IDs in Microsoft's October 2026 Patch Tuesday.

Grateful to MSRC for the opportunity to contribute to the Windows security ecosystem!

#PatchTuesday #CVE #SecurityResearch

[m0nd2y @m0nd2y]

@gosasu1 @Zcash @osec_io wow....

[m0nd2y @m0nd2y]

Presented our work CTFusion at @HITCON 2026! 🇹🇼

“When the Benchmark Is the Vulnerability”

We explored how AI agents can cheat on existing CTF benchmarks and how streaming live CTFs can help build more reliable evaluations.

Thanks to everyone who joined the talk! 🙌
#HITCON2026

[m0nd2y @m0nd2y]

I’ll be presenting our work, CTFusion, at HITCON this year!

Looking forward to sharing what we learned about evaluating the real-world hacking capabilities of AI agents. See you in Taiwan

[HITCON @HacksInTaiwan]

AI 真的會駭嗎？！！
從只花 278 元買來、全球卻有超過 2,000 萬台在用的刷卡機，到監控設備，再到題目尚未公開的真實 CTF，今年 HITCON 有三場議程，從不同角度拆解 AI agent 的攻擊能力到底走到哪裡。

💳【刷卡機：AI 真的拿到 Root Shell】
The "Never Gave It Up" Harness: How AI Hacked a Payment Terminal and Turned It Into an Arcade
講者：Chiao Lin Yu

研究團隊用 278 元買下一台 PCI 認證支付終端，讓受監督的 AI agent 對它展開研究。
27 次迭代、從未放棄，串起三個漏洞，60 秒內從 WiFi 拿到 root shell。
最後，這台刷卡機跑起了貪食蛇和俄羅斯方塊。

📹【監控設備：讓 AI 重做漏洞研究】
When your surveillance system is watching you: breaking into GeoVision devices in the age of AI
講者：Philippe Laulheret
研究團隊過去在 GeoVision 多款產品中發現超過 13 個漏洞。
這次，他們把原本的人類研究方法交給 AI 重做，
問題不只是「AI 能不能找漏洞」，而是——哪些漏洞研究工作真的能交給 AI？

��【CTF：AI 到底是真的會，還是早就看過？】
CTFusion: Catching AI Agents That Cheat at CTF and Streaming Live CTFs to Fix It
講者：Dongjun Lee、Ga-eun Bae、Insu Yun
如果 AI 在公開 CTF 題庫拿到高分，真的代表它很會駭嗎？
研究團隊實測發現，agents 出現 71 種作弊行為，甚至有一次直接 pip install 評測題目的答案套件，三行指令印出 flag。
於是他們把測試搬到題目尚未公開、正在進行的真實 CTF。
結果：真實環境 pass@3 僅 6.3%，不到靜態評測 14.4% 的一半。

這三場議程讓我們發現，答案不是「AI 會不會駭」這麼簡單。
真正的問題是：AI 在什麼條件下能駭、能做到什麼程度，又該怎麼衡量它的真實能力？

📅 HITCON 2026：8 月 21 日－8 月 22 日
🔎 完整議程：https://t.co/e3iWdoBtzI
🎫 購票連結：https://t.co/qpV9Z02Deq

#HITCON2026 #AISecurity #OffensiveSecurity #AIagent #漏洞研究 #CTF

[m0nd2y @m0nd2y]

Our team, 0x4b52, placed 2nd at DEFCON34 CTF!

Huge thanks to all of my teammates who worked so hard throughout the competition. I’m grateful to have shared this experience and achievement with such a great team.

[Insu Yun @insu_yun]

My last CTF has come to an end.

I’m very proud that our team, 0x4b52, finished in second place at DEF CON CTF.

On the final day, I was a little upset—not only as a CTF player, but also as a professor. As a professor, I always want to tell my students that we should try to live and compete with integrity. As a CTF player, I deeply respect a community where each of us voluntarily chooses to uphold the spirit of the game. I believe we should hack systems, not the rules.

Of course, I understand that not everyone may see things the same way. And to be fair, I probably didn’t think this way myself when I was younger. Maybe I’ve just gotten a little older and come to believe that this is the way things should be.

Anyway, a huge thank you to BBB for organizing this competition. It is impossible to imagine how much time, effort, and volunteer work it takes to make an event like this possible. If I came across as too aggressive during the game, I’m really sorry. As a team leader, every single tick felt incredibly precious to me.

Congratulations to Blue Water. They definitely outperformed us. Some of the team members are my old friends. I really want to congratulate them.

Most of all, I’m grateful to my teammates and students. It was truly a pleasure playing together.

I had a great time. Thank you, everyone.

[m0nd2y @m0nd2y]

Honored to rank 41st on the MSRC 2026 Q2 Points Leaderboard and to be invited to the MSRC Researcher Celebration during Black Hat USA!

[m0nd2y @m0nd2y]

Presented our paper, “CTFusion: Catching AI Agents That Cheat at CTF and Streaming Live CTFs to Fix It,” at the #AIWILD Workshop at #ICML2026!

📄 https://t.co/2PcLRiawAL

Big thanks to my coauthor Ga-eun Bae and my advisor Professor Insu Yun!

#Cybersecurity #LLMAgents #CTF

[m0nd2y @m0nd2y]

In 2024, I went to HITCON to play CTF.

In 2026, I’m returning to HITCON as a speaker to present our accepted paper.

Excited to be back in the same community, this time in a different role.

See you at HITCON 2026!

[m0nd2y @m0nd2y]

Thrilled to announce our paper "CTFusion: A CTF-based Benchmark for LLM Agent Evaluation" is accepted to the AIWILD Workshop @ICML 2026!
A new CTF-based benchmark for evaluating LLM agents on real security tasks.
See you in Coex

[m0nd2y @m0nd2y]

played MidnightSun CTF 2026 this weekend with team HackingForMakguli 🇸🇪
sweden? incredible.
gg & big thanks to HackingForSoju for running it 🙏

[m0nd2y @m0nd2y]

We’re heading to the Midnight Sun CTF Finals as HackingForMakguli!

It feels even more special to compete alongside my labmates.

See you in Sweden 🇸🇪

[m0nd2y @m0nd2y]

Excited to share that Team 0x4b52 has qualified for the DEF CON 34 CTF Finals! 🔥

See you in Vegas.
@defcon

[CyKor @CyKorKU]

📢 CyKor CTF (@cykorctf) Announcement

CyKor is pleased to host the upcoming CyKor CTF with great prizes!
• 1st Place: $ 3,000
• 2nd Place: $ 1,500
• 3rd Place: $ 500
The event will be held for 24 hours, from 2025.12.06 01:00 (UTC+0) !
🔗 CTF Link: https://t.co/QPHKJyZ3u2

[0xor0ne @0xor0ne]

"LLMs Solving a DEF CON CTF Finals Challenge"

https://t.co/CukMcY6Jb4

Credits @cl4sm

#infosec

[m0nd2y @m0nd2y]

🚨 Just earned a $400 bounty through a private program on HackerOne!

It’s always fascinating to see how intuition and a bit of curiosity can lead to impactful discoveries. Grateful to the program for recognizing and rewarding responsible disclosure 🙌

#BugBounty #HackerOne

[CyKor @CyKorKU]

CyKor played DEFCON 33 Quals as Cold Fusion and we’re happy to share that we qualified for the finals!!🥳
See you in Las Vegas! 🇺🇸🎰✈️

— We're currently looking for sponsors. If you're interested, feel free to contact us at [email protected]
#DEFCON33 #CTF #CyKor

[m0nd2y @m0nd2y]

HITCON 2024 (feat. Coldfusion)

[CyKor @CyKorKU]

CyKor played DEFCON 32 Quals with Cold Fusion.