Navid Emamdoost

Views my own, not my employer's · Hypervisor sec @Google · Program analysis, fuzzing · Reading on isolation × agentic AI safety · PhD @UMNComputerSci

[Navid Emamdoost @navidemd]

Our solution? An AI dual-agent pipeline (Protocol Expert + Fuzz Writer) with self-correcting feedback loops. It automatically bypasses coverage plateaus, generating stable fuzz targets in hours instead of weeks. Come see how we're scaling this to 200+ devices!

[Navid Emamdoost @navidemd]

Excited to present at Open Source Summit 2026! 🚀 I'll be sharing how our team is automating vulnerability discovery in my talk: "Hardening QEMU with Self-Correcting Fuzzing Pipelines."
🔗 [https://t.co/PxL3uuZDft](https://t.co/L26dswR6hz)
#OSSummit #QEMU #Fuzzing

[Navid Emamdoost @navidemd]

Fuzzing a hypervisor like QEMU is notoriously hard. Traditional fuzzers fail at stateful protocols, feeding devices gibberish. To find deep bugs, we can't limit ourselves to PIO or MMIO; any potential callback to a device-specific function can be an entry point.

[Navid Emamdoost @navidemd]

🚀 2026 PhD Internship at @Google

I’m hosting a PhD intern in 2026! We’ll be researching
Hypervisor Security and Program Analysis, with a focus on how LLMs can
transform vulnerability detection.

Feel free to reach out!

[[email protected] @Zardus]

Hello aspiring hackers! Every summer, we host high school cybersecurity enthusiasts from around the Phoenix valley for summer internships through ASU’s Center for Cybersecurity and Trusted Foundations! Applications for this summer close in under a week! https://t.co/108RGMdLBI

[[email protected] @Zardus]

Hello hackers! Finished all the awesome challenges on https://t.co/VBZlmDUtBg? Ready for more? It's your lucky day! Today, we're launching a new https://t.co/yjFhiLYc7V feature: Community Dojos full of new and exciting challenges to tackle and learn from!

Read on! 🧵

[Brendan Dolan-Gavitt @moyix]

Slides here, and hopefully the recorded video will be available soon! https://t.co/yy5GFv2lqs

[Navid Emamdoost @navidemd]

@thuanpv_ @cis_unimelb Congratulations Thuan!

[David Korczynski @Davkorcz]

Check out the recent blog post from @openssf on Fuzz Introspector developments and what's new! Macro-level insights on open source fuzzing, search for #fuzzing details in more than one million functions, automatic fuzz harness generation and more!

[Thuan Pham @thuanpv_]

KCC @kayseesee is "officially" presenting his new Distributed Differential Fuzzing engine Centipede in FUZZING'23 workshop. Core properties: libFuzzer-compatible, distributed, scalable, modular, rich coverage signal, better corpus management (supports billions of inputs) #fuzzing

[Navid Emamdoost @navidemd]

Nice to see this work! Kudos to all involved, I can't wait to read the final version!

[Thuan Pham @thuanpv_]

Happy to share our FUZZING'23 paper on analyzing fuzz blockers: https://t.co/CzQR5iIFzW. This work is led by my PhD student @WentaoGao5 in collaboration w/ @Alan32Liu, @halbecaf, @tobycmurray, and @bipr. Can't wait to e-meet #fuzzing lovers in the workshop next week @issta_conf!!

[Navid Emamdoost @navidemd]

@moyix Congratulations!

[is-eqv.bsky.social @is_eqv]

This is exactly what developing should look like. It's insane how big the difference between "what's possible" and "what we actually do" is. If you are interested in dev tooling at all, please spend the few minutes watching this.

[Navid Emamdoost @navidemd]

@is_eqv Thanks for bringing this to my timeline! Great dev experience!

[Kostya Serebryany @kayseesee]

LLMs are bs generators. But we need to use it as a strength and apply LLMs to fuzzing

[David Korczynski @Davkorcz]

Fuzz Introspector recently integrated support for Java projects -- see e.g. jackson-core report: https://t.co/1dOI5s9yWS

[Parisa Tabriz @laparisa]

I've been reflecting on recent events & how different my life would've been if my parents returned to Iran.

I stand with the courageous women & allies protesting for freedom. My heavy heart goes out to the family & friends of #MahsaAmini & others that were senselessly murdered.

[Jonathan Metzman @metzmanj]

We published a blogpost on SystemSan - our sanitizer for command injection which found a remote code execution vulnerability in tinygltf.

https://t.co/7NQr4wSPvA

We will pay rewards for sanitizers that can find non C/C++ specific vulnerabilities such as SQLI, XSS, and SSRF.

[laurent @lsim99]

npm Best Practices for the Supply-Chain is out! https://t.co/Yx1CT6nYBA Thanks everyone who got involved @MylesBorins @ljharb @jeffmendoza @erezrokah @liran_tal @theopenssf and many more!

[Oliver Chang @halbecaf]

Proof that fuzzing can discover exploitable vulnerabilities that aren't memory corruption! OSS-Fuzz discovered a very interesting command injection vulnerability which was just fixed: https://t.co/QOw9Vv26RE