Stefan Nagy

Faculty @uutah.
My lab hunts bugs: [email protected]
Bluesky:

[Stefan Nagy @snagycs]

Super proud of the FuTURES³ Lab and everything we accomplished in 2025, and excited for what’s ahead in 2026! Check out our work at https://t.co/cFqKsnFC79. 😃

[University of Utah @UUtah]

W

[Sean Heelan @seanhn]

haha, so apparently OpenAI are about to start training on your Daybreak Blue sessions, with no way to opt out.

Literally stealing people's private work, as they do it, is cartoonishly evil.

It also will presumably kill Daybreak usage by security researchers. Or at least, it should. The thing OAI have had to swear they are not doing to math researchers, they are now explicitly about to start doing to security researchers.

Yet another reminder of the importance of open models.

[Stefan Nagy @snagycs]

@lorisdanto Lots of cool stuff happening in this space. My group is doing some work here as well -- happy to chat sometime. 🙂

[Low Level @LowLevelTweets]

very excited for mythos to tell the sysadmins that exposing the PLCs to the internet is bad

[Ana Marasović @anmarasovic]

ELI5 why corporate AI companies get to run cyber attacks on real-world systems with zero consequences

[Stefan Nagy @snagycs]

@pr0me Neat! I'm curious though about whether recall of training-set code had any influence here (related discussion on this: https://t.co/QCHvgxFmWx).

[roddux @roddux]

We need to break 1000/day, only then will security be achieved

[Stefan Nagy @snagycs]

En route to Montreal 🇨🇦 @FSEconf!

On Wednesday, FuTURES³ Lab researchers @yeaseen_, @yangzaocn, and @gabe_sherman6 will present their three papers on invariant-guided binary fuzzing, LLM-driven transpiler testing, and Python auto-harnessing.

Papers/code: https://t.co/cFqKsnF4hB

[gabe sherman @gabe_sherman6]

Love Python but loathe its libraries' bugs?

This Wednesday at @FSEconf, I’ll be presenting my latest work in collaboration with @snagycs, "SnakeCharmer: Automatic Fuzzing Harness Generation for Pure and Hybrid Python Libraries"!

[Sanjay Rawat @tosanjayr]

Dyn Taintflow Analysis (DTA) - one of the main components of VUzzer (NDSS 2017) - finally got the re-engineering I'd been postponing for years.
Several ideas had been stuck in my notebook ever since. 1/n

[Stefan Nagy @snagycs]

@keviv9 I've learned that successes and failures come in waves. Cast a wide net, keep doing what you're doing, and eventually some great wins will come your way!

[Samuel Groß @5aelo]

The fuzzer that found https://t.co/Y5DOo7QGHE (and a number of issues prior to that as well) is now open-source: https://t.co/zCdbHCpJ4z

It uses pkeys, trap-handling and single-stepping to intercept and mutate in-sandbox reads (see trap-fuzzer.h). Definitely had fun writing it!

[Scott Bauer @ScottyBauer1]

I have a job opening on my team. If you're interested in incident response & software security across a wide range of industries (Laptops, Auto, Mobile, Datacenter) while working with very talented people please apply. DMs are open for questions*.

https://t.co/a7qmDyaZIO

[Stefan Nagy @snagycs]

@mahal0z Congratulations @mahal0z!!

[Alex Plaskett @alexjplaskett]

ZeroDayBench: Evaluating LLM Agents on Unseen Zero-Day Vulnerabilities for Cyberdefense

https://t.co/QRvdcPT9cm

[Stefan Nagy @snagycs]

@zeshan_nobin Congrats @zeshan_nobin!

[chrisrohlf @chrisrohlf]

https://t.co/MPV1Pa1RFn

[Stefan Nagy @snagycs]

Awesome to see @yeaseen_'s work on transpiler testing recognized by the Go2Hx dev community! https://t.co/bmd1sS6BDl 😁

Interested in improving transpilers? Check out our fuzzer TeTRIS!

Paper: https://t.co/HTj20ZfktB
Slides: https://t.co/ETxJappEt7
Code: https://t.co/PrPGCCo4he

[Yeaseen Arafat @yeaseen_]

TeTRIS uncovered 16 translation bugs across real-world transpilers—12 of them completely new!