Views my own, not my employer's · Hypervisor sec @Google · Program analysis, fuzzing · Reading on isolation × agentic AI safety · PhD @UMNComputerSci
Joined February 2017
- Tweets245
- Following654
- Followers262
- Likes4.9K
Navid Emamdoost retweeted
🥳 Excited to start revealing what we've been working on in the last few months. First, we decided to reinvent Kubernetes for agentic workloads with statefulness and fast resumption. Secondly, we are building an agentic orchestrator that will be Google's open agentic orchestrator and runtime. github.com/google/ax
Linux is 35.
Over the years, I’ve contributed ~100 patches upstream, mostly security fixes. Nothing spectacular individually, but it’s a number I’m quietly proud of.
Sadly, Ingenuity ran an older kernel, so none of my patches made it to Mars :)
Happy birthday, Linux!
"I'm doing a (free) operating system (just a hobby, won't be big and professional like gnu)..."
On August 25, 1991, a 21-year-old student sent a message to a Usenet newsgroup. He thought he was just building something fun for himself.
35 years later, that "hobby" is the backbone of global technology:
🚀 Powering helicopters in space with NASA
☁️ Running the global cloud and 100% of the world’s supercomputers
📱 Connecting billions of people
🎮 Redefining the future of handheld gaming
What started as one student's side project became the greatest collaborative technology movement in history. Thank you to every maintainer, contributor, and advocate who made it possible.
Happy 35th Birthday, Linux. Here’s to the power of open source and the next 35 years of building together.
learnlinux.ie/content/linus-…
#Linux35
A lot of agentic AI safety looks like the Confused Deputy problem.
An agent has tool authority from the operator, then consumes untrusted input containing instructions. Whose authority applies to the next tool call?
1/2
Navid Emamdoost retweeted
We asked GPT 5.6-Cyber to escape a VM used to sandbox agents. It broke out three times.
In its final escape, the agent found three 0-days on its own and chained them into a working exploit. blog.trailofbits.com/2026/08…
Excited to present at Open Source Summit 2026! 🚀 I'll be sharing how our team is automating vulnerability discovery in my talk: "Hardening QEMU with Self-Correcting Fuzzing Pipelines."
🔗 [osselcna2026.sched.com/event…](google.com/search?q=https://…)
#OSSummit #QEMU #Fuzzing
Fuzzing a hypervisor like QEMU is notoriously hard. Traditional fuzzers fail at stateful protocols, feeding devices gibberish. To find deep bugs, we can't limit ourselves to PIO or MMIO; any potential callback to a device-specific function can be an entry point.
🚀 2026 PhD Internship at @Google
I’m hosting a PhD intern in 2026! We’ll be researching
Hypervisor Security and Program Analysis, with a focus on how LLMs can
transform vulnerability detection.
Feel free to reach out!
Navid Emamdoost retweeted
Hello aspiring hackers! Every summer, we host high school cybersecurity enthusiasts from around the Phoenix valley for summer internships through ASU’s Center for Cybersecurity and Trusted Foundations! Applications for this summer close in under a week! ctf.asu.edu/education/intern…
Navid Emamdoost retweeted
Hello hackers! Finished all the awesome challenges on pwn.college? Ready for more? It's your lucky day! Today, we're launching a new pwn.college feature: Community Dojos full of new and exciting challenges to tackle and learn from!
Read on! 🧵
Navid Emamdoost retweeted
Slides here, and hopefully the recorded video will be available soon! moyix.net/~moyix/LLMs_Softwa…
Navid Emamdoost retweeted
Check out the recent blog post from @openssf on Fuzz Introspector developments and what's new! Macro-level insights on open source fuzzing, search for #fuzzing details in more than one million functions, automatic fuzz harness generation and more!
Fuzz Introspector is an open source tool that provides insights and suggestions for improvements on how software projects are being fuzzed @Davkorcz & @AdamKorcz4 take a look & share recent updates in our latest blog: openssf.org/blog/2023/07/20/… #fuzzing
Navid Emamdoost retweeted
KCC @kayseesee is "officially" presenting his new Distributed Differential Fuzzing engine Centipede in FUZZING'23 workshop. Core properties: libFuzzer-compatible, distributed, scalable, modular, rich coverage signal, better corpus management (supports billions of inputs) #fuzzing
Nice to see this work! Kudos to all involved, I can't wait to read the final version!
Happy to share our FUZZING'23 paper on analyzing fuzz blockers: thuanpv.github.io/publicatio…. This work is led by my PhD student @WentaoGao5 in collaboration w/ @Alan32Liu, @halbecaf, @tobycmurray, and @bipr. Can't wait to e-meet #fuzzing lovers in the workshop next week @issta_conf!!
Navid Emamdoost retweeted
This is exactly what developing should look like. It's insane how big the difference between "what's possible" and "what we actually do" is. If you are interested in dev tooling at all, please spend the few minutes watching this.
Here's a look at some of our internal programming tools at Tomorrow Corporation!
youtu.be/72y2EC5fkcE
Navid Emamdoost retweeted
LLMs are bs generators. But we need to use it as a strength and apply LLMs to fuzzing
This Post is from an account that no longer exists. Learn more
Navid Emamdoost retweeted
Fuzz Introspector recently integrated support for Java projects -- see e.g. jackson-core report: storage.googleapis.com/oss-f…
Navid Emamdoost retweeted
I've been reflecting on recent events & how different my life would've been if my parents returned to Iran.
I stand with the courageous women & allies protesting for freedom. My heavy heart goes out to the family & friends of #MahsaAmini & others that were senselessly murdered.
This is Iran today. A woman proudly burning the most visible symbol of religious dictatorship; compulsory hijab.
Hijab police killed #MahsaAmini but now there are millions of Mahsa in Iran who are shouting NO to Forced hijab NO to gender apartheid regime.
#مهسا_امینی
Navid Emamdoost retweeted
We published a blogpost on SystemSan - our sanitizer for command injection which found a remote code execution vulnerability in tinygltf.
security.googleblog.com/2022…
We will pay rewards for sanitizers that can find non C/C++ specific vulnerabilities such as SQLI, XSS, and SSRF.
ALT Proof of concept for exploiting bug in tinygltf