Sean Heelan's Blog

Recently I ran an experiment where I built agents on top of Opus 4.5 and GPT-5.2 and then challenged them to write exploits for a zeroday vulnerability in the QuickJS Javascript interpreter.

In this post I’ll show you how I found a zeroday vulnerability in the Linux kernel using OpenAI’s o3 model.

A few months back I wrote a blog post where I mentioned that the least-effort/highest reward approach to application optimisation is to deploy a whole-system profiler across your clusters, look at the most expensive libraries & processes, and then search…

In the previous post I advocated for building systems that combine static and dynamic analysis for performance optimisation.

This is the first post in a two part series on combining static and dynamic analyses for performance optimisation.

How do you almost 2x your application’s performance with zero code changes?

Over the summer I defended my PhD thesis.

At the upcoming ACM Conference on Computer and Communications Security (CCS) I’ll be presenting a paper on Automatic Exploit Generation (AEG), with the same title as this blog post.

At last year’s USENIX Security conference I presented a paper titled “Automatic Heap Layout Manipulation for Exploitation” [paper][talk][code].

I was lucky enough to attend a Dagstuhl seminar titled “Bringing CP, SAT & SMT Together” earlier this week, and learned about some really cool work I hadn’t previously heard of, especially in the realm of constraint satisfaction and optimization.