About

I graduated from Bilkent University's Computer Technology and Information Systems program in June 2026. Before that, I spent roughly 14 months doing offensive security work at a cybersecurity and AI security firm, running penetration tests against web applications, mobile apps, APIs, and AI/ML systems.

Since July 2026 I've been interning at HUX AI Research, where I'm building an LLM Guardrails Evaluation Toolkit that measures how well language model safety barriers hold up under adversarial pressure. Alongside the internship, I do independent vulnerability research and AI red-teaming. I'm an approved researcher in Anthropic's Cyber Verification Program (CVP).

Selected Findings

  • NocoBase VM sandbox escape (CVE-2026-34156, CVSS 9.9). Breaking out of the formula and scripting sandbox gives full server compromise.
  • Mautic SSTI to RCE (CVE-2026-9558, CVSS 9.9). Uploaded Twig themes render without a sandbox, so template injection becomes remote code execution.
  • Moodle GeniAI plugin (CVE-2025-60507, CVSS 8.9). A PDF uploaded by a teacher carries both stored XSS and prompt injection into the AI assistant.
  • Decap CMS stored XSS (CVE-2025-57520, CVSS 6.1). Body, title, tag and description fields go unsanitized through version 3.8.3.
  • Moodle PDF Annotator stored XSS (CVE-2025-60506, CVSS 5.4) and Moodle OpenAI Chat block IDOR (CVE-2025-60511, CVSS 4.3).

Scores above are NVD CVSS 3.1 base scores, not my own ratings.

AI Red-Teaming

I've submitted case studies to MITRE ATLAS covering a Crescendo-style jailbreak technique and a prompt-injection trilogy. My open-source work includes direction_explorer, a mechanistic interpretability tool that reproduces refusal-direction ablation on open-weight models and surfaced cross-lingual leakage patterns in safety-tuned models.

I also built PromptShot, a guardrail-fingerprinting recon layer for probing how a deployed model refuses.

AI Safety

I went through BlueDot Impact's Technical AI Safety course: six units of reading, written deliverables and facilitated discussion. What I produced there:

  • Preference pipelines. Designed an RLHF pipeline for one narrow task, a Wikipedia Manual of Style editing assistant, and wrote the threat model beside it: where sycophancy enters through the preference model, and what a careless or hostile labeller changes about what the model learns. A design and a threat model, not a training run.
  • Frontier Safety Framework critique. I picked Google DeepMind's FSF because it is one of the few public frameworks that names deceptive alignment as its own risk domain. Its mitigation leans on chain-of-thought monitoring, which is itself a model output, and its pause commitments are not binding. CoT monitoring is useful but fragile, and structurally blind to a single-shot attack that never has to narrate itself.
  • Dangerous-capability evaluation design. Set out what evidence should be strong enough to stop a deployment rather than trigger another round of testing: the model reliably telling evaluation from deployment, hiding its reasoning, sandbagging, or routing around oversight.
  • Cyber kill chain for an agentic system. A defense-sector supply-chain scenario in five phases, from capability emergence through access and weaponization, initial breach, escalation cascade, to institutional breakdown, with the capabilities each phase requires and a layered control architecture against them.
  • Refusal-direction ablation. Brought the direction_explorer experiments above into the Unit 4 discussion as a worked case: probe to detect a safety-relevant direction, then ablate it as a causal test. Probing is detection, ablation is the stress test. Across the open-weight models I ran, one direction was not always enough to remove refusal, which points at a distributed or multi-directional representation.
  • Where it goes next. My Unit 6 one-pager argues for AI control on cyber-capable agentic systems, treating the model, scaffold, tools, memory, permissions and external actions as one system instead of scoring the model alone. The evaluation is a proposal at this stage, not something I have built.

Engineering

CTIS is a software degree, so most of it went into building things rather than breaking them: C, C++ with OpenGL, Java, Kotlin, PHP, Oracle SQL and .NET. My senior project was an AI-powered wardrobe platform, which I then security-tested myself and wrote up.

I still ship code. This site is a Next.js frontend on a headless Ghost backend, running on a Linux server I administer. The security tooling is built as pipelines rather than one-off scripts: NucAIScan chains Subfinder, Subzy and FFUF into an AI-assisted DAST run, and the honeypot stack behind my seven-day honeypot writeup parsed 108,000 attack sessions.

Certifications

  • eWPTXv3 (Web Application Penetration Testing eXtreme)
  • eWPT (Web Application Penetration Testing)
  • CompTIA Security+
  • C-AI/MLPen (AI/ML Penetration Testing)
  • C-AgAIPen (Agentic AI Penetration Testing)

Research Areas

  • AI Security

    LLM guardrail evaluation, jailbreak methodologies, OWASP GenAI Top 10 mapping, mechanistic interpretability.

  • Vulnerability Research

    Web framework audits, CVE disclosure, CVSS 4.0 scoring, root-cause analysis and detection guidance.

  • Mobile Security

    End-to-end APK red-team pipelines, binary-to-PoC workflows, Android application analysis.

  • Automation

    AI agent architectures, scheduled task orchestration, multi-model coordination systems.

Contact

Responsible Disclosure Policy

If you believe you have found a security vulnerability in any of my projects, I appreciate your help in disclosing it responsibly.

Please report findings to onurcangencbilkent@gmail.com or open a security advisory on the relevant GitHub repository. I aim to acknowledge receipt within 48 hours and provide an initial assessment within 7 days.

Please refrain from public disclosure until a fix has been released or 90 days have passed since the initial report, whichever comes first.