_               _   _                 _               _
| |__   _____  _| |_| |__   ___  ___| |__   __ _  __| |___ _      __
| '_ \ / _ \ \/ / __| '_ \ / _ \/ __| '_ \ / _` |/ _` / _ \ \ /\ /
| | | |  __/>  <| |_| | | |  __/\__ \ | | | (_| | (_| \  __/\ V  V /
|_| |_|\___/_/\_\\__|_| |_|\___||___/_| |_|\__,_|\__,_|\___| \_/\_/

vulnerability researcher  ·  agentic systems  ·  memory safety

---

>_ whoami

Self-taught security researcher and AI systems engineer from Lahore, Pakistan.

I build autonomous multi-agent systems that do what an experienced vulnerability researcher does — read source code, form attack hypotheses, trace call graphs, confirm bugs with sanitizers, write working exploits, and produce full disclosure reports — without human involvement at any step.

My agents don't run scanners. They reason.

Founder of Vorthix — an autonomous security research platform powered by XOR-1, a self-hosted multi-agent system running Qwen 3 27B that has operated continuously for 100+ hours per session without getting stuck in a loop.

---

>_ research

target	finding	class	status
libexpat	Incomplete fix bypass for CVE-2026-50219 — doCdataSection() skips beforeHandler()/afterHandler(), leaving m_handlerCallDepth at zero during CDATA callbacks	heap-UAF · CWE-416
FreeRDP	Unchecked palette read in update_decompress_brush() — stream check guarantees 8 bytes, palette dereference reaches stream_pos+31 for bpp=32	heap-OOB-read · CWE-125
LibRaw	Dangling FORC loop variable reused as write offset in rpi_load_raw8() — crafted padding_right shifts every row write past the allocation end	heap-overflow · CWE-122
Monocypher	Integer truncation in crypto_argon2() makes lane_size zero — init loop writes blocks[1] 1024 bytes past allocation end	heap-overflow · CWE-122
PJSIP / pjmedia	H.263 PLEN field excluded from bounds check in pjmedia_h263_unpacketize() — single crafted RTP packet overflows decode buffer by up to 63 bytes	heap-overflow · network	
Chromium	Fenced Frame ACER policy bypass — SetFencedFrameAutomaticBeaconReportEventData() accepts cross-origin beacon data without checking allow_cross_origin_event_reporting_	privacy-boundary	
Linux Kernel	UAF in vsock loopback transport — race in virtio_transport_consume_skb_sent() yields write + read primitive on kmalloc-96	UAF · KASAN

---

>_ xor-1

  input  →  github repo / source path / binary
  output →  confirmed vuln · sanitizer trace · minimized PoC · patch · disclosure report
  model  →  qwen 3 27b · self-hosted · openai-compatible api
  runtime → 100+ hours · no human intervention · no loop

custom systems built from scratch:

call-graph find-callers memory-management token-management hypothesis-storage
coverage-tracking deduplication self-correction loop-detection failure-handling
agent-confidence context-management iteration-logging self-training-pipeline

→ full architecture: hex-the-shadow-vorthix.vercel.app/#systems

---

>_ stack

languages   →  C · C++ · Python
platforms   →  Linux (Arch, Ubuntu) · x86-64
sanitizers  →  ASan · KASan · UBSan · TSan
tooling     →  GDB · strace · ltrace · ptrace · DynamoRIO · ftrace · perf
ai/ml       →  LLM integration · self-hosted inference · agentic pipelines · training data
domains     →  memory corruption · browser security · kernel · IPC · agentic systems

---

>_ pocs

Published PoCs for confirmed, patched vulnerabilities:
github.com/hextheshadow/PoC-Exploit

---

>_ contact

Open to vulnerability research, AI security engineering, agentic systems, and red team roles.