Alpha Hex
Offensive Security & Vulnerability Research
Hire this person
Send a job offer directly to this candidate
About
Founded Vorthix an autonomous AI security research system (XOR-1) that discovers and confirms vulnerabilities in critical open-source infrastructure with zero false positives. Within its first month, XOR-1 published 4 CVEs including incomplete fix bypasses in libexpat (Python, Git, CMake) and FreeRDP that evaded scanners and manual review for years. Every finding ships autonomously with a working PoC, sanitizer trace, root-cause path, suggested patch, and regression test.
Chromium contributor with 4 independently assigned bugs. Expanding XOR-1 to ARM kernel drivers, IoT firmware
Experience
Founder & Security Researcher at Vorthix (Present)
Designed and fine-tuned a custom LLM (QLoRA) specialized in autonomous vulnerability research — training a base model to reason adversarially, operate custom binary analysis toolchains, form and test exploit hypotheses, and confirm findings end-to-end without human intervention.
- CVE-2026-56412 — libexpat: Incomplete fix bypass in libexpat (heap-use-after-free). PR #1246 was believed complete; XOR-1 identified the missing beforeHandler() guard in doCdataSection().
Affects
Python, Git, CMake and millions of downstream applications worldwide.
- CVE-2026-57158 — FreeRDP: Incomplete fix bypass in the GFX planar decoder. A malicious RDP server triggers a 1-byte OOB read with no user interaction beyond connecting.
Every
FreeRDP client on the GFX pipeline was exposed.
- CVE-2026-53720 — pymonocypher: Heap corruption in the Argon2 password hashing function. Applications using pymonocypher to protect passwords and derive encryption keys were affected. Fix authored by Vorthix, shipped to PyPI in 15 hours.
- CVE-2026-72841 — LibRaw: 6-year-old heap overflow in the Raspberry Pi RAW decoder. Opening a crafted photo in Darktable, ImageMagick, or RawTherapee crashes the process or worse. Fix merged in 24 hours.
Security Researcher — Chromium Bug Contributor at Google Chromium (Present)
- Chromium Fenced Frame ACER Policy Bypass (2026): Identified missing enforcement in allowing cross-origin child iframes to register and fire automatic beacons across the ACER boundary without operator opt-in. AI pipeline mapped enforcement path, generated and validated PoC. Confirmed on stable channel. Assigned P3 privacy bug.
- 2 additional bugs reported: missing input validation and a performance regression. Both assigned and acknowledged by the Chromium security team.
