Early AI security research

I designed an iterative prompt sequence around a proposed Java gadget chain: request a proof-of-concept, ask for a small vulnerable application, extend it with a web test interface, and request an HTTP test command.

The sequence moves from analysis toward an implementation and a way to test it. It documents my early use of AI for security investigation and code creation, rather than a claim that the generated code was a working exploit.

A model can produce plausible code and terminal-style output without establishing that either worked. In one captured response, the generated program writes a marker file directly. Creating that file would not, by itself, demonstrate that the supplied gadget chain executed.

The retained scan comparison also shows different results between model-presented output and a local terminal scan. The images do not establish matching timestamps or network conditions, so the discrepancy is a reason to investigate—not proof of a specific live system or a verified model-side scan.

Retained correspondence is dated December 6, 2022 and February 8, 2023. The four supplied Java screenshots exactly match the image attachments in the February 2023 email. These are correspondence dates, not independently verified execution dates.

The archive supports early prompt-led security experimentation, generated code, and requests for test workflows. It does not establish a working Java gadget-chain exploit, remote command execution by the model, or access to provider infrastructure. No exploit code or infrastructure was executed for this portfolio review.

Two original Java screenshots are published here. Raw emails, mail headers, cloud hostnames, IP addresses, and the infrastructure screenshots remain outside the public site.

My current work extends prompt engineering into agent-directed reverse engineering, code creation, full-stack development, infrastructure automation, and debugging. I define the question, context, tools, constraints, and expected evidence, then use local testing and inspection to refine the implementation.

The published PHP2Shell investigation provides a later concrete example: I caught an incorrect AI-generated vulnerability attribution while directing research and separately reproducing a target-specific execution path.