SSRF Beyond HTTP: Egress-Path-Incomplete Guards in AI Agent Platforms
A formal egress-path-incomplete SSRF model instantiated on CVE-2026-33234 (AutoGPT). Zenodo, 2026.
// root@pavan ~ ./recon
Pavan Nallamothu
Offensive security researcher and bug bounty hunter. Twelve CVEs published through MITRE, with credits from Apple, CISA, and the NSA. I hunt on HackerOne, Bugcrowd, Google VRP, Apple Security Bounty, and Meta, and hold an M.S. in Cybersecurity.
12
CVEs Published
3
Apple · CISA · NSA
5
Bug Bounty Platforms
4+
Years Cloud/DevOps
Published CVEs
Twelve MITRE-published CVEs across Apple, the NSA, CISA, AutoGPT, yt-dlp, and BlueprintUE, covering sandbox escapes, SSRF, authentication bypass, IDOR, path traversal, and denial of service.
Credited by CISA in advisory ICSA-26-230-01 for reporting CVE-2026-63133, CVE-2026-63134, and CVE-2026-63177 in CISA Malcolm, and by Apple in macOS security updates.
// hover any card to pause the loop
Exploit Lab
Live reproduction scripts for disclosed bugs. Each visit loads a random proof of concept, and the tabs switch between them.
Publications
Open-access security research preprints with permanent DOIs, indexed by OpenAIRE and Google Scholar.
Trusting the Filename: File-Write Attacks from Untrusted Archive and Download Metadata
File-write attacks from attacker-controlled archive and download metadata across three 2026 CVEs. Zenodo, 2026.
Experience
Running AWS infrastructure at scale, building and hosting CTF challenges, and supporting a university campus.
Education & Credentials
Master of Science in Cybersecurity from Pace University, awarded a Graduate Merit Scholarship.
Education
M.S. Cybersecurity
Pace University, New York, NY · 2023 – 2025 · Graduate Merit Scholarship
Certifications
Community
Talks, mentoring, competition, and event organizing across the security and open-source communities.
Open-Source Builds
Seventeen systems tools written from scratch in Rust, each its own repository with a live project page. Build-your-own versions of the software I break for a living, from a static analyzer to a version-control core.
Oracle
A query language whose result is an attack path across identity and network graphs, not rows. Aimed at AWS IAM privilege escalation and lateral movement.
Lint-Owl
A static analyzer for Python, JavaScript, and PHP that returns the data-flow path from source to sink, not just a warning.
Unweave
An EVM bytecode disassembler that reconstructs intent and flags dangerous opcodes, not just mnemonics.
Cipherlock
An encryption toolkit with from-scratch ChaCha20-Poly1305 AEAD, proven against the RFC 8439 test vectors.
Flint
An embedded key-value store, the SQLite of KV stores. A single binary and a directory, no server to run.
Rift
A reverse proxy whose routing rules are a compiled DSL, not YAML.
Metronome
A cron scheduler built as a single binary around a pure, unit-tested schedule engine you can embed.
Honeycomb
A readable global memory allocator that reports bytes-in-use and peak live memory.
Semaphore
A length-prefixed binary wire protocol you can read in one sitting.
Timelace
A version-control core with content-addressed blob, tree, and commit objects. The git idea made readable.
Trailhead
A full-text search engine with an inverted index and TF-IDF ranking, readable end to end.
Mirage
A panic-free stack bytecode VM with its own assembler and bytecode format.
Phantom
A CHIP-8 CPU emulator you can unit-test opcode by opcode.
Sprite
A tiny embeddable scripting language and interpreter you can read in a sitting.
Prism
A software rasterizer that draws real 3D triangles on the CPU with a z-buffer, no GPU.
Synapse
A reverse-mode autograd engine you can follow node by node. Trains a network on XOR.
Reverb
An audio synthesis engine with oscillators, an ADSR envelope, and a hand-written WAV writer.
More from the site
Shell
Type help to see all commands. Try neofetch, cves, experience, or scan github.com.
guest@pavan-blog:~$
Get in Touch
Reach out for collaboration, coordinated disclosure, or a conversation about offensive security.
Get in touch
Have a question or want to work together? Reach out directly.
Connect with Pavan Nallamothu on LinkedIn.