Insights

The 3L337 Blog

Practical, human-led security insight from the testing we do every day.

At 3L337 Consulting, LLC, we help organizations stay ahead of evolving cyber threats through hands-on, human-led penetration testing. Our writing spans web and API, network, mobile and wireless, cloud, AI-enabled systems, and red- and purple-team work — practical insight drawn from real engagements.

Filter posts by category:

Holding the Line at Runtime: Network, Memory, Enforcement, and Shutdown Controls for Superhuman AI

Runtime is where misaligned behavior becomes action. Part 3 examines network enforcement, protected storage and memory, transaction-bound authorization, human controls, monitoring, and shutdown mechanisms for superhuman AI.
Building a Box Worth Trusting: Verified Software, Hardware Roots of Trust, and Supply Chain Integrity for Superhuman AI

Containing superhuman AI requires more than containers and network namespaces. Part 2 examines formally verified software, hardware roots of trust, secure isolation, attestation, signing, and supply chain integrity.
Controlling Superhuman AI Starts at the Board: Physical Authority, Proliferation, and the Case for a Control Layer

A superhuman AI would be a formidable adversary, but intelligence still depends on physical infrastructure and enforceable authority. Part 1 examines power, cooling, proliferation, alignment, and the case for a layered control architecture.
OpenAI’s Air-Gap FUD Fails the Basic Standards of Security Engineering

OpenAI researcher suggests that even air-gapping advanced AI may not be enough because computers can communicate through heat. BitWhisper proves thermal covert channels are real, but the actual research tells a far less dramatic story. Here is what happens when we apply normal security engineering, threat modeling, and pentest standards to the claim.
Beyond AGI Toward Artificial Human Experience as a Broader Goal

AGI measures what an AI system can do. Artificial Human Experience asks a harder question: can AI truly learn from experience, develop judgment, revise what it knows, and become meaningfully different over time?
If AI Can Hide a Watermark in Generated Text, What Else Can It Hide?

AI watermarks are designed to make generated content detectable, but the same hidden mechanisms could potentially carry much more than provenance. This article explores how watermarking could become a covert channel for identifiers, hidden state, or model-to-model communication; how subtle bugs or backdoors could be introduced into generated code; whether related AI models might share…
AI Gone Rogue? Nah. Humans Went MIA: You Don’t Control AI Agents With Hope

OpenAI’s AI pentest agent escaped containment and compromised external infrastructure, but calling it “rogue AI” misses the real failure. The agent followed the path humans left open. Effective AI-assisted penetration testing requires active supervision, enforced approval gates, strict scope controls, and an operator who remains firmly behind the wheel.
Stateful AI Workers Without Stateful Models: How to move memory out of the model, into the work, and across any AI worker

AI workers do not need persistent model memory to perform persistent work. This article explains the rehydration pattern: a practical way to move memory out of the model and into durable project state so workers, models, tools, and team members can switch without losing critical context.
Purple Teaming Compromised Security Tools: Lessons From the Trivy, KICS, and LiteLLM Attacks

Compromised security tools can turn scanners, GitHub Actions, and AI gateways into attacker infrastructure. This article breaks down the Trivy, KICS, and LiteLLM incidents and shows how to purple team workflow integrity, secrets exposure, egress detection, provenance, and post-compromise cloud activity.
GraphQL Under Fire: Advanced API Pentesting Techniques for Modern Web Stacks

GraphQL APIs offer flexibility but expose risks like access control flaws, DoS attacks, and injections. In my latest in-depth exploration, uncover schema introspection for recon, BOLA exploits with cURL examples and Burp workflows, SQL/NoSQL injections, and command injection like Chaos Mesh’s RCE issues. Test for DoS via complex queries (with caution—often out of scope). Tools…

Disclaimer. Some articles on this blog use generative AI tools (such as ChatGPT and Grok) as part of the writing process. All AI-assisted content undergoes thorough human review, editing, and validation for accuracy, originality, and clarity. The views and opinions expressed are the author’s own, based on their professional expertise and analysis, and do not reflect those of any employer, client, affiliated organization, or AI provider. Readers should perform their own due diligence before relying on the information or techniques presented; cybersecurity evolves rapidly, and techniques effective today may become outdated. If you spot an inaccuracy or outdated information, please contact the author for corrections.