Top all-time · #4237
Sean Heelan
Personal blog · sean.heelan.iosecurityaiprogramming
Sean Heelan's personal blog at sean.heelan.io covers security, ai and programming. Since 2016, 18 different Hacker News readers have linked it 20 times, most often “I used o3 to find a remote zeroday in the Linux SMB implementation”. It is still writing: the last post was on 2026-01-18, and you can follow it by feed.
Too few sampled comments (10) to say how often HN recommends it.?
Why HN links it
HN commenters cite his post on using o3 to find a remote zero-day in the Linux kernel's ksmbd as evidence that LLMs can find real security bugs, and as a source for how many LLM calls that takes.
Summarised by Claude from a sample of 10 HN comments that link here. Each comment is marked recommending, critical or neutral (citing without judging); how this works.
If you'd like to get in contact you can find me on Twitter or LinkedIn. Recent Posts Other Popular Posts A full list of all posts, organized by category and year, can be found here.
Most-linked posts?
- I used o3 to find a remote zeroday in the Linux SMB implementation10 people · 11 mentions · first linked 2025-05-22
- The Coming Industrialisation of Exploit Generation with LLMs4 people · 4 mentions · first linked 2026-01-18
- PhD Thesis: Greybox Automatic Exploit Generation for Heap Overflows2 people · 2 mentions · first linked 2020-11-19
What Hacker News says?
I find it extremely useful as a research tool. It can talk to probably over 100 models at this point, providing a single interface to all of them and logging full details of prompts and responses to its SQLite database. This makes it fantastic for recording experiments with different models over time. The ability to pipe files and other program outputs into an LLM is wildly useful. A few examples: llm -f code.py -s…
Comment linking /2025/05/22/how-i-used-o3-to-find-cve-2025-37899-a-remote-zeroday-vulnerability-in-the-linux-kernels-smb-implementation/
on “Show HN: My LLM CLI tool can run tools now, from Python code or plugins”Submitted I used o3 to find a remote zeroday in the Linux SMB implementation as a story · 658 points
HN discussionRecently, Sean Heelan wrote a post "How I used o3 to find CVE-2025-37899, a remote zeroday vulnerability in the Linux kernel’s SMB implementation". It might be what they are referring to. Link: https://sean.heelan.io/2025/05/22/how-i-used-o3-to-find-cve-...
Comment linking /2025/05/22/how-i-used-o3-to-find-cve-2025-37899-a-remote-zeroday-vulnerability-in-the-linux-kernels-smb-implementation/
on “OpenAI dropped the price of o3 by 80%”Submitted How I used o3 to find a remote 0-day vulnerability in the Linux kernel (ksmbd) as a story · 17 points
HN discussionMy takeaway - from this article, from Google’s AlphaEvolve [1], and the recent announcement about o3 finding a zero day in the Linux kernel [2] - is that Gemini Pro 2.5 and o3 in particular have reached a new level of capability where these ideas that were tried unsuccessfully with other models, suddenly just work. [1] https://deepmind.google/discover/blog/alphaevolve-a-gemini-p... [2] https://sean.heelan.io/2025/05…
Comment linking /2025/05/22/how-i-used-o3-to-find-cve-2025-37899-a-remote-zeroday-vulnerability-in-the-linux-kernels-smb-implementation/
on “Surprisingly fast AI-generated kernels we didn't mean to publish yet”Submitted PhD Thesis: Greybox Automatic Exploit Generation for Heap Overflows as a story · 3 points
HN discussionI find this hard to believe- how would you even know if someone used AI in producing a PR or indie product? Are you omniscient? Further, there are articles here on HN all the time about people using AI for actual serious work. Heres a pretty significant example : https://sean.heelan.io/2025/05/22/how-i-used-o3-to-find-cve-...
Comment linking /2025/05/22/how-i-used-o3-to-find-cve-2025-37899-a-remote-zeroday-vulnerability-in-the-linux-kernels-smb-implementation/
on “The rise of judgement over technical skill”Submitted The Coming Industrialisation of Exploit Generation with LLMs as a story · 2 points
HN discussionThe reasoning does not need to be 100% accurate to be useful. Humans are rarely 100% accurate at anything, and yet over time we can build up large models of problems using verification and review. We can do the exact same thing with LLMs. The best example of this is Sean Heelan, who used o3 to find a real security vulnerability in the Linux kernel: https://sean.heelan.io/2025/05/22/how-i-used-o3-to-find-cve-... Sean…
Comment linking /2025/05/22/how-i-used-o3-to-find-cve-2025-37899-a-remote-zeroday-vulnerability-in-the-linux-kernels-smb-implementation/
on “Reasoning models reason well, until they don't”Submitted On The Coming Industrialisation of Exploit Generation with LLMs as a story · 1 points
HN discussionVery well put. The trick is to do either of the following: 1. Find simpler tasks for which the trust in LLMs is high. 2. Give tasks to the LLMs that have a very low cost to verify (even when the task is not simple) - particularly one off scripts. I once had a colleague who was in the "not trust" bucket for the work we were doing. So we found something he was good at that was a pain for me to do, and re-assigned him…
Comment linking /2025/05/22/how-i-used-o3-to-find-cve-2025-37899-a-remote-zeroday-vulnerability-in-the-linux-kernels-smb-implementation/
on “Peer Programming with LLMs, for Senior+ Engineers”Submitted The Coming Industrialisation of Exploit Generation with LLMs as a story · 1 points
HN discussionI learned from a recent post ( https://sean.heelan.io/2025/05/22/how-i-used-o3-to-find-cve-... ) that finding security issues can take 100+ calls to an LLM to get good signal. So I wonder about agent implementers who are trying to get good signal out of single calls, even if they are specialized ones.
Comment linking /2025/05/22/how-i-used-o3-to-find-cve-2025-37899-a-remote-zeroday-vulnerability-in-the-linux-kernels-smb-implementation/
on “Learnings from building AI agents”Submitted Application Optimisation with LLMs as a story · 1 points
HN discussionI wrote to him as a comment under his post > sebstefan: There’s this one from yesterday > https://sean.heelan.io/2025/05/22/how-i-used-o3-to-find-cve-... > David Gerard: > My experiment harness executes this N times (N=100 for this particular experiement) and saves the results > That’s just fuzzing but vastly less efficient? > Also, that’s not the question being asked, is it. It wasn’t “did someone use an AI for any…
Comment linking /2025/05/22/how-i-used-o3-to-find-cve-2025-37899-a-remote-zeroday-vulnerability-in-the-linux-kernels-smb-implementation/
on “How I used o3 to find a remote 0-day vulnerability in the Linux kernel (ksmbd)”Submitted Finding 10x+ Performance Improvements in C++ with CodeQL as a story · 1 points
HN discussionPeople have found 0days assisted by LLMs for a while, and none of them wrote hype pieces to find an excuse not to release their 10x bigger model in the middle of a GPU shortage. https://sean.heelan.io/2025/05/22/how-i-used-o3-to-find-cve-...
Comment linking /2025/05/22/how-i-used-o3-to-find-cve-2025-37899-a-remote-zeroday-vulnerability-in-the-linux-kernels-smb-implementation/
on “Small models also found the vulnerabilities that Mythos found”Submitted Greybox automatic exploit generation for heap overflows in language interpreters as a story · 1 points
HN discussion> LLMs agents are not exploiting kernels to get out of the sandbox. You can't assume that. Attackers with LLMs have enough capabilities to engineer them to build exploits for kernel vulnerabilities [0] or to bypass sandboxes to exfiltrate data [0] in covert ways. It is completely possible to craft a chained attack for an agent to bypass sandboxes even with or without a kernel exploit. From [0] and [1] [0] https://se…
Comment linking /2026/01/18/on-the-coming-industrialisation-of-exploit-generation-with-llms/
on “Running Claude Code dangerously (safely)”Submitted Tracking Down Heap Overflows with Rr as a story · 1 points
HN discussion
