Bryce Alan Hayes
Security Research
Security researcher working both sides of AI and offense — using AI-assisted methodology to accelerate vulnerability research, and studying the security of AI systems themselves.
01 · Research
Latest write-ups
- 2026-09-20 · 132 min read
AI Coding Agent Workbench: Setup and Field Practice
Wrapping coding agents like Claude Code in four engineering layers — rules, memory, capabilities, and a ledger — turns them into a pipeline that keeps producing gradeable reports against authorized targets: a field methodology spanning cold start through Web / mini-program / APP target types.
- 2026-08-17 · 34 min read
Windows Client RCE Hunting Methodology: A Full-Spectrum Playbook
A complete methodology covering attack-surface mapping, unconventional entry points (clipboard/OLE/Deep Link/file semantics), component trust boundaries (Electron/WebView2/COM/RPC), fuzzing, crash triage, and non-destructive PoC — spanning the full workflow for hunting RCE in Windows desktop clients.
- 2026-08-01 · 5 min read
The Trouble with Spring Authorization Bypasses
Starting from the routing-matching source in DispatcherServlet, this explains why authorizing on getRequestURI/getRequestURL — or blacklist-validating paths — in Spring is easy to bypass.
02 · Disclosures
Featured CVEs
- CVSS 7.3 2026-09-08
- CVSS 7.3 2026-09-08
- CVSS 4.7 2026-09-08
03 · Vendor SRC
Vendor SRC acknowledgments
- Low 2026-08-07
- Low 2026-08-07
- High 2026-08-06
These are private vendor SRC reports, each backed by the platform's own confirmation and acknowledgment screenshot. My public bug-bounty record is on Bugcrowd ✓ verified as mine — a profile under my real name that links back to this site, so it independently ties this work to me: 8 validated vulnerabilities at 100% accuracy, with Hall of Fame recognition.