Benjamin Kincses

@benihacking

Security researcher and bug bounty hunter from Hungary. Open source contributor, 48 PRs merged into other repos. benihacking.top

Budapest

Pinned
Benjamin Kincses
@benihacking
Oct 29
Security researcher from Hungary. I audit open source and AI products, prove every finding with a working PoC, then report it. 21 advisories filed and 47 PRs merged so far. Findings and writeups here from now on.
Benjamin Kincses
@benihacking
2h
If your agent can call tools, every tool argument is attacker input. Prompt injection is not a chatbot problem. It is an authorization problem. Untrusted text should never reach a consequential tool call without a check the model cannot override.
Benjamin Kincses
@benihacking
Nov 13
Most of my best findings started in the JS bundle, not in a scanner. Scanners test what they know. The bundle tells you what the app actually does. Read it first.
Benjamin Kincses
@benihacking
Nov 13
free ai method #100 Ling-3.1-flash-1019 Ant Group, inclusionAI 560B total, 25B active MoE 1M context MIT license, no revenue carve-out weights free on Hugging Face
inclusionAI/Ling-3.1-flash-1019 · Hugging Face
From huggingface.co
Benjamin Kincses
@benihacking
Nov 12
most bounty reports die in the first minute. not on the bug. on the repro. no target, no steps, no expected vs actual. write the repro like the triager is tired and in a hurry. because they are.
1

Benjamin Kincses’s posts