Thomas Shadwell

I am an internationally recognised expert on computer security, with specialisms in web security, security program (SSDLC) construction, and automated security analysis.

I am a Member of Technical Staff at OpenAI, where I work on computer security.

I am interested in consulting on legal cases. For business, email me at thomas@shadwell.im.

A selection of my work over the years can be found below.

2026

XXXII

September.

Stanford Security Lunch. Stanford University. Talk with Adrian Spânu at Stanford Security Lunch. §3eb9b.

Visual Studio Code Security Feature Bypass. Microsoft Security Response Center. Critical vulnerability allowing an attacker to compromise a user's computer through VSCode. CVE-2026-81376. §6d3a6.

August.

Visual Studio Code Python Extension Security Feature Bypass. Microsoft Security Response Center. High-severity vulnerability allowing a specially crafted file to bypass a security feature in the Visual Studio Code Python extension. CVE-2026-54981. §86a18.

June.

Beyond Prompt Injection: Agentic AI Attacks in the Real World. Real World AI Security. Talk at Stanford with Adrian Spânu on the present and future of prompt injection. §86c44.

Beyond Prompt Injection: Agentic AI Attacks in the Real World. YouTube. Video of Stanford talk with Adrian Spânu on the present and future of prompt injection. §5e49c.

May.

Letter to Kasimir. zemn.me. A letter to Kasimir, a child of a friend, about the world and how to understand it. §0a5c0.

April.

Beyond Prompt Injection: Agentic AI Attacks in the Real World. DEF CON Singapore. Talk with Adrian Spânu on the present and future of prompt injection. One of the most attended talks at the conference. Q&A lasted for 2 hours. §431c2.

March.

Designing AI agents to resist prompt injection. OpenAI. Blog post on how prompt injection attacks are becoming more like social engineering and how we can design AI agents to be more resistant to them. §f26d0.

February.

Introducing Lockdown Mode and Elevated Risk labels in ChatGPT. OpenAI. Blog post summarising a fully sandboxed mode for chatgpt which mitigates impacts from Prompt Injection. §68408.

January.

Preventing URL-Based Data Exfiltration in Language-Model Agents. OpenAI. Paper describing the mechanism OpenAI products such as ChatGPT use to detect when an AI is communicating non-public data. §8f87f.

Keeping your data safe when an AI agent clicks a link. OpenAI. Blog post summarising paper describing the mechanism OpenAI products such as ChatGPT use to detect when an AI is communicating non-public data. §1a8b0.

2025

XXXI

November.

Understanding prompt injections: a frontier security challenge. OpenAI. Overview of OpenAI’s approach to prompt injection. §2bc4c.

October.

ChatGPT Atlas. OpenAI. AI enabled web-browser. §32dda.

Panel Discussion: How Leading AI Platforms Approach Building Trustworthy Agents. AI Agent Security Summit SF. Panel representing OpenAI at the AI Agent Security summit at the Commonwealth Club of San Francisco. §11a2c.

August.

GPT5. Security for OpenAI's next-generation model. §c0c42.

2024

XXX

December.

The Hagiography of Clean. zemn.me. Article analysing cleanliness, the human condition, and social media. §ab290.

November.

Missing. zemn.me. Article on what it means to miss home after two years. §cc77f.

October.

ChatGPT Canvas. Security for AI pairing system for text. §c1e3a.

September.

Member of Technical Staff, AppSec, OpenAI. Built out OpenAI's first Secure Development Lifecycle (SDLC); security for OAI products including ChatGPT Canvas (ChatGPT Apps, MCP Apps & Code Blocks), OpenAI Atlas, ChatGPT Lockdown Mode, Sign In With ChatGPT, ChatGPT Finance, GPT-4o, GPT5, Apple Intelligence and others. Work on Prompt Injection, Agentic Security & AI cyber risk. §e5c48.

May.

GPT4o. OpenAI. Product security for OpenAI’s first multimodal model. §b220c.

January.

HackFortress Champions. ShmooCon. §741b6.

HackFortress Finals. ShmooCon. Video of the finals of HackFortress at ShmooCon. §48ad5.

2023

XXIX

November.

Member of Technical Staff, Security Product and Platform (PROP), OpenAI. §94c65.

October.

crypto-js PBKDF2 1,000 times weaker than specified in 1993 and 1.3M times weaker than current standard. GitHub Advisory Database. Vulnerability in second most popular Javascript cryptography library allowing forgery of digital signatures. CVE-2023-46133. §1aced.

crypto-es PBKDF2 1,000 times weaker than specified in 1993 and 1.3M times weaker than current standard. GitHub Advisory Database. Vulnerability in maintained fork of most popular Javascript cryptography library allowing forgery of digital signatures. CVE-2023-46233. §4ef84.

August.

Black Badge. DEF CON. The highest award given by the world's largest hacker convention. Awarded for the HackFortress CTF. §19478.

HackFortress Champions. DEF CON. Hybrid CTF / esports competition winners. §1a8b8.

Visual Studio Code is why I have (Workspace) Trust issues. DEF CON 31. Talk at DEF CON by Sonar R&D including original research into VSCode security, reflecting on my own prior art CVE-2022-41034 (not my talk). §9d204.

March.

2022

XXVIII

November.

Visual Studio Code: Remote Code Execution. GitHub Security Advisory. Google research; exploit to remotely take over VSCode and any attached cloud systems. CVE-2022-41034, GHSA-pw56-c55x-cm9m. §bda2e.

2021

XXVII

November.

Relocated to San Francisco from London. §e76c6.

July.

Monorepo. a polyglot, fully tested, automatically upgraded, automatically versioned, continuously integrated monorepo ecosystem reflecting ideas I had working on hardening at scale at Google. §957be.

Apple Hall of Fame. For major security issue covered in 'How to Hack Apple ID'. §3d14e.

2020

XXVI

December.

How to Hack Apple ID. Bypassing cutting-edge web security techniques to hack Apple ID. §3d6ca.

October.

Typescript Union Merging. Using interface merging to write somewhat decentralised Redux actions. §763a0.

August.

HackFortress Champions. DEF CON. §9195a.

July.

Senior Information Security Engineer, Google ISE hardening. Automated security mitigation, detection and refactoring using compiler technology (“langsec”), SDKs and DSLs (“hardening”) on TypeScript and Java. Google-wide mitigations for Log4Shell, XSS, deserialization attacks. Product security review and design, Google Ads (“FLOC”, “FLEDGE”), Google Cloud, Google's IDE (“Cider”). Research including critical disclosures such as CVE-2022-41034. §bbd55.

May.

Why We don't we have UIs like the ones in Neon Genesis. Exploration of how rendering hardware has affected UI design. §0943b.

April.

do-sync. Async to sync library for encapsulated javascript macros. §08e89.

February.

SVGShot. small tool for taking SVG 'screenshots' of webpages. §faf30.

HackFortress Champions. ShmooCon. Defended title for hybrid gaming CTF / esports competition. §e4ad8.

2019

XXV

December.

UK Government Vulnerability Disclosure Initiative. responsible disclosure program created with the UK National Cyber Security Center covering all government assets. §0dd06.

November.

Chromium cross-origin bypass. NVD. in Google Chrome, Blink, or Chromium, it was possible to bypass cross-origin restrictions by causing a refresh of a failed cross-origin request. CVE-2019-13664. §db098.

August.

If CORS is just a header, why don’t attackers just ignore it? Article on common security misconceptions around CORS. §befbb.

July.

CSVPretty. typescript pretty printer for the CSV format. §15042.

National Cyber Security Centre 'Turing' challenge coin. UK National Cyber Security Centre. Award for my work on UK government vulnerability disclosure policy and my responsible disclosure of vulnerabilities in the UK tax system. §c22f9.

June.

react-oauth2-hook. An entirely clientside implementation of an oauth2 implicit client, with React hooks. §7196a.

May.

Full Steam Ahead: Remotely Executing Code in Modern Desktop Applications. Infiltrate. Technical talk at offensive AppSec conference summarising through example research into hybrid web / desktop application security. §10282.

April.

IE 11 command switch injection. MSRC. in IE11, programs on the user's computer could be launched with arbitrary arguments by executing the scheme in an iframe. CVE-2019-0764. §41b9f.

January.

HackFortress Champions. ShmooCon. Hybrid CTF / esports competition winners. §1bb3d.

reactive-d3. react helper bindings for d3. §93de4.

$7,500 Steam Weakness Let Hackers Take Remote Control Of Gamers' PCs. Forbes. News coverage of Steam vulnerability allowing remote access to users’ computers. §98835.

linear. react based personal website for 2019. §ace0f.

Steam Remote Code Execution. HackerOne. Vulnerability to remotely access Steam users' computers. §fdee3.

XSS in Steam React Chat Client. HackerOne. Technical writeup & disclosure of a 1-click attack on the Steam, the world’s largest gaming platform, allowing remote access to users’ computers. §440b0.

2018

XXIV

December.

Übersicht Remote Code Execution, Spotify takeover. Article on an Übersicht form-post bug that let any website control users’ computers, and using Spotify's certificate design to explain why localhost web services are a weak application-security boundary. §a0113.

September.

Cross-site information assertion leak via Content Security Policy. HackerOne. CSP1 information leak allowing efficient deanonymisation of internet users. §91956.

I hacked video games like 300 times and all I got was this stupid talk. Game Dev Days. Talk at Game Dev Days 2018 in Graz, Austria summarising some security concepts for game developers. §7aa34.

August.

HackFortress Champions. DEF CON. §a0b8e.

January.

Application Security Engineer, UK National Cyber Security Centre. advisory position. Provided expertise to UK cyber advisory / defence group on Go and building security analysis systems. Launched world's first government-wide responsible disclosure program. §a3777.

30 under 30, tech. Forbes. For my work at Twitch, and on responsible disclosure. §3c32b.

2017

XXIII

November.

how to hack the uk tax system: the talk. OWASP. Talk at OWASP about critical UK tax system flaw in obfuscated system and the 57 day trek to get it fixed. §88681.

September.

'Serious' security flaws found on official UK tax site. BBC News. News post on manipulation of UK tax data. §9160d.

how to hack the uk tax system, i guess. Vulnerability allowing manipulation of UK tax system. §6186a.

July.

This Will Cut You: Go's Sharper Edges. InfoQ. Musings on Go-specific security gotchas. §d3c06.

February.

Design Evolves By Constraint. musings on the evolution of design. §73ee7.

2016

XXII

May.

'Mr. Robot' Web Weaknesses Left Fans And USA Network Vulnerable, Warns Non-Fictional Hacker. Forbes. Remote code execution in website for TV show “Mr. Robot” allowing attacker to control the website server. §aab45.

Irony Alert: Hacker Finds Vulnerability In Mr Robot Website. Forbes. Code execution vulnerability in website for TV show “Mr. Robot”. §3ab05.

April.

Steam Patches Broken Crypto in Wake of Replay, Padding Oracle Attacks. Threatpost. Padding oracle based attack allowing full decryption of traffic on Steam, the world’s largest gaming platform. §d4b51.

January.

Buffalo NAS Remote Shutdown. Packet Storm. Unauthorized remote shutdown of Buffalo-made network attached storage devices. §12939.

CVE-2016-2049. NVD. Vulnerability in php-openid allowing an attacker to log in as any user. §08426.

r.no.ms. minimal reactive d3.js resistor colour code calculator. §b0e4b.

2015

XXI

December.

Finder’s Fee. Valve Corporation. Unique developer granted cosmetic item for the video game Team Fortress 2 granted for security issue allowing decryption of all Steam traffic. §4a091.

October.

Finder’s Fee. Valve Corporation. Unique developer granted cosmetic item for the video game Team Fortress 2 granted for security issue disclosures allowing remote access to computers running the video game. §214fc.

2014

September.

Senior Application Security Engineer, Twitch. first security engineer at the video game streaming website. Designed security architecture for flagship projects including bits, the Twitch API, extensions and Twitch's OIDC / OAuth AuthN/Z systems. Created and defined security relationships and processes. Built Go security static analysis system, security frameworks and libraries. §0bb2b.

July.

When Security Generates Insecurity. zemn.me. Exploit using content security policy 1 to steal data on the web. §f6bfd.

April.

Sunbeams Ebenezer. Valve Corporation. Unique developer granted cosmetic item for the video game Team Fortress 2 granted for security issues allowing movement millions of dollars of virtual items between arbitrary accounts via account takeover. §9fd25.

January.

5th place, Cambridge Chemistry Challenge (C₃L₆). University of Cambridge. §74086.

2013

XIX

January.

7th place Cambridge Chemistry Challenge (C₃L₆). University of Cambridge. §24896.

Parmiter’s School Sixth Form, Garston. Graduated Sixth Form with A levels in Biology, Chemistry, Physics and Mathematics with Mechanics. §0ce91.

2012

XVIII

May.

Software Engineer, Consultant. Full stack freelance work building MVPs for London startups and wrangling data for hackathons. §169b8.

March.

Developer, Rewired State. Charity focused on teaching code literacy. Ran and participated in hackathons for good causes. Taught software engineering to young people. §f775d.

2011

XVII

November.

MozFest: Rewired State geeft jonge programmeurs een kans De Nieuwe Reporter. Interview on National Hack the Government Day prize (dutch). §214f6.

September.

Sr. Admin, TF2Outpost. Volunteer role at once largest trading website in the Steam community. Worked on administration of high-profile trades & scams. §29971.

August.

Better understanding of the work of Parliament Prize. Rewired State: Parliament. §10750.

April.

Geckoboard Prize. London Real Time Hackathon. §a3363.

Wallace and Gromit Prize. National Hack the Government Day 2011. §6b7e9.

February.

Best example of Coding. Young Rewired State. Prize from national hackathon for young people. §963e6.

2010

XVI

December.

Assistant Obstetrician (shadow). Work experience at the Royal Free Hospital NHS Trust. Spent time in world-leading virology department. §c90df.

January.

Parmiter’s Secondary School, Garston. Graduated Secondary School with GCSES in Biology, Chemistry, English, Geography, Electronics, Mathematics, ICT, BCS, Physics, German and English Literature. §fd4ec.

2009

July.

ICT Support Technician, The Grove Hotel, Watford, UK. Year 12 work experience program at luxury hotel. Networking & technical support. Decompiled and reverse-engineered .net app for ease of provisioning corporate machines via batch scripts. §eb759.

Kenwood House Gardens

51°34′17.0″N 0°10′9.3″W

zemnmez

Thomas NJ Shadwell

⁂