Yan Shoshitaishvili

Associate professor at Arizona State University, where his research covers vulnerability analysis, exploitation, and automated repair. Author of the angr binary-analysis framework, built during his own graduate work and now the substrate for a long line of research prototypes from the same lab.

Delivered the closing keynote of Black Hat USA 2026, Vulnerability Research in the Agentic Age, introduced by Jeff Moss.¹ The keynote is the wiki’s source for two concepts: the analyzer ordering confound, which holds that cross-tool finding-count comparisons measure which tool ran first, and vulnerability properties as an explicit input to agentic discovery pipelines.

He is a named co-author of ExploitGym, the exploit-generation benchmark published by UC Berkeley RDI with sixteen authors across seven organizations.² His name and the Berkeley group’s appear together on this one author list; the CyberGym and CyberGym-E2E papers from the same group name neither him nor his lab, and the ExploitGym attribution names Arizona State University rather than SEFCOM.

His career runs through competitive CTF — team Shellphish, and Order of the Overflow, which organized the DEF CON CTF — into academic automation of the same work.

His stated position on capability restriction is that it is misguided. Fifteen years of offensive research conducted in the open, including open-sourcing angr and the team’s cyber reasoning system from the Cyber Grand Challenge and the AI Cyber Challenge, is the basis: the defending population is the larger one, and a capability gate costs it more than it costs an adversary. He extends this to proposals for restricting capable open-weight and next-generation models.

He also runs pwn.college, Arizona State University’s open security-education platform, and argues that agentic tooling raises the return on human security expertise rather than retiring it.

The Frontier AI for Vulnerability Discovery thesis carries his Black Hat keynote as its only harness ablation run at fixed model capability, and his lab as one of two non-vendor operators supplying primary results on that axis.

Footnotes

1. Yan Shoshitaishvili, Keynote: Vulnerability Research in the Agentic Age, Black Hat USA 2026 (2026-08-06). See the talk summary. ↩

2. UC Berkeley RDI, ExploitGym (fetched 2026-08-31); arXiv:2605.11086. Local copy: .raw/articles/exploitgym-2026-08-31.md. ↩