vitalysim.com valid

Vitaly Simonovich — Security Researcher

Vulnerability Research · Threat Intelligence · AI Security

Their llms.txt

The beginning of the file, from our validated copy saved 2026-10-26T00:01:19.758Z. Cached copy · Source on vitalysim.com

# Vitaly Simonovich — Security Researcher

> Vulnerability Research · Threat Intelligence · AI Security
> Senior security researcher working across vulnerability research, threat intelligence, and AI security. I break systems the way real attackers do, from core internet infrastructure like DNS and glibc to browsers, web platforms, and LLMs, and turn those findings into practical defenses, threat reports, and education so organizations can stay ahead of attackers.

Last updated: October 9, 2026

## Links
- github: https://github.com/vitalysim
- linkedin: https://linkedin.com/in/vitalysimonovich
- x: https://x.com/vitalysimx
- Location: Remote, available worldwide

## At a glance
- Years Experience: 10+
- CVEs Discovered: 29
- Public Speaking: 12
- Press Mentions: 75+

## Areas of expertise
- Vulnerability Research
- Threat Intelligence
- LLM & GenAI Security
- Jailbreaks & Prompt Injection
- Application Security
- Data Security
- Offensive Security & CTFs
- Security Education & Public Speaking

## Highlights (8)
Selected work, in the order it is presented on the site — the first entry is the featured item.

- **DEF CON 34 Main Track (talk, NEW)** — C(2)YA: Inside the Adversary's Inbox — six months of LLM-assisted research against five C2 frameworks (Havoc, Mythic, Sliver, Covenant, AdaptixC2) yielding 251 findings, 85 exploitable straight from the internet, and 28 takedown chains. (https://defcon.org/html/defcon-34/dc-34-speakers.html)
- **Cited by the UK AI Security Institute (press, Featured)** — Nytheon AI research cited by name in reference 26 of AISI's Frontier AI Trends Report, published on 18 December 2025. (https://www.aisi.gov.uk/frontier-ai-trends-report)
- **HashJack Research (research)** — First known indirect prompt injection technique weaponizing URL fragments to manipulate AI browser assistants. Covered by Forbes, The Register, and The Hacker News. (https://www.catonetworks.com/blog/cato-ctrl-hashjack-first-known-indirect-prompt-injection/)
- **Apple WebKit Vulnerabilities (cve)** — Three flaws in Apple WebKit (CVE-2026-28917, CVE-2026-28962, CVE-2026-43700): a memory-safety crash, an information disclosure issue, and a cross-origin leak of sensitive user data. (https://support.apple.com/en-us/127121)
- **NVIDIA TensorRT-LLM Vulnerabilities (cve)** — Two flaws in NVIDIA's LLM inference engine (CVE-2026-24226, CVE-2026-24234): improper control of code generation, and a server-side request forgery in multimodal media fetching. (https://www.nvidia.com/en-eu/product-security/acknowledgements/)
- **Operation Poisson (research)** — A 33-day French-speaking cybercrime operation captured command-by-command, revealing how a junior operator used Tailscale and OpenSSH to keep access after his C2 went offline. Covered by The Hacker News. (https://www.catonetworks.com/blog/cato-ctrl-operation-poisson-analyzing-a-cybercriminals-entire-operation/)
- **MongoDB Hall of Fame (cve, Hot)** — Pre-authentication denial of service in MongoDB Server (CVE-
…

Related sites

Explore similar publishers →

Similar publisher descriptions and documentation. Similarity does not imply affiliation or equivalent capabilities.

Machine-readable: GET /v1/resolve?q=vitalysim.com · GET /v1/domain/vitalysim.com · this page as Accept: application/json or text/markdown · MCP lookup_domain

Automatically discovered from public files. Inclusion does not imply endorsement or publisher participation.

Claim my listing on Agent Web Map for vitalysim.com:
1. POST https://agentwebmap.com/v1/sites/vitalysim.com/claims and keep claim_id and claim_secret private.
2. Publish the verification line "AgentWebMap verification: <token>" (token from step 1) in https://vitalysim.com/llms.txt, or use the DNS, meta-tag or well-known method the response describes. This only verifies the listing; your website and domain remain yours.
3. POST https://agentwebmap.com/v1/sites/vitalysim.com/verify with {"claim_id": "...", "claim_secret": "..."}.
4. Save the api_key from the answer; it manages the listing (PATCH https://agentwebmap.com/v1/sites/vitalysim.com).
MCP equivalent: tools begin_ownership_claim, then verify_domain, at https://agentwebmap.com/mcp. Docs: https://agentwebmap.com/docs#verify

Corrections or removal requests: contact the directory.