Self-hosted AI security, live-verified or honestly rebutted. Platform engineering and independent vulnerability reproduction by Erik Van Till. Detect-and-disclose only.https://example.com/https://example.com/blog/fractal-basins-repro/https://example.com/blog/fractal-basins-repro/Independent reproduction of Lai et al. 2026 on the EqR recurrent solver, with a bit-exact early-exit solver at 2.75x.Fri, 18 Sep 2026 00:00:00 GMThttps://example.com/blog/plex-undisclosed-fixes/https://example.com/blog/plex-undisclosed-fixes/Plex patched multiple undisclosed vulnerabilities in 1.43.3 with no CVEs and no technical detail. We diffed the binaries and verified the fix behavior against a live instance.Wed, 23 Sep 2026 00:00:00 GMThttps://example.com/blog/saw-test/https://example.com/blog/saw-test/We steered a 4B language model into strong negative and positive states, then asked it to choose between its own relief and someone else's suffering. Local weights, no APIs, everything reproducible on a laptop.Thu, 24 Sep 2026 00:00:00 GMThttps://example.com/blog/three-live-proofs/https://example.com/blog/three-live-proofs/Unauth RCE on Ray's current release, unsandboxed code exec in Langflow's authenticated build path, and a task-runner sandbox escape in n8n.Wed, 23 Sep 2026 00:00:00 GMThttps://example.com/blog/tireless-search/https://example.com/blog/tireless-search/How a one-person audit lab runs pattern-first fan-out across self-hosted AI infrastructure, and what the first month found.Tue, 22 Sep 2026 00:00:00 GMThttps://example.com/blog/validator-wars/https://example.com/blog/validator-wars/A best-in-class URL validator beaten by its own parser, a whitelist that never checks the URL, and a server with no validator at all. Plus the bridge that closed the same seam properly.Thu, 24 Sep 2026 00:00:00 GMT