GeezerVison

GeezerVison is showing secure.dev — Root Cause by struct

My name is Chris Rohlf. I've been a security and software engineer since 2003. 'Root Cause' is a space to post technical articles about computer security, obscure computer science topics, and US national security policy. You can reach this page at secure.dev or struct.github.io

Shrinking Margins

March 7th, 2026 - Frontier models don't perform vulnerability discovery the way traditional tools do, they reason through code the way humans do, and the margin left for human researchers is rapidly shrinking.

Agentic Sufficiency Curve

November 22nd, 2025 - Some quick thoughts on what I call the 'Agentic Sufficiency Curve', a threshold where GPU capacity for inference becomes good enough for a specific problem domain and the bottleneck shifts to driving agents with commodity CPU's, and what it means for AI competition between states.

A Guest Lecture on 'AI, Cyber and National Security'

October 25th, 2025 - This week I had the pleasure of guest lecturing on Artificial Intelligence, Cyber and National Security at both Georgetown University and Johns Hopkins SAIS in Washington DC.

Exploring the Security of the GGML RPC Server

July 27th, 2025 - I spent some time auditing the GGML RPC C++ implementation, writing a simple fuzzer and fixing some of the issues I found. This article takes a deep dive into those discoveries, how I implemented the fuzzer and what work is still left to be done.

The definition of cyber "defense"

February 8th, 2025 - AI governance discussions often have a limited understanding of what cyber defense means in practice. If we want better AI policy then we must work to broaden this definition to include the software engineers who build these systems and the activities that occur to secure them long before they are deployed.

AI Replication: Work and Exploitation

October 19th, 2024 - A short essay with some thoughts on how AI agents might acquire the funds and resources necessary to replicate and adapt.

AI + Cyber and the Security Dilemma

October 6th, 2024 - A short essay on how AI and cyber security might affect and introduce additional complexity into the broader security dilemma between states.

LLM Emergent Abilities and Weird Machines

October 4th, 2024 - Comparing the similarities and differences between LLM emergent abilities and weird machines.

No, LLM Agents can not Autonomously Exploit One-day Vulnerabilities

April 21st, 2024 - A brief analysis of an AI research paper on using LLM based agents to autonomously discover and exploit vulnerabilities 1-day vulnerabilities

AI and Hardware Enabled Governance Mechanisms

April 7th, 2024 - An article that briefly explores the concept of HEMs to enforce AI governance and national security policy.

No, LLM Agents Cannot Autonomously "Hack" Websites

February 19th, 2024 - A brief analysis of an AI research paper on using LLM based autonomous agents to discover and exploit vulnerabilities in web applications.

Memory Safety: An Explainer

September 26th, 2023 - Published on the CSET Georgetown Blog. Memory safety issues remain endemic in cybersecurity and are often seen as a never-ending source of cyber vulnerabilities. But what exactly is memory safety? This explainer explores the topic of Memory Safety, and its origins, for policy makers.

AI Code Generation and Cyber Security Retrospective

September 23rd, 2023 - A short retrospective on how AI code generation has unfolded for cyber security since 2021.

Notes on RISC-V Support and Security Implications

May 20th, 2023 - Brief notes I wrote on what is required to support a functioning RISC-V system and security implications of architecture and design choices.

Memory/Pointer Tagging In IsoAlloc

November 25th, 2022 - A brief overview of the Memory Tagging implementation in IsoAlloc inspired by MTECheckedPtr and ARM MTE.

Uninitialized Read Detection in IsoAlloc

April 4th, 2021 - I introduced a new feature to IsoAlloc that can detect uninitialized reads using the userfaultfd syscall. This article covers the technical details of how it works.

Isolation Alloc

March 8th, 2020 - This post describes a new secure memory allocator I wrote that relies on an isolation strategy and other lightweight security checks to detect and mitigate memory safety issues.

Map Guard and Intel MPK

July 28th, 2019 - A brief overview of the Map Guard library I published to github and how it uses Intel Memory Protection Keys (MPK) to dynamically mark all code in a process as execute only.

Bytes, Bombs and Spies - Review

June 15th, 2019 - My review of 'Bytes, Bombs and Spies'. A quick recap of my thoughts on this collection of essays tackling the topic of strategic cyber offense. Originally posted on Dave Aitels CyberSecPolitics blog.

Cross DSO CFI - LLVM and Android

January 1st, 2019 - I wanted to briefly explore cross DSO CFI implementations and whether targeting their fast path 'Shadow' allocations was possible as an exploitation technique (it's not).

Chrome Oilpan - Meta Data, Freelists and more

April 7th, 2017 - In this article I briefly cover the internals and some weaknesses of OilPan, Google's Garbage Collected heap for Chrome.

Hardening PartitionAlloc

January 22, 2016 - In this article I dive into how PartitionAlloc works by first explaining its origins and how some of its basic allocation code paths work. I also introduce some basic hardening measures by randomizing the freelist and adding some basic double free protection.