Scaling real-world hacker research with AI to help AppSec teams find and fix their most exploitable risks before attackers do.
Stockholm and Boston
Joined November 2011
- Tweets4.9K
- Following1K
- Followers11.2K
- Likes3.9K
His rules for agent tools: • Wrap whole workflows • Type the inputs • Keep the output lean • Namespace them (recon_subdomains, oob_listen) • Let the tool write the log
“Your agent is not impressed by ASCII art, and neither is Doug McIlroy.”
1
280
The payoff is fewer tokens, less time and findings you can check. One example he cites from Anthropic: presenting tools as a code API cut context from about 150,000 tokens to 2,000.
Read the full piece: blog.detectify.com/best-prac…
3
281
Detectify retweeted
Back in 2021 I wrote a "how to hack APIs" blog for Detectify. It ended up being one of the most-read things I've written that year, but APIs have changed a lot since then: GraphQL, AI-generated endpoints, all of it.
So I rewrote the whole thing for 2026.
Check it out👇
In 2026 the API is the application for most of what you’ll test.
Are your API hacking skills up to date? Check out @hakluke´s latest guide on how to hunt for API vulnerabilities in 2026:
👇 labs.detectify.com/how-to/ho…
Unauthenticated access in AI agent platforms like Ruflo exposes API keys, logs, & execution tools in one go.
Detectify co-founder Johan Edholm spoke with @DarkReading about the expanding attack surface of AI infrastructure.
🔗 darkreading.com/cyber-risk/p…
3
483
When adversaries weaponize LLMs, attack economics change overnight.
@DarkReading details how threat actors turned jailbroken AI into a commercial offensive platform.
Our CEO Rickard Carlsson breaks down why lowering the barrier to entry changes defense: darkreading.com/cyber-risk/h…
409
.@DarkReading reports on "JadePuffer", the first fully agentic, LLM-driven ransomware attack that autonomously executed a network intrusion and extortion. Our co-founder Johan Edholm discusses how traditional incident response can't keep up with AI threats darkreading.com/cyberattacks…
4
3
842
We are proud to recognize some of the top ethical hackers from our Crowdsource community. Thanks to their research submissions, our customers can access some of the best hackers in the world:
labs.detectify.com/crowdsour…
1
4
428
🚨Security Update on CVE-2025-64446 - FortiWeb authentication bypass that leads to complete WAF control. Learn how the impersonation flaw works and what steps to take now.
blog.detectify.com/industry-…
593
We're now integrating real-world threat data into our AI Researcher Alfred to prioritize and generate protection against the most active CVEs, boosting security speed and relevance for all Detectify customers:
blog.detectify.com/product-u…
430
450 automated, validated security tests created in 6 months, targeting critical threats (avg. CVSS 8.5). 70% of tests needed no manual fix. Write-up with our prompts, lessons, & build process in @detectify labs! ⤵️
labs.detectify.com/writeups/…
With the new API Scanner, customers gain access to dynamic payloads that make every scan different. Instead of relying on static methods, the scanner uses ML to randomize and rotate payloads for each run, ensuring fresh attack simulations every time:
Detectify expands AppSec platform with new API scanning capabilities ift.tt/TPG2Meu
1
752
Methods and tools (from DNS records and IP addresses to HTTP analysis and HTML content) that practitioners can use to classify every web app and asset in their attack surface. blog.detectify.com/best-prac…
We know it is hard to ensure all essential web apps are covered with deep DAST. Which of your dozens or hundreds of web apps actually need deep testing? Which are processing user data or even have many components that attackers would target?
blog.detectify.com/product-u…
