I'm Chams Bouzaiene, a software engineer in Hamburg. I build AI agents and developer tools, and write in-depth security teardowns — supply-chain attacks, CVEs, and how AI coding tools change the attack surface.
Focus
Three threads run through most of what I build and write.
Agent loops that drive real tools — browsers, terminals, and files — instead of sandboxed copies. dodo, CtxAnt, and now BinaryClerk.
Long-form teardowns of supply-chain attacks and CVEs, and experiments in using AI coding agents for vulnerability research.
Software that keeps your data on your machine: SQLite on disk, your own API keys in the OS keychain, no cloud lock-in.
Projects
What I'm building now, and open-source agents and research I've shipped along the way.
A local-first desktop AI coworker for people who live in the browser. Chat with capable models, let them work in your real tabs, and keep everything on your own machine.
A coding agent written in Go. CLI-first: no editor plugin, no cloud.
Text an agent on Telegram and it drives a real Chrome browser for you.
An AI agent that suggests QA operations for developers.
Prompts, PoC harness, and ASan reproduction from using Cursor and Codex to rediscover CVE-2026-42945.
Writing
Technical notes for when something in the stack deserves a careful teardown.
One generic security prompt, one vulnerable source file, no fuzzers or static analyzers. Cursor found the nginx bug fast; Codex validated it with a real ASan crash.
Technical deep-dive into the Mini Shai-Hulud worm: GitHub Actions cache poisoning, npm propagation, persistence in Claude Code and VS Code, credential theft, dead-man’s switch, and why AI “vibe coding” widens the attack surface.
Cloud AI assistants are great until you notice where your data lives and what they can actually touch. Here's what I'm building instead.
Contact
Questions about something I wrote, or want to talk agents, security, or local-first software? Email is the fastest way to reach me.