Sean Heelan
Irish vulnerability researcher who wrote about automatic exploit generation in 2009 and in 2025 had a language model find a new security bug in the Linux kernel.
Heelan's master's thesis at Oxford (2009) was about going automatically from a crash to a working exploit — a problem then considered close to academic. He stayed in exploitation and program analysis, and co-founded Optimyze, a continuous-profiling company, with Thomas Dullien; Elastic bought it in 2021.
In May 2025 he described how OpenAI's o3, fed the source of the kernel's SMB server ksmbd, found a previously unknown use-after-free in its logoff handling (CVE-2025-37899). The model was right in roughly one run out of a hundred and wrong in the rest. Heelan's conclusion was sober: noisy but useful, rather like fuzzing once was — and the first public case of its kind that holds up to scrutiny.