# clearbluejar blog, code, and research This is one page of public article previews, not the complete archive. Follow Next page to continue. Summaries are not the original full articles. ## Abliterated Models Show Verdict Bias in FreeBSD Kernel Bug Hunting DevFeed: [Abliterated Models Show Verdict Bias in FreeBSD Kernel Bug Hunting]() Original publisher: [Read original article]() Author: clearbluejar Published: 2026-09-01T06:00:00Z Content type: article Language: en Sources: [clearbluejar]() Topics: [freebsd](), [vulnerability](), [bug](), [Kernel](), [gemma4](), [Testing](), [gemma]() Tags: [bug](), [bug-hunting](), [cve](), [false-positives](), [freebsd](), [gemma](), [gemma-4](), [kernel](), [llms](), [testing](), [vulnerability](), [vulnerability-research]() ### AI overview The article examines local abliterated open-weight models during vulnerability scanning of FreeBSD kernel source. Compared with base models of the same family and size, the modified models produced substantially more candidate and VALID findings, including false positives, while the most aggressive build did not surface the real CVE in a 28-file scan. The article describes this tendency as verdict bias: a greater willingness to return positive findings under uncertainty. ### Source excerpt Abliterated models never refuse, which makes them tempting for bug hunting. But on the same kernel source, they graduate three to four times as many findings to VALID, including false positives the base correctly rejects, and across a 28-file scan of FreeBSD's sys/rpc the most aggressive build never surfaced the real CVE at all. ## System Over Model, Tested: Reproducing Mythos's FreeBSD Find on Local Open-Weight Models DevFeed: [System Over Model, Tested: Reproducing Mythos's FreeBSD Find on Local Open-Weight Models]() Original publisher: [Read original article]() Author: clearbluejar Published: 2026-06-04T07:00:00Z Content type: article Language: en Sources: [clearbluejar]() Topics: [freebsd](), [gpt-oss](), [Artificial Intelligence](), [gemma4](), [bug](), [Large Language Model](), [Benchmark](), [Python]() Tags: [ai](), [benchmark](), [cve](), [false-positives](), [freebsd](), [gemma-4](), [gpt-oss](), [llm](), [llms](), [python](), [rce](), [vulnerability-research]() ### AI overview This article tests AISLE's vulnerability-finding pipeline on the local open-weight models gpt-oss-20b and gemma-4-31b-it using a FreeBSD RCE as the benchmark. The models initially appeared to miss the bug, but a rerun recovered it. The author reports that adding a reachability stage reduced false positives from 30 to 5 while retaining the CVE finding. ### Source excerpt Mythos found a 17-year-old FreeBSD RCE; AISLE reproduced it with gpt-5.4-nano via their nano-analyzer pipeline. I ran the pipeline on two local open-weight models, gpt-oss-20b and gemma-4-31b-it. The misses recovered on re-run. The real problem was the false-positive rate, and one extra system stage cut it from 30 to 5 with the CVE still standing. ## pyghidra-mcp Meets Ghidra GUI: Drive Project-Wide RE with Local AI DevFeed: [pyghidra-mcp Meets Ghidra GUI: Drive Project-Wide RE with Local AI]() Original publisher: [Read original article]() Author: clearbluejar Published: 2026-05-05T07:00:00Z Content type: article Language: en Sources: [clearbluejar]() Topics: [Ghidra](), [Reverse Engineering](), [Local AI](), [MCP Server](), [Artificial Intelligence](), [Processes]() Tags: [ai](), [gemma4](), [ghidra](), [local](), [local-ai](), [mcp](), [mcp-server](), [reverse-engineering]() ### AI overview The article presents pyghidra-mcp v0.2.0, which adds a GUI-backed mode allowing a local LLM to drive a live Ghidra CodeBrowser across an entire project. It demonstrates real-time function renaming, plate comments, and cross-binary analysis, with edits recorded in Ghidra's undo history. ### Source excerpt pyghidra-mcp v0.2.0 ships a GUI-backed mode that lets a local LLM drive a live Ghidra CodeBrowser at full project scope. Renames, plate comments, and cross-binary pivots land in real time, with every edit tagged in Ghidra's undo history while the session is alive. ## How LLMs Feed Your RE Habit: Following the Use-After-Free Trail in CLFS DevFeed: [How LLMs Feed Your RE Habit: Following the Use-After-Free Trail in CLFS]() Original publisher: [Read original article]() Author: clearbluejar Published: 2026-02-03T06:15:00Z Content type: tutorial Language: en Sources: [clearbluejar]() Topics: [Reverse Engineering](), [Large Language Model](), [vulnerability](), [race-condition](), [Windows](), [Kernel](), [Logging]() Tags: [ghidra](), [kernel](), [llms](), [macos](), [race-condition](), [reverse-engineering](), [vulnerability]() ### AI overview This article describes how LLMs and pyghidra-mcp support reverse engineering by tracing a use-after-free vulnerability in Windows Common Log File System (CLFS) through a patch diff. It explains CLFS, its Win32 and kernel-driver interfaces, and how a race condition can trigger the vulnerability. ### Source excerpt Dive into how LLMs and pyghidra-mcp accelerate reverse engineering by tracing a UAF vulnerability in CLFS through a patch diff. ## pyghidra-mcp: Headless Ghidra MCP Server for Project-Wide, Multi-Binary Analysis DevFeed: [pyghidra-mcp: Headless Ghidra MCP Server for Project-Wide, Multi-Binary Analysis]() Original publisher: [Read original article]() Author: clearbluejar Published: 2025-08-19T15:56:00Z Content type: release Language: en Sources: [clearbluejar]() Topics: [Ghidra](), [Reverse Engineering](), [MCP Server](), [Model Context Protocol](), [Large Language Model](), [Artificial Intelligence](), [Automation](), [agentic workflows]() Tags: [agentic](), [automated](), [engineering](), [ghidra](), [llm](), [mcp](), [mcp-server](), [reverse-engineering]() ### AI overview The article introduces pyghidra-mcp, a headless Model Context Protocol server for Ghidra. It is designed for automation and exposes an entire Ghidra project so an LLM can trace function calls across multiple interdependent binaries in one analysis session. ### Source excerpt Unlock project-wide, multi-binary analysis with pyghidra-mcp, a headless Ghidra MCP server for automated, LLM-assisted reverse engineering.