Aonan Guan
Head of Security at Wyze Labs
I lead security for cloud systems, AI, and connected devices. My independent research focuses on AI assistants, MCP, and the infrastructure they use.
My research exposed credential-theft risks in Anthropic Claude, Google Gemini, and Microsoft Copilot. It now informs OpenSSF security guidance and independent defenses. Our Comment and Control paper was accepted at ACM CCS 2026.
Media Coverage
“has hunted down bugs in pretty much every AI system out there”
Jessica Lyons on Aonan Guan · The Register, May 2026
Comment and Control · Anthropic Claude, Google Gemini, Microsoft Copilot
The Register interviewed me about our findings across three AI assistants. SecurityWeek and VentureBeat also reported the research.
The Register interview · SecurityWeek · VentureBeat
Microsoft NLWeb · Security in Microsoft’s next-generation Web initiative
The Verge interviewed me about the vulnerability and reported Microsoft’s correction. PCWorld and ITPro covered the finding.
The Verge interview · PCWorld · ITPro
Claude Code · Repeated network sandbox failures
The Register interviewed me about a second network-isolation bypass; SecurityWeek and Cybernews also reported the finding and Anthropic’s response.
The Register interview · SecurityWeek · Cybernews
More coverage and international reporting
Anthropic Claude Code Network Sandbox Bypass - Interviewed by The Register and covered by Cybernews, SecurityWeek, Cyber Security News, ComputerBase, iThome, and innovaTopia (May 2026)
Comment and Control — Cross-Vendor Agent Hijacking (Anthropic Claude Code, Google Gemini CLI, GitHub Copilot Agent) - Featured in VentureBeat, The Register, SecurityWeek, The Next Web, Xataka, Cybernews, Security Boulevard, Techzine, Digital Today Korea, 3DNews Russia, and SANS ISC Stormcast — with coverage in 16 countries and 13 languages (April 2026)
Anthropic MCP Git Server Vulnerabilities (CVE-2025-68143) - Featured in The Hacker News, Dark Reading, Infosecurity Magazine, CSO Online, InfoWorld, SiliconANGLE, and Techzine (January 2026)
Microsoft Azure NLWeb Vulnerability - The Verge exclusive interview. Subsequently featured in 30+ international outlets including PCWorld, IT Pro, Neowin, Tom’s Guide, CIO Korea, 3DNews Russia, iSpazio Italy, Dagens AI Denmark — with coverage in 10+ languages across North America, Europe, Asia, and South America (August 2025)
Research
Comment and Control — ACM CCS 2026
We showed how ordinary GitHub comments could make AI assistants expose credentials or take unauthorized actions. Our research with Johns Hopkins University connected findings in Anthropic Claude, Google Gemini, and Microsoft Copilot with a method for testing these failures across automated workflows.
Accepted at ACM CCS 2026.
Paper · Technical write-up · Official accepted-papers list
Follow-up use
- OpenSSF incorporated the research into its published AI security guidance.
- Repello included all three disclosed attack patterns in its ARTEMIS security test suite.
- Praetorian released protection linked to the research for its AI-assisted software-review workflow.
- University of Maryland selected the paper as reading for its Fall 2026 graduate course on AI security and privacy.
Professional Service
- OWASP Agentic Skills Top 10 — Project co-lead in the V1 whitepaper, documenting security risks and mitigations for AI agent skills. Project · V1 whitepaper
- KubeCon + CloudNativeCon — Program committee and proposal reviewer for the joint 2026 event with OpenInfra Summit and PyTorch Conference. Reviewer credential
- AGNTCon + MCPCon North America — Program committee, 2026. Official committee
Whitepapers and technical review
- CNCF, Software Supply Chain Best Practices v2, Reviewer (2024)
Referenced by NIST SP 800-218 - Secure Software Development Framework - Cloud Security Alliance, Managing Privileged Access in The Cloud-First World, Reviewer (2025)
- Cloud Security Alliance, Secure Agentic System Design, Reviewer (2025)
- CNCF Security TAG, Cloud Native AI Security Whitepaper, Author (2025 draft)
Talks & Presentations
Not My Vibe: When AI Coding Agents Go Off the Rails
A talk with Zhengyu Liu on command execution, filesystem boundaries, and sandbox failures in AI coding assistants, with demonstrations and deployment lessons.
Black Hat 2026 — Remote Server, Local Root. Welcome to MCP.
Research contributor to the MCP security briefing. Official program · Details
Auburn University at Montgomery — Invited guest lecture
Security Risks in Modern AI Systems: Lessons from the Real World. University report · Details
Amazon Developer University — SP-API Guard webinar · 2023
Security auditing for applications connecting to Amazon’s marketplace. Watch recording · Details
All talks and invited briefings →
Blog
Enterprise MCP Gateway Security in Practice with Agentgateway · AAIF, August 2026
My article for the Agentic AI Foundation on protocol translation, complete request inspection, and session authorization.
Your Session, My Policy: An MCP Gateway Authorization Bypass · July 2026
Second Time, Same Sandbox: Another Claude Code Network Bypass · May 2026
Comment and Control: Credential Theft in Three AI Assistants · April 2026
Earlier writing
CVE-2025-66479: Anthropic’s Silent Fix and the CVE That Claude Code Never Got (2025)
Three Dots to Root: How I Found a Path Traversal in Microsoft’s Agentic Web (NLWeb) (2025)
Rotate Your SP-API Credentials Using AWS (May 17, 2023)
Using Amazon Selling Partner API Guard for Security Audits to Make Your SP-API Applications More Compliant (Dec 6, 2022)
Notable Vulnerabilities
- Path Traversal in Anthropic MCP Git Server - CVE-2026-27735 • Capability Laundering
- Credential Exfiltration in Anthropic MCP Git Server - CVE-2025-68143 • Capability Laundering
- Sandbox Bypass in Anthropic Claude Code - CVE-2025-66479 • Network Isolation Bypass
- Command Injection in Google Gemini CLI - 4 Bypass Techniques • Google Cloud VRP, Bounty Confirmed
- Current Working Directory Bypass in Google Gemini CLI - Path Restriction Bypass • Google Cloud VRP
- Path Traversal in Microsoft Azure NLWeb - Featured by The Verge
- DoS in Next.js - CVE-2024-39693 • CVSS 8.7
- Terminal Hijacking in Anthropic MCP Memory Server - Security Fix PR • Capability Laundering
- RCE in Microsoft OmniParser - CVE-2025-55322
- Weak Crypto in NSA Emissary Project - CVE-2025-27508 • CVSS 7.5
Vulnerability research and technical write-ups →
Experience
Wyze Labs - Head of Security
Leading cloud and AI security across 200+ AWS accounts, 20+ GCP projects, securing AI products like AI Video Search and Descriptive Alerts.
Amazon - Security Solutions Architect (2020 - 2023)
Drove security compliance for 90 ISVs, launched SP-API Guard, mentored engineers, built serverless security solutions.
Cisco Webex - Software Engineer (2020)
Infrastructure provisioning and GitOps for K8s clusters, managed 100K+ VMs across cloud providers.