BERNHARD MUELLER

I have been breaking software since the early 2000s. At SEC Consult in Vienna I found and exploited vulnerabilities in enterprise software, network appliances and phones; the Symbian research won the 2009 Pwnie Award for Most Innovative Research. In Singapore I started the OWASP Mobile Application Security Testing Guide and the Mobile Application Security Verification Standard. I wrote Mythril, a symbolic-execution security analyser for Ethereum smart contracts, and later built AI agents that audit code.

Since 2021 I have been working on repair networks: local parts that compare what they share and repair disagreement until the whole settles. The same idea drives my physics research, Observer Patch Holography, and Cadence, a brain that learns from live experience. Pragma Research is the independent lab for this work.

RESEARCH

1. 2021–

   Repair networks

   Preprint: Agreement and Surprise

   Local repair between networked parts, the global equilibrium it settles into and the limits of that equilibrium.

   paper
2. 2021–

   Physics

   Preprint: Observer Patch Holography

   Physics reconstructed from the records that finite observers can share, with machine-checked Lean proofs and an executable observer model.

   particlespapercode
3. 2021–

   AI

   Preprint: Cadence

   A brain that learns from live experience by settling local disagreement into one coherent state.

   demospapercode

EXPERIENCE

1. 2021–

   Pragma Research

   Founder

   Independent research on repair networks, physics and AI, published as preprints, machine-checked Lean proofs and open-source code.

2. 2025–

   Sherlock

   AI Research Lead

   Research lead for Sherlock AI, an AI auditor for smart contracts. Hound and ScaBench started as my own projects; I co-founded the scabench-org organisation and moved both there.

3. 2025–

   Independent security researcher

   Cantina

   Web3 security audits and audit competitions.

   profile
4. 2017–2020

   ConsenSys Diligence

   Code auditor and software engineer

   Smart-contract audits and security tooling. I started Mythril as my own project in 2017, transferred it to ConsenSys when they hired me and developed it there until 2020.

5. 2014–2017

   Vantage Point Security, Singapore

   Principal Security Consultant

   Mobile application security, reverse engineering and penetration testing. Initiated the OWASP MASTG and MASVS in 2016 and led both projects through their first year.

6. 2005–2013

   SEC Consult, Vienna

   Vulnerability Lab

   Vulnerability research and penetration testing across browsers, databases, VPN clients, enterprise management software and smartphones.

RECOGNITION

1. 2025

   Cantina circuit-puzzles competition

   Second of 25.

2. 2019

   OWASP Flagship project

   The Mobile Security Testing Guide, now the Mobile Application Security Testing Guide.

3. 2018

   Pwnie Award nomination, Most Innovative Research

   For Smashing Ethereum Smart Contracts for Fun and ACTUAL Profit.

4. 2009

   Pwnie Award, Most Innovative Research

   For From 0 to 0Day on Symbian.

   pwnies

PAPERS

1. 2026

   Agreement and Surprise

   Preprint, PhilPapers. Repair networks paper
2. 2026

   Observer Patch Holography

   Preprint, PhilPapers. Physics paper
3. 2026

   Cadence

   Preprint, PhilPapers. AI paper
4. 2025

   Hound: Relation-First Knowledge Graphs for Complex-System Reasoning in Security Audits

   arXiv

   A language-agnostic code auditor whose agents build and refine knowledge graphs of the system under audit.

   papercode
5. 2018

   Smashing Ethereum Smart Contracts for Fun and ACTUAL Profit

   HITB SecConf Amsterdam

   Symbolic execution of EVM bytecode with the LASER engine and the vulnerability detection modules of Mythril.

   papercode
6. 2016

   Hacking Soft Tokens: Advanced Reverse Engineering on Android

   HITB GSEC Singapore

   Extracting OTP algorithms and stored secrets from software tokens, using static and dynamic analysis, custom kernel sandboxes and full-system emulation.

   paper
7. 2009

   From 0 to 0Day on Symbian

   SEC Consult whitepaper

   Finding and exploiting low-level vulnerabilities on Symbian smartphones, including Nokia multimedia codecs reachable through MMS.

   papermirror
8. 2008

   Improved DNS Spoofing Using Node Re-Delegation

   SEC Consult whitepaper

   Making DNS cache poisoning more reliable by spoofing delegations for a single node.

   paperdisclosure

TALKS

1. 2020

   Metatrack: Detecting DeFi Bugs and Arbitrage with Symbolic Execution

   Paralelní Polis, Prague video
2. 2020

   Preventing Disaster: Advances in Smart Contract Vulnerability Detection

   EthCC 3, Paris video
3. 2019

   Smashing Smart Contracts

   IT-SECX, St. Pölten slidesvideo
4. 2019

   Preventing Disaster: Advances in Smart Contract Vulnerability Detection

   Devcon 5, Osaka. With Daniel Luca video
5. 2019

   Breaking Smart Contracts

   Devcon 5, Osaka. Workshop with Shayan Eskandari and others video
6. 2019

   The Ether Wars: Exploits, Counter-Exploits and Honeypots on Ethereum

   DEF CON 27, Las Vegas. With Daniel Luca videoslidesdemoscode
7. 2019

   Advances in Automated Smart Contract Vulnerability Detection

   ETHBerlin Zwei, Berlin video
8. 2018

   Hashing It Out #21: Mythril

   The Bitcoin Podcast listen
9. 2018

   Smashing Ethereum Smart Contracts for Fun and ACTUAL Profit

   HITB SecConf, Amsterdam videoslides
10. 2017

    Fixing Mobile AppSec: The OWASP Mobile Project

    OWASP AppSec EU. With Sven Schleier video
11. 2016

    Attacking Software Tokens

    HITB GSEC, Singapore videoevent

STANDARDS AND BOOKS

1. 2016–

   OWASP Mobile Application Security Testing Guide (MASTG)

   Initiated in 2016 and led through its first year. Co-authors include Sven Schleier, Jeroen Willemsen and Carlos Holguera

   The OWASP manual for mobile application security testing and reverse engineering, including the reverse engineering and tampering chapters.

   guidesourcebook
2. 2016–

   OWASP Mobile Application Security Verification Standard (MASVS)

   Initiated in 2016. Author of releases 0.9 to 0.9.4

   Security requirements for mobile applications, used by developers, testers and certification schemes.

   standardsource

SOFTWARE

1. 2026

   Cadence

   A Python library for a brain that learns a world from live experience, acts in it and repairs what fails.

   live demoscodedemo code
2. 2025–

   Observer Patch Holography

   Papers, Lean proofs and executable models for the physics research.

   particlescode
3. 2025

   Hound

   An AI code auditor that builds relation-first knowledge graphs while it investigates.

   code
4. 2025

   ScaBench

   A benchmark for AI audit agents built from recent real-world vulnerabilities.

   code
5. 2025

   STARK Lab

   Interactive lessons on STARK proofs, from execution traces and constraints to FRI.

   opencode
6. 2025

   Awesome ZK Proofs, Awesome AI Security

   Reading paths through zero-knowledge proof systems and through AI security.

   zkai security
7. 2024

   Legion

   An assistant for web3 bug hunting that tracks bounties and sends agents into the code.

   code
8. 2023

   MiniAGI, Darwin GPT

   A minimal general-purpose agent on the OpenAI API, and an agent that spawns copies of itself.

   mini-agidarwin-gpt
9. 2021

   Rage of the Machine, Mancala Deep-Q

   A multi-instrument music transformer trained on 3,604 metal, grunge and punk MIDI songs, and deep Q-learning for Mancala.

   storymancala
10. 2020–2022

    SolFuzz, DeFi Hacking Playground, Rektosaurus

    Grey-box fuzzing with symbolic analysis for Solidity, a local environment for flash-loan attacks, and tests for script injection through NFT metadata.

    solfuzzplaygroundrektosaurus
11. 2018

    Scrooge McEtherface

    An Ethereum auto-looter that finds and exploits vulnerable contracts with symbolic execution and Z3.

    code
12. 2017

    Mythril

    Security analysis for EVM bytecode with symbolic execution, SMT solving and taint analysis. I created it in 2017 and developed it at ConsenSys until 2020.

    code
13. 2016–2017

    Mobile reversing tools

    Frida detection methods, apkx for one-step APK decompilation, the Android App Security Checklist, obfuscation metrics and the UnCrackable mobile crackmes.

    frida-detectionapkxchecklistmetricscrackmes

ADVISORIES

Early advisories credit my handle, sk0L.

1. 2015-08

   Cisco Unified Communications Manager: command injection, file inclusion, session-ID bypass

   exploit-dbdisclosure
2. 2014-12

   SysAid Server: arbitrary file disclosure and LDAP credential theft

   exploit-dbdisclosure
3. 2013-07

   Sybase EAServer: directory traversal, XML entity injection, OS command execution. With Gerhard Wagner

   advisory
4. 2012-12

   IBM System Director Agent: remote DLL injection, Metasploit module. With Juan Vazquez and Kingcope

5. 2012-11

   Applicure dotDefender WAF: format string

6. 2012-10

   ModSecurity: multipart parsing rule bypass

   advisorydisclosure
7. 2009-07

   Symbian S60 and Nokia firmware: media codec memory corruption through MMS

   advisory
8. 2009-05

   Nortel Contact Center Manager: authentication bypass

   advisory
9. 2009-03

   IBM Director CIM Server: remote denial of service and local privilege escalation

   dosprivesc
10. 2008-12

    Microsoft SQL Server: sp_replwritetovarbin memory overwrite (CVE-2008-5416, MS09-004)

    advisoryms09-004cert/cc
11. 2007-10

    Perdition IMAP Proxy: pre-authentication format string (CVE-2007-5740)

    advisory
12. 2007-03

    MySQL: information_schema null-pointer denial of service. With S. Streichbier

13. 2006-10

    PHP exec, system and popen: file descriptor leak, proof of concept overwriting the Apache log

14. 2005-11

    Macromedia Flash Player: ActionDefineFunction memory corruption

    advisory
15. 2005-11

    toendaCMS: credential and session theft, directory traversal, arbitrary file upload

16. 2005-06

    Internet Explorer 6: javaprxy.dll COM object heap corruption (CVE-2005-2087, MS05-037). With Martin Eiszner

    advisorycert/cc
17. 2005-06

    phpCMS 1.2: arbitrary file inclusion

    advisory
18. 2005-06

    Exhibit Engine: blind SQL injection

    advisory

WRITING

1. 2026-09

   Why Cadence artificial brains must sleep and dream

2. 2026-09

   You don't need attention after all: the road to embodied AGI with Cadence

3. 2026-09

   Thinking Is All There Is

4. 2026-01

   A Practical Guide to Finding Soundness Bugs in ZK Circuits

5. 2025-12

   STARK Lab: An Interactive Deep Dive into Zero-Knowledge Proofs

6. 2025-11

   The Security Researcher's Guide to Mathematics

7. 2025-09

   Hunting for Security Bugs with AI Agents: A Full Walkthrough

8. 2025-08

   Unleashing the Hound: How AI Agents Find Deep Logic Bugs in Any Codebase

9. 2024-04

   Reverse Engineering Inferno Drainer

10. 2024-04

    A Brief Analysis of Angel Drainer

11. 2022

    Wolf Game: Herdsman's Report

12. 2022

    Building a Secure NFT Gaming Experience: A Herdsman's Diary

13. 2021

    Is Tether a Black Swan?

14. 2021

    Rage of the Machine: An AI Makes Metal Music

15. 2020

    I Asked GPT-3 for the Question to "42"

16. 2019

    Automated Smart Contract Looting with SMT Solvers

17. 2019

    Catching Weird Security Bugs in Solidity Smart Contracts with Invariant Checks

18. 2019

    Advanced Smart Contract Security Verification in Remix

19. 2019

    Ethereum Security Tools Built by ConsenSys Diligence

20. 2018

    Practical Smart Contract Security Analysis and Exploitation, Part 1

21. 2018

    Detecting batchOverflow and Similar Flaws in Ethereum Smart Contracts

22. 2017

    Analyzing Ethereum Smart Contracts for Vulnerabilities

23. 2017

    What Caused the Latest $100 Million Ethereum Bug

24. 2017

    Introducing Mythril: A Framework for Bug Hunting on the Ethereum Blockchain

25. 2017

    To Fork or Not to Fork? Results of a Bitcoin and Ethereum Community Survey

26. 2017

    The Definitive Guide to Becoming a Crypto Maximalist

27. 2017

    How to Become a Cryptocurrency Thought Leader on Twitter