Geoffrey Diederichs is a member of the Offensive Security team at Escape, an ethical hacker specializing in web application and API security. His work sits at the intersection of hands-on OffSec, vulnerability research, and AI.
Escape's research team found two stacked flaws that led to an auth bypass enabling any member to delete all members' likes on comments. It's now CVE-2026-103288, found only by testing as multiple low-auth users to see what they could do with data they shouldn't have access to.
Offensive Security
Weeks apart, at two unrelated companies, Escape's AI pentesting agent found the same stored XSS. Both had shipped a customer-facing chat where the model emits Markdown and the frontend renders it with raw HTML enabled and no sanitizer, so anything the model can be made to say executes in the browser of whoever reads the transcript next. Ask your own frontend team how many places in your product render Markdown that a model produced, and the honest answer is usually a number followed by "probabl
