Independent security research lab

Hunt what lurks in the depths.

Byteshark is an independent security research lab. It builds autonomous tooling for offensive and defensive work, keeps a human on every call that matters, and publishes the research in the open.

$
Focus areas

Where the lab works.

Tooling gets built where the work is repetitive enough to automate. Write-ups go out when something turns up that is worth publishing, not on a schedule.

Adversary emulation

Mako: an autonomous agent pointed at an authorized target and left to find its own way in. The harness logs every step it takes.

About Mako →

Malware reverse engineering

Loaders, stealers, and droppers, unpacked until the logic is clear.

Threat intelligence

Campaigns, infrastructure, and the actors behind them, traced from the evidence.

Hardware hacking

Devices opened up, probed, and documented, from firmware down to the bus.

Latest research

From the lab.

3 write-ups · Feb 2026 – Oct 2026

Tools Making Mako 1 min read

Meet: Mako

All research →
CLOSED BETA

Meet Mako.

Mako emulates the attacker that is now cheap to run: an AI agent pointed at a target and left unsupervised. It enumerates, exploits, pivots, and escalates on its own against external networks, Active Directory, and web applications, and logs every command. A person reads the log, checks the claims, and signs the report. Closed beta. The build log is on the Research page.

How the lab works

Build the tool. Run it. Publish the receipts.

Most security work is volume. Byteshark builds harnesses to carry it and keeps the judgment calls with a person.

The tool.

A harness built for one job, in the lab, against lab targets, until it does the job reliably.

The run.

Against an authorized target or a fresh sample. Each claim the model makes is checked by hand before it goes into a report.

The write-up.

What it found, how, and what stayed uncertain.

Independent by design

The research is not shaped by the product.

Byteshark sells its own tooling, and says so. The research follows the question rather than the roadmap: a write-up is free to say a technique is unremarkable, a sample is boring, or a run cost more than it was worth. That record is what lets a reader judge the work.

More about the lab →

Independent.

The lab chooses its own questions and answers to no vendor.

Evidence first.

Findings come with the evidence so readers can check them.

Consent first.

Byteshark only works on systems and organizations that have authorized it in writing.

Plain language.

Hard topics explained clearly, with no fear tactics.

Nothing hides in open water forever.

New write-ups, straight to your inbox. No noise.

Have something worth taking apart? Work with Byteshark.  ·  Apply for the Mako beta.