Free Wortley

Staff Security Engineer · Builder · YC Founder

free@qaz: ~

free

YC Founder (LunaSec, S19), ex-Scale AI, ex-Figma, ex-Uber, ex-Snapchat.

Best known for coining the term "Log4Shell" for the Log4j vulnerability.

Pushing the limits of AI and currently building the tools to decrease the security risks they pose.

Featured work

All projects
dream-serpent's DNS gate enforcing default-deny egress: an allowlisted API domain resolves, an unlisted exfiltration hostname is refused, and a public DoH resolver is blocked with policy attribution in the DNS response

dream-serpent — sandboxed agent platform

Active

A secure sandboxing platform for autonomous coding agents — per-session KVM VMs with default-deny networking and credential-swap egress — built in five and a half weeks almost entirely by the agents it is designed to contain.

Agent infrastructureJun 2026 – PresentKVM · sandboxing · Rust
A Rock Band 3 venue crowd rendered by the shared WebGPU engine running the decompiled game natively on x86_64

Milo engine — native + WebGPU port

Active

Extracted a shared C++17/WebGPU runtime from one decompiled game and re-linked it into a second from a different console, so reverse-engineered code runs natively on x86_64 and in a browser.

Engine portsMay 2026 – PresentC++17 · WebGPU · WebAssembly
objdiff terminal UI diffing a retail function against its clean-room reconstruction at 99.8%: anonymous fn_ addresses on the left, recovered C++ names on the right

Rock Band 3 (Xbox 360) — 18,689 functions matched

Active

Byte-exact decompilation of a symbol-less Xbox 360 binary: 18,689 functions matched in eight weeks by orchestrating fleets of Claude Code agents.

Matched code (fuzzy, game + engine target scope)62.7%
DecompilationMay 2026 – PresentXbox 360 · agent orchestration · reverse engineering

Latest writing

All posts
July 19, 202610 min readFeatured

How agent swarms decompile games byte-for-byte

Seven months teaching fleets of coding agents to reconstruct a shipped game binary byte-for-byte — and building the oracles that keep them honest.

decompilationAI agentsreverse engineering
July 15, 20269 min read

LLM-assisted decompilation: tools, not prompts

How fleets of coding agents byte-matched 18,000+ functions of a stripped Xbox 360 binary in eight weeks — by never letting the model judge its own work.

decompilationAI agentsprogram synthesis
July 12, 20269 min read

The Milo engine decompilation saga

How one engineer and a fleet of AI agents reverse-engineered a shared game engine across three games and two consoles — and discovered that a perfect match score can still be wrong.

decompilationgame enginesreverse engineering
Free Wortley — Staff Security Engineer · Builder · YC Founder