# Tarun Koyalwar

Making agents better at hacking.

AI researcher @ ProjectDiscovery. Benchmarks, evals, and observability that show what language models actually do on offensive-security tasks.

## now

Right now: benchmarking and experimenting with OSS models, all things agents and models, at ProjectDiscovery.

First talk that will be recorded: [BSides Las Vegas 2026](/talks.md#bsides-las-vegas-2026), this August.

## writing

- [Learning is a Passive Skill](/writing/learning-is-a-passive-skill.md) `jul 2026`
  Active skills have a cooldown, passive skills don't. Reading and memorizing are active. Learning is the passive, and nobody can sell you the passive.
- [Oh My Rogue Agent](https://projectdiscovery.io/blog/oh-my-rogue-agent) `projectdiscovery blog · jul 2026`
  Agents solving benchmarks take unintended paths, reaching for internal services, mounted secrets, and network pivots. Four case studies of sandbox escapes caught while benchmarking, and the argument that rogue behavior is expected, not unprecedented, and something to design for.
- [Benchmarking Neo's Black-Box DAST Capabilities](https://projectdiscovery.io/blog/neo-black-box-dast-capabilities) `projectdiscovery blog · apr 2026`
  Neo scores 51/60 (85%) on Argus under a hardened black-box methodology, benchmarking autonomous AI-driven vulnerability discovery.
- [Introducing the httpx dashboard](https://projectdiscovery.io/blog/introducing-httpx-dashboard-2) `projectdiscovery blog · aug 2024`
  A hosted view over httpx scan output, built on the PDCP dashboard.

## talks

- **[Watching Agents Work: A Behavioral Audit of 189 Offensive-Security LLM Runs](/talks.md#bsides-las-vegas-2026)** · BSides Las Vegas · Ground Truth `aug 2026 · will be recorded`
- **[From Mapping to Mitigation](/talks.md#from-mapping-to-mitigation)** · Black Hat Asia Arsenal `apr 2025`
  with Dogan Can Bakir
- **[Vulnerability Scanning and Enumeration with Nuclei: Deep Dive](/talks.md#vulnerability-scanning-and-enumeration-with-nuclei-deep-dive)** · BSides Ahmedabad `oct 2024`
  with Dhiyaneshwaran Balasubramaniam
- **[Unveiling Vulnerabilities: A Comprehensive Guide to Bug Bounty Recon](/talks.md#unveiling-vulnerabilities-a-comprehensive-guide-to-bug-bounty-recon)** · DEF CON 32 · Bug Bounty Village `aug 2024`
  with Prince Chaddha, Dhiyaneshwaran Balasubramaniam
  - [slides](https://docs.google.com/presentation/d/1gaBwSdjiA4Vj38GKxMS8Eoz2KgxwVfx6ae0iuCSN1rs/pub)
  - [repo](https://github.com/projectdiscovery/defcon32)

## selected work

- [Neo: evals & benchmarking](https://projectdiscovery.io/blog/neo-black-box-dast-capabilities) · ProjectDiscovery's offensive-security AI agent, and the open question of whether an autonomous agent can actually hack. Builds the harness that measures it: evals at scale, benchmarking, and the trace observability that shows what the agent actually did on a target. `neo · evals · benchmarking · observability`
- [Nuclei](https://github.com/projectdiscovery/nuclei) · The vulnerability scanner much of offensive security runs on. Core team through the v3 era, now on Neo. `go · ~29k★ · core team, v3 era`
- [Alterx](https://github.com/projectdiscovery/alterx) · Subdomain permutation generator driven by patterns instead of a static wordlist: define the patterns, get candidate hostnames to enumerate before a scan. `go · ~940★ · author`
- [Talosplus](https://github.com/tarunKoyalwar/talosplus) · Recon-automation framework in Go: plain bash scripts become a managed parallel execution graph. One of the two tools that landed the ProjectDiscovery job. `go · ~92★`

## say hi

In Pune now, Las Vegas next month. X is the fastest line, faster than email. Always up for talking AI, agents, or travel.

[say hi on X](https://x.com/KoyalwarTarun)

---

tarun@no-ide.dev · [github](https://github.com/tarunKoyalwar) · [x](https://x.com/KoyalwarTarun) · [linkedin](https://www.linkedin.com/in/tarun-koyalwar) · [medium](https://medium.com/@zealousme)

agents start at [/agents.md](/agents.md)