BO SHANG
Summary
Security & AI engineer with over a decade across offensive and defensive security — vulnerability assessment, penetration testing, incident response, and the engineering of production security tooling. Builds and operates the controls that protect networks, systems, and digital assets: continuous threat monitoring, security-log and threat-intelligence analysis, vulnerability management, and automated detection-and-response pipelines. Founder of ErosolarAI (朝阳智能); creator of Vigil, an AI-driven security agent spanning network, endpoint, cloud, and API defense. Also ships production full-stack AI products — the Anvilwing coding CLI, the Helia browser, and the Erosolar chatbot — and independent technical research (see GitHub).
Experience
- Founded an applied-AI studio shipping Anvilwing (terminal coding CLI), Helia (agentic browser), the Erosolar chatbot, and Provenika — most on DeepSeek models.
- Built Vigil, an AI-powered security agent pairing an LLM command-line agent with an offensive/defensive toolkit spanning network, endpoint, cloud, and API defense plus threat intelligence.
- Engineered continuous monitoring & detection pipelines — security-log analysis, Nmap/CVE correlation, CISA KEV threat-intel, secret scanning, SBOM generation.
- Implemented Model Context Protocol (MCP) tool servers exposing security capabilities to the LLM for automated investigation and response; designed a three-tier authorization model with scope/target verification and refusal detection.
- Architected platforms across ~200 TypeScript modules (React 19 SPA, AWS Lambda, Firebase, multi-stage Docker), with security documentation throughout.
- Independent security consultancy: penetration testing, vulnerability assessments, red-team exercises, code audits, and incident response under contract.
- Built a CVE Discovery Engine for zero-day research — grammar-aware coverage fuzzer, static pattern analyzer, differential binary analyzer, and an LLM novelty engine.
- Led incident response end to end — containment, forensics, root-cause analysis, remediation — supporting disaster-recovery and business-continuity goals.
- Built an Exploit-Chaining Engine (A*/beam-search attack graphs) to validate real risk and prioritize remediation; delivered clear technical reports and fixes.
- Delivered offensive and defensive engagements — penetration testing, vulnerability research, and custom tooling — for a range of clients.
- Reverse-engineered binaries with Ghidra and IDA Pro; developed proof-of-concept exploits and actionable remediation guidance.
- Early engineer at an AI/analytics startup applying machine learning to financial and economic data; built data-ingestion services and internal tooling.
- Delivered full-stack web applications across front-end, back-end, and database layers.
Technical Skills
Security Operations & Monitoring: SIEM & security-log analysis, Wazuh, threat-intel feeds (CISA KEV), Nmap/CVE correlation, ClamAV, secret scanning, SBOM generation
Offensive Security: Penetration testing, vulnerability assessment, Metasploit, Burp Suite, Ghidra, IDA Pro, Hashcat, John the Ripper, BloodHound, Kali Linux (70+ tools)
Incident Response & Governance: Containment & forensics, root-cause analysis, remediation, security audits, compliance support, risk mitigation
Cloud & Infrastructure: AWS (Lambda, API Gateway, EventBridge, S3, IAM, Secrets Manager), Firebase (Auth, Firestore, Functions, Hosting), Docker
Languages: TypeScript, JavaScript, Python, C/C++, x86/ARM Assembly
AI / LLM: LLM agent orchestration, Model Context Protocol (MCP), streaming tool-calling, prompt design
Selected Projects
- Claude-Code-class coding agent on DeepSeek v4 Pro with /loop, scheduled cloud runs, background agents, and web/iOS control of a live local session.
- ChatGPT-Atlas-style browser with a side-panel AI that has full page context and drives the page via the Chrome DevTools Protocol; signed & notarized macOS builds.
- LLM command-line agent + 70-tool offensive/defensive toolkit (Kali + Ghidra); CVE-discovery and exploit-chaining engines and MCP defense servers, for authorized testing.
- Datalink sidelobe-detection and emitter-geolocation simulation (TDOA/FDOA/DF) with aspect-dependent RCS models — built entirely from OSINT and first-principles physics; unclassified, public, ITAR/EAR-compliant methodology.
Education
Languages
English: Fluent — speaking and reading.
Mandarin Chinese: Understands spoken Mandarin and reads Pinyin; does not read Hanzi.
BO SHANG
个人摘要
拥有十余年攻防安全经验的安全与 AI 工程师，涵盖漏洞评估、渗透测试、事件响应，以及生产级安全工具的工程化开发。擅长构建并运营保护网络、系统与数字资产的安全控制：持续威胁监控、安全日志与威胁情报分析、漏洞管理，以及自动化检测与响应流水线。ErosolarAI（朝阳智能）创始人；AI 驱动安全代理 Vigil 的创建者，覆盖网络、终端、云与 API 防御。亦交付生产级全栈 AI 产品——Anvilwing 编码命令行、Helia 浏览器与 Erosolar 对话引擎——以及独立技术研究（详见 GitHub）。
工作经历
- 创立应用型 AI 工作室，发布 Anvilwing（终端编码命令行）、Helia（智能体浏览器）、Erosolar 对话引擎与 Provenika，多基于 DeepSeek 模型。
- 构建 Vigil：AI 驱动的安全代理，将 LLM 命令行代理与覆盖网络、终端、云、API 防御及威胁情报的攻防工具集结合。
- 设计并实现持续监控与检测流水线——安全日志分析、Nmap/CVE 关联、CISA KEV 威胁情报、密钥扫描、SBOM 生成。
- 实现 Model Context Protocol (MCP) 工具服务器，将安全能力开放给 LLM；设计三级授权模型，含范围/目标校验与拒绝检测。
- 在约 200 个 TypeScript 模块上完成平台架构（React 19 单页应用、AWS Lambda、Firebase、多阶段 Docker），全程维护安全文档。
- 运营独立安全咨询机构，按合同提供渗透测试、漏洞评估、红队演练、代码审计与事件响应。
- 构建用于零日发现的 CVE 发现引擎——语法感知覆盖率模糊测试器、静态模式分析器、差分二进制分析器与 LLM 新颖性引擎。
- 端到端主导事件响应——遏制、取证、根因分析与修复——支撑灾难恢复与业务连续性目标。
- 构建漏洞利用链引擎（A*/集束搜索攻击图）以验证真实风险并对修复进行优先级排序；交付清晰技术报告与修复建议。
- 为多家客户交付攻防安全项目——渗透测试、漏洞研究与定制工具。
- 使用 Ghidra 与 IDA Pro 进行二进制逆向；开发 PoC 漏洞利用与可执行的修复建议。
- AI / 分析创业公司早期工程师，将机器学习应用于金融与经济数据；构建数据摄取服务与内部工具。
- 为客户交付涵盖前端、后端与数据库层的全栈 Web 应用。
技术技能
安全运营与监控：SIEM 与安全日志分析、Wazuh、威胁情报源（CISA KEV）、Nmap/CVE 关联、ClamAV、密钥扫描、SBOM 生成
攻击性安全：渗透测试、漏洞评估、Metasploit、Burp Suite、Ghidra、IDA Pro、Hashcat、John the Ripper、BloodHound、Kali Linux（70+ 工具）
事件响应与治理：遏制与取证、根因分析、修复、安全审计、合规支持、风险缓解
云与基础设施：AWS（Lambda、API Gateway、EventBridge、S3、IAM、Secrets Manager）、Firebase、Docker
编程语言：TypeScript、JavaScript、Python、C/C++、x86/ARM 汇编
AI / LLM：LLM 代理编排、Model Context Protocol (MCP)、流式工具调用、提示词设计
精选项目
- 基于 DeepSeek v4 Pro 的 Claude-Code 级编码代理，支持 /loop、云端定时运行、后台代理，并可经网页/iOS 操控本机实时会话。
- 仿 ChatGPT Atlas 的浏览器，侧栏 AI 通晓整页上下文并经 Chrome DevTools Protocol 操控页面；macOS 版本已签名并经 Apple 公证。
- LLM 命令行代理 + 70 种攻防工具集（Kali + Ghidra）；含 CVE 发现与漏洞利用链引擎及 MCP 防御服务器，用于合规授权测试。
- 数据链旁瓣探测与辐射源定位仿真（TDOA/FDOA/测向）及随视角变化的 RCS 模型——完全基于公开情报与第一性原理物理；非密、公开、符合 ITAR/EAR 方法论。
教育背景
语言能力
英语：流利（口语与阅读）。
普通话：能听懂口语、能阅读拼音；不能阅读中文汉字。