Harry Alesso@alessoh
2
Events attended
2
Submissions made
United States
20+ years of experience
About me
I grew up with a talent for numbers, leading me to MIT. I have an M.S. and an advanced Engineering Degree from M.I.T. I was a nuclear physicist at Lawrence Livermore National Laboratory for twenty-one years. I am currently an AI software developer and technology author with extensive experience. I have published several software titles, numerous scientific journal and conference articles, and numerous books.
🤓 Latest Submissions
ZeroDay: Autonomous CVE Patch Agent
ZeroDay is an autonomous AI agent that closes the gap between CVE detection and CVE remediation. A critical vulnerability drops. Every scanner in the organization flags it. Then someone still has to read the code, decide if the vulnerability is actually exploitable in this codebase, write the fix, test it, and ship the pull request. ZeroDay does all of that work autonomously in approximately 42 seconds. The user provides two inputs: a GitHub repository URL and a CVE identifier. The agent runs a six-stage pipeline. Stage one fetches the advisory from the National Vulnerability Database and normalizes affected packages and version ranges. Stage two scans the repository across nine languages (Python, JavaScript, TypeScript, Go, Ruby, Java, Rust, PHP, C#) and identifies vulnerable dependencies and the source files that import them. Stage three is the differentiator: a hybrid syntactic plus language-model analyzer decides whether the vulnerable function is actually reachable in this codebase, distinguishing a dependency that sits on disk from one that gets called at runtime. Stage four generates the patch as a unified diff, with the strategy decision (version-bump versus code-fix) made automatically and alternatives documented. Stage five predicts test outcomes by reasoning about the patch against the existing test files. Stage six writes the pull request: a Conventional Commits title, a Markdown description with vulnerability details and patch strategy, a stakeholder summary for non-engineers, a rollback plan, and a merge checklist. The output is a copy-ready artifact a developer can paste straight into GitHub. The frontend streams stage progress to the user in real time via Server-Sent Events. Every claim ZeroDay makes is sourced and explainable. The hackathon scope is documented honestly against the production roadmap inside the codebase, because security buyers do not trust pitches that oversell. Built solo in 48 hours. Deployed live and working.
19 May 2026
AutoResearch Strategic Stock Orchestration
AutoResearch Strategic Stock Orchestration is a self-improving multi-agent trading system inspired by Andrej Karpathy's nanochat methodology. Three trading strategies (momentum, mean-reversion, buy-and-hold) compete for capital from a meta-allocator. An overnight AutoResearch loop sends the source code to the Claude API and asks for one targeted improvement per iteration as a unified diff. The loop applies the diff, runs a backtest on held-out validation data, and keeps the change only if validation Sharpe improves by at least 0.02. Otherwise it rolls back with git reset. Every experiment is logged to JSON; every accepted change becomes a git commit with a structured message. Across 105 unattended iterations on Lightning AI, the agent produced five accepted improvements that compounded validation Sharpe from a 1.0911 equal-weight baseline to 3.6260. The agent rediscovered classical quantitative techniques from first principles by reading source code alone: inverse-volatility weighting, momentum-of-strategies allocation, EWMA-based scoring, regime-conditional weights, and a shorter momentum lookback. Held-out final-test Sharpe came in at 6.5319, which we discuss honestly as a combination of generalization, sample-window luck, and adaptive-allocator effects. The full audit trail (every proposed diff, kept or rejected) is committed to git and visualized in a Vercel-deployed Next.js dashboard. The system demonstrates a methodology rather than claiming alpha: small codebase (1,145 lines total), measurable metric (validation Sharpe), and self-improvement driven by readable git diffs that any reviewer can inspect.
19 May 2026
