Recon 2026

John McIntosh

John McIntosh (@clearbluejar) is a security researcher at ClearSecLabs specializing in reverse engineering and offensive security. His expertise spans binary analysis, patch diffing, and vulnerability discovery, with multiple open-source security tools for vulnerability research available on his GitHub. His website, https://clearbluejar.github.io/, features detailed write-ups on reversing recent CVEs and building RE tooling with Ghidra.

John has delivered advanced reverse engineering and vulnerability discovery talks at leading international security conferences worldwide, including Black Hat, REcon, Insomnihack, Ringzer0, SecTor, 44CON, and DEF CON. His sessions emphasize systematic, reproducible workflows and hands-on, AI-augmented analysis, consistently recognized for clarity and technical depth. A distinguished presenter and educator, John maintains a fervent commitment to sharing cutting-edge research, advancing binary analysis, and fostering collaboration within the global security community.


Sessions

06-19
18:30
60min
The AI Reversing Panel: Are we all powerful, or out of a job?
John McIntosh, Aaron Portnoy, Marion Marschalek, Gadi Evron

It’s not every day we convene a panel at Recon.
AI affects us all, but where can we go beyond buzzwords and make it concrete?
- What actually works, how we set up our own harnesses, what constantly fails, and what works today that didn’t even a month ago? Are there limits?
- How the technology affects us daily, from attackers to defenders? We see software development sped up to the max, models finding vulnerabilities autonomously, malware being dissected by AI, and written even faster.
- Topics such as disclosure, when vulnerability in code == public, and if coordinated disclosure can survive it. Is full disclosure back?
- And lastly… are we still going to have a job in a year or two? Will there still be a need for researchers? Let’s be specific.
We will welcome surprise guests to the panel, as we cycle through topics. The topics themselves are discussion seeds only.

Grand Salon Opera
06-20
13:00
180min
Agentic Reverse Engineering: Building Custom AI "Skills" with Coding Agents
John McIntosh

Agent Skills are now an open format and the latest evolution in agentic workflows, enabling coding agents to execute multi‑step reverse‑engineering tasks with high accuracy and minimal prompting. This workshop teaches participants to design, build, and iterate custom Skills using coding agents such as Claude Code, OpenCode, and Mistral Vibe. Through guided exercises, attendees will build a multi‑platform driver‑analysis Skill that automates IOCTL mapping, platform‑specific dispatch analysis, code‑flow analysis, and workflow capture across Windows, macOS, and Linux. The workshop blends conceptual foundations with extensive hands‑on practice, ensuring participants leave with both the understanding and practical experience needed to implement agentic RE Skills in their own workflows.

Soprano B