The name arrived before the product. In March 2024, Mufeed VH watched a demo of Devin, Cognition's coding agent, and started playing with the word “developer.” An Indian counterpart, he joked online, might be called Devika. The post escaped the small orbit of a throwaway thought. People wanted to try it. Some wanted to help build it. Mufeed, then 21 and working from Kerala, had accidentally written a product announcement for software that did not yet exist.
There are two reasonable responses to this situation. One is to close the laptop and enjoy the engagement. Mufeed chose the more troublesome option. He spent roughly 20 hours across three days turning the joke into a working open-source project. He learned Svelte while building the interface, wired together agents that could plan, browse, research, write code, and run their output, then invited the internet inside. He was candid about the hurried code. He was equally clear about the invitation.
Devika travelled. The repository collected contributors and a large audience, while its creator became a useful character in the early coding-agent story: a young security researcher from Thrissur who could make a joke, make the thing, and make both public before the week was over. Yet the sprint makes more sense when placed beside the years before it. Speed was not the origin story. It was the visible result of practice.
Before the agent, the scoreboard
Mufeed grew up in Thrissur, Kerala, and entered software through its more adversarial doors. Cybersecurity competitions reward an unusual combination: patient reading, aggressive curiosity, calm under a clock, and the willingness to suspect that a perfectly ordinary input box may be lying to you. He won gold in Cyber Security at the IndiaSkills National Competition and bronze at the BRICS Skills competition. In 2022, he represented India at the WorldSkills Special Edition in Korea. The Indian pair finished eighth.
A competition gives every problem a timer and every claim a score. Bug bounty work applies a similar discipline outside the arena. Mufeed says he helped secure organizations including Google, Mastercard, Okta, Dell, Ford, the Electronic Frontier Foundation, and Telefónica through their bounty programs. His personal tally also includes more than 300 CVEs patched or reviewed in open-source software. The exact projects vary; the habit does not. Find the edge case, demonstrate it, and leave the system sturdier than it was.
“I make. I break.”
That compact line appears across his public profiles, sometimes extended into “computer witchcraft.” It lands as a joke because the two verbs are usually assigned to opposing teams. Developers make; hackers break. Mufeed's career treats them as alternating steps in one loop. A builder who never tries to break the work learns slowly. A breaker who never builds misses how compromise, deadlines, and inherited code create the flaws.
The repeating loop
A consultancy for hard problems
At 18, Mufeed started Lyminal, a research consultancy he later described with characteristic economy: a place where he solved hard software problems “for fun and profit.” Consultancy work rarely supplies the clean arc beloved by founder biographies. It supplies other things: unfamiliar codebases, incomplete briefs, practical constraints, and customers who care less about the elegance of a theory than whether the system works on Tuesday.
Alongside the client work came a stream of public tools. Moonwalk is a Rust utility for covering tracks during Linux exploitation exercises. Binserve is a single-binary static web server. PDFRip tackles password recovery. Code2prompt turns a repository into a structured prompt with its source tree and token counts. The projects do not pretend to be one grand platform. They look more like a well-used workbench, each tool built because a particular annoyance had become intolerable.
This matters because Devika was not a lottery ticket purchased with a clever name. It drew from security automation, agent experiments, and the muscle memory of publishing utilities. When interest appeared, Mufeed had enough pieces nearby to assemble an answer. Luck opened the door. Prepared code walked through it.
The useful limit of a viral build
Mufeed resisted one of the more theatrical claims surrounding coding agents. He described Devika as help for engineers, closer to an intern that could absorb mundane tasks than a replacement for the people responsible for a system. The distinction was practical. An agent could research, draft code, and correct some errors. It still operated inside limits set by models, context, tools, and the judgment of whoever deployed its output.
Devika nevertheless demonstrated two things. Reasoning models could coordinate a recognizably useful engineering workflow. Open source could turn a rapid prototype into a public laboratory. The repository's popularity gave Mufeed distribution, collaborators, criticism, and evidence that developers wanted better interfaces for agentic work. Later projects carried pieces of that lesson forward. Opcode, for example, provides a graphical app and toolkit around Claude Code sessions, custom agents, checkpoints, and background work.
The deeper commercial question waited in security, where an agent's confident mistake is more than comic. Conventional static-analysis tools can produce long queues of potential vulnerabilities. Every false alarm spends a human's attention. A finding that looks alarming but cannot be exploited is not free; it transfers the work of verification to the customer.
Make the software show its work
In 2024, Mufeed joined Vivek R and Asjid Kalam to launch Asterisk, accepted into Y Combinator's Summer batch. The company later became winfunc, with Mufeed as CEO and Vivek as CTO. Its focus tightened around AI-native security engineering for consequential codebases. The agent is designed to understand context, search for business-logic and implementation flaws, attempt to verify them in a controlled environment, and help generate a patch.
The important product word is “verify.” A model can write a persuasive paragraph about why a line of code looks dangerous. A security engineer needs to know whether the danger survives contact with the application. Winfunc's pitch places the proof-of-concept between suspicion and alert, asking the machine to perform more of the expensive doubt before involving a person.
This is where Mufeed's competition years and agent years meet. A CTF flag is proof. A bounty report needs a reproducible path. An open-source patch faces maintainers and tests. A useful security agent should inherit the same burden. Fluency may begin the investigation, but evidence closes it.
The work has moved into current software. Winfunc says its agent has found vulnerabilities across projects including Supabase, Sentry, Cal.com, Gumroad, Bun, and Hoppscotch. In May 2026, a KUSANAGI security update credited Mufeed VH of Winfunc Research in connection with CVE-2026-9256, a heap buffer overflow issue in NGINX. His public updates also describe experiments using small open models against hardened targets. The recurring question remains almost stubbornly consistent: can the system prove what it claims?
A security alert is a request for attention. Verification earns it.
The founder inside the side quests
Mufeed's public writing has little interest in polishing away the odd corners. His GitHub status reads “we ball.” His website lists “Latest Oscillating Interests” as spreadsheets, compilers, and an Instagram cat named Xiaojie. The About page ends with a bonus link to two cats posing together. These details do not explain a company. They do explain why his products often begin as playful provocations rather than solemn strategy documents.
There is a useful management instinct hiding in the play. A joke lowers the cost of exploring an idea. A small tool makes the exploration concrete. Publishing recruits reality before the builder becomes too attached to the thesis. When the response is weak, the side quest can remain a side quest. When people arrive asking for access, the experiment has earned another weekend.
Winfunc is the more deliberate bet. It sits at the intersection Mufeed has been approaching for years: offensive security, code automation, open-source engineering, and models that can reason through systems. The aspiration is not merely to make security reports arrive faster. It is to improve the ratio between a warning and a fact, then make the fix part of the same loop.
The route from Thrissur to San Francisco looks unusual only from a distance. Up close, it is a sequence of artifacts. A competition result. A vulnerability report. A consultancy. A repository built in 20 hours. A company accepted to YC. A credited security finding. Each one can be inspected. For a founder whose life has revolved around suspicious inputs, that may be the most fitting biography: never trust the claim when you can run the code.