Joanna Rutkowska: From Blue Pill to Qubes OS

Most hackers try to sneak malware into your computer. In 2006 Joanna Rutkowska asked a stranger question: what if you sneaked the computer into the malware?

The answer was Blue Pill, a rootkit that slid a running copy of Windows into a virtual machine without the operating system noticing. The name came from The Matrix, and so did the implication: nothing you see on the screen can be trusted.

Rutkowska spent the next decade proving that point against the biggest names in computing, then did something stranger still. She built an operating system around the assumption that every part of it'll eventually be broken.

Joanna Rutkowska at a Glance

• A Polish researcher who learned on a PC/AT 286, Rutkowska spent the early 2000s digging into kernel malware on Windows and Linux.
• In 2006, working for the Singapore firm COSEINC, she unveiled Blue Pill at Black Hat in Las Vegas and, in the same talk, bypassed the driver-signing protection of the unreleased Windows Vista.
• In 2007 she founded Invisible Things Lab in Warsaw, which went on to publish a string of attacks on Intel's trusted computing technologies.
• Her 2009 "Evil Maid" attack showed that an encrypted laptop left in a hotel room could be made to give up its password in a couple of minutes.
• In April 2010 she announced Qubes OS, a desktop system that splits your digital life into isolated virtual machines. Version 1.0 shipped in September 2012.
• Edward Snowden called Qubes "the best OS available today" in 2016, and she used a 2017 Black Hat keynote to argue that security comes from distrust, not trust.
• In 2018 she handed Qubes to a new lead and joined the Golem Project to work on trust in the cloud, later building a data system called Wildland.
• In February 2026 she started a new blog, Traces of Humanity, and said she no longer works in computer security at all.

The Life of Joanna Rutkowska

Rutkowska's Early Years

Joanna Rutkowska grew up in Poland and got her first computer early: a PC/AT 286 that ran, as she later remembered it, "at a blazing speed of some 16MHz."

By the early 2000s she was taking apart the lowest level of Windows and Linux, the kernel, where the most dangerous malware lives. Rootkits, programs that hide inside an operating system and lie to it about what's running, became her specialty.

Her early work included Red Pill, a tiny program that could tell whether it was running inside a virtual machine. It was a detector. The next idea was the opposite.

The Blue Pill

In 2006 Rutkowska, then a researcher for the Singapore-based security firm COSEINC, wrote on her blog about a rootkit that wouldn't hide inside the operating system at all. Instead it'd use the new virtualization features in AMD's processors to lift the entire running system into a virtual machine it controlled.

"Your operating system swallows the Blue Pill and it awakes inside the Matrix," she wrote.

That August she took it to Black Hat in Las Vegas in a talk titled "Subverting Vista Kernel For Fun And Profit." For good measure she also showed how to defeat the driver-signing checks in 64-bit Windows Vista, which Microsoft hadn't yet released.

"The fact that this mechanism was bypassed doesn't mean Vista is insecure," she told reporters. "It just means it's just not as secure as advertised."

The talk made her famous. It also started an argument that ran for years over whether a Blue Pilled machine could ever be detected.

Invisible Things Lab

In 2007 Rutkowska set up her own company in Warsaw, Invisible Things Lab, and brought in two researchers she considered among the best in the field, Alexander Tereshkin and Rafał Wojtczuk.

The boutique firm became Intel's least favorite reviewer. Over the following years it published exploits against Intel's Trusted Execution Technology, a software escape from the VT-d isolation hardware and a way into the management technology that lives below the operating system.

Blue Pill itself never showed up in the wild, and Rutkowska had a theory about why.

"There are still so many places in a Windows kernel to hide traditional malware," she told Wired in 2014. "I was as vulnerable as any other user. This was annoying."

The Evil Maid

In October 2009 Rutkowska and Tereshkin published an attack on TrueCrypt, the popular disk-encryption tool, that needed no cryptography at all.

An attacker with a minute or two alone with a powered-down laptop boots it from a USB stick. The stick patches the encryption software's bootloader to record the passphrase the next time the owner types it.

"As any smart user might have guessed already," she wrote, "this part is ideally suited to be performed by hotel maids, or people pretending to be them." The name stuck. "Evil maid" is now standard vocabulary for any attack that begins with a few minutes of physical access.

Security by Isolation

By 2010 Rutkowska had concluded that the game of finding and fixing holes couldn't be won. "I believe in 'Security by Isolation,'" she'd told an interviewer the year before.

On April 7, 2010, she announced Qubes OS, "an open source OS based on Xen, X, and Linux, designed to provide strong isolation for desktop computing." Instead of one operating system doing everything, Qubes runs your work, your banking and your idle browsing in separate virtual machines that can't see one another.

Open a poisoned attachment and the malware is trapped in one compartment, which you can simply throw away. It was alpha software, but she was already using it for "pretty much all the other daily tasks."

Qubes 1.0 shipped on September 3, 2012. By 2014 Rutkowska was typically running about fifteen virtual machines at once.

Snowden's Endorsement

On September 29, 2016, Edward Snowden told his followers: "If you're serious about security, @QubesOS is the best OS available today. It's what I use, and free." The project keeps the tweet on its endorsements page, next to one from Micah Lee of The Intercept: "When I use Qubes I feel like a god."

Qubes was never going to be mainstream. It demands a capable machine and a tolerance for friction. But for people whose adversaries can afford zero-days, it became the obvious choice.

Intel x86 Considered Harmful

Rutkowska's distrust ran deeper than any one program. In October 2015 she published a 50-page paper titled "Intel x86 considered harmful," cataloguing a decade of problems in the processors themselves, including the Management Engine, a hidden computer that Intel decided "to serve to us on every new processor."

In December 2017 she gave the keynote at Black Hat Europe in London under the title "Security Through Distrusting." The industry, she argued, had spent too long trying to make each component trustworthy: "The industry has been way too much focused on this first approach, which I see as overly naive and non-scalable to more complex systems."

Better, she said, to assume any single piece could be compromised and build so that it doesn't matter.

The Next Chapter

On October 25, 2018, Rutkowska published a post titled "The Next Chapter: From the Endpoint to the Cloud." She was joining the Golem Project as chief strategy officer, "also doubling as Chief Security Officer," and handing Qubes to Marek Marczykowski-Górecki.

"Marek will continue to lead Qubes now, so I'm reassured about the future of the project," she wrote, promising to stay on as an adviser and as a user.

Her next project, Wildland, was a system for organizing files across many kinds of storage. Its first client shipped in June 2021. Then the blog went quiet.

Rutkowska Today

It stayed quiet until February 2, 2026, when a short post appeared: "After all those years of silence, I've felt like writing a blog again." The new site, Traces of Humanity, bills itself as "Rants of a struggling humanist."

Its about page runs through the past twenty years in one breath, listing Red Pill, Blue Pill, Evil Maid, Qubes and Wildland, and then: "Today I no longer do computer security." Her first long essay there is about freediving.

Qubes has carried on without her. Version 4.3 shipped in December 2025, and the project's team page still lists her as founder and adviser.

Joanna Rutkowska: Trust Nothing

Blue Pill was a party trick with a serious lesson: the layer you're standing on can always be pulled out from under you. Rutkowska spent a decade pulling it out, from Windows to Intel's silicon, and then wrote the one operating system that takes the lesson seriously.

Qubes outlived her involvement, which is the point of building things that don't depend on any single person. Snowden's endorsement still hangs on the project's site, and the project still ships.

She, meanwhile, has walked away from the whole field, which may be the most Rutkowska move of all. Trust nothing, including your own career.