Computer Engineer · AI Security Researcher · Pentester
I work at the intersection of agentic AI and offensive security, building AI agents that attack and defend systems and auditing AI systems for vulnerabilities. My current focus:
- Offensive AI agents: LLM-powered multi-agent frameworks for recon, exploitation, and post-exploitation automation (LangGraph, MCP, A2A).
- Defensive AI agents: Agentic pipelines for threat triage, incident response, investigation assistance, and post-incident documentation.
- AI system security: Attacking LLMs and agentic pipelines in production: prompt injection, jailbreaking, RAG exfiltration, tool poisoning, adversarial ML.
Security assessments of production AI deployments: LLM-powered platforms, agentic pipelines, and systems with broad tool/connector surfaces. Findings reported using OWASP API Security taxonomy and CVSS 3.1 scoring.
LangGraph multi-agent system for automated Solidity auditing, targeting bug bounty platforms (Immunefi, Code4rena, Sherlock).
- Prompt injection (direct & indirect, including via MCP channels)
- Jailbreaking and alignment evasion
- Tool poisoning and confused deputy in multi-agent systems
- RAG exfiltration and knowledge base data poisoning
- Model extraction and membership inference
- Guardrail bypass in production apps
| CVE | Product | Description | CVSS |
|---|---|---|---|
| CVE-2026-55784 | free5GC AUSF ≤ 1.4.4 | Race condition: concurrent auth requests overwrite active cryptographic session context (SUPI-keyed global map), enabling DoS for targeted subscribers | 7.5 High |
| CVE-2026-55785 | free5GC AUSF ≤ 1.4.4 | Non-constant-time cryptographic comparisons (CWE-208/385) + XRES* authentication material written to INFO logs (CWE-532), exposing 5G-AKA session keys to log collectors and adjacent processes | 3.7 Low |
Also reported and patched 3 vulnerabilities in other open-source 5G cores, fixed by maintainers without CVE assignment.
| Cert | Org | Status |
|---|---|---|
| OSAI - Offensive Security AI | OffSec | In progress |
AI / Agents
LangGraph · LangChain · MCP · AWS Bedrock · OpenAI API · HuggingFace
AI Security
MITRE ATLAS · OWASP LLM Top 10 · ART · Adversarial ML
Pentesting
Burp Suite · Metasploit · Nmap · Wireshark · Caido · Kali Linux
Smart Contracts
Solidity · Foundry · Slither
DevSecOps
Docker · Git · CI/CD · Linux hardening
Languages
Python · Go · JavaScript · C
Agentic AI Security
Tool poisoning · MCP attack surface · A2A delegation abuse
LLM Attacks
Prompt injection · Jailbreaking · RAG exfiltration
Adversarial ML
Model extraction · Data poisoning · Membership inference
5G Core Security
Open-source 5G NF vulnerabilities (free5GC, OAI, srsRAN)
Smart Contracts
Solidity audit automation · Bug bounty (Immunefi, Code4rena)
$ echo "Always learning, always breaking things." _