Security research across AI-integrated and agentic systems, web applications, distributed systems, and secure-by-design code.
Everything below is used in the repositories on this profile.
Languages
AI & retrieval
Testing & tooling
AI & agentic systems retrieval authorization and tenant isolation, direct and indirect prompt injection, guardrail evasion, agent memory persistence, and exfiltration through sanctioned channels.
Application & API security exploit-chain reasoning across web application and API attack surface, walked through so the attack can be reconstructed from first principles.
Distributed systems protocol-layer and on-chain work: defensive build patterns for the EVM, each tied to the EIP and the failure mode it exists to prevent, and offensive work against financial state machines through worked solutions.
agent-action-broker Policy decision point for tool-using agents. Mediates each tool call by capability and information flow, fails closed, and returns a least-privilege downgrade on denial. Carries an audit trail and an AgentDojo-modeled evaluation reporting injection-block and utility rates.
agent-defense-eval Evaluation harness that scores agent-authorization defenses against the AgentDojo benchmark on injection blocking and utility, attributing each block to its cause through benign twins. Includes published results for a trained prompt-injection classifier.
agent-trace-detections Detects cross-call and sequence-level attacks in agent execution traces that a per-call reference monitor cannot see. Reads OpenTelemetry GenAI spans and reports each finding with a false-positive rate measured against a benign twin. Three signatures across the cross-call and tool-integrity categories, with numbers pinned by a test.
mcp-controlplane-scan Scanner for the localhost HTTP control plane exposed by local AI tools and MCP servers. Flags DNS-rebinding, cross-site, and unauthenticated-read failure classes, and ships a hardened reference server that passes its own checks.
agentic-rag-tenant-lab Multi-tenant agentic RAG security lab. Four retrieval authorization flaws, five defense layers, measured attack success rates.
lab-journal Technical write-ups and notes, with documented reproducible attack chains and analysis.
modern-solidity-patterns Defensive build reference for Solidity 0.8.x and the current EVM. The patterns, each stating the failure mode it prevents, grounded in the relevant EIPs and audited libraries.
move-security-patterns A defensive reference for building on Aptos Move, stating which layer of the platform covers each failure mode and how far that coverage reaches. Every pattern carries an adversarial test that tries the attack.
runtime-differential Runs the same operation on more than one blockchain runtime and reports what each one did. It records no expectations, so a runtime changing behaviour changes the reading rather than failing against a recorded belief.