AI security brings together the parts of cybersecurity I find most compelling: social engineering, application behavior, model boundaries, infrastructure, and the ever-evolving relationship between human and machine.
I approach models and the applications around them as one integrated system. Sometimes the weakness is in a prompt, retrieval-augmented generation (RAG) pipeline, over-permissive configuration, tool call, or model artifact. Sometimes it is an exposed API, permissive output sink, authentication failure, or familiar server-side flaw. The investigation begins wherever the system starts giving away too much.
Fedora CyberStrike Agentic Harness
CyberStrike runs inside a dedicated Fedora Workstation VM built as a contained environment for agentic security tooling. The application is installed under my user account with user-only execution, and its configuration, cache, data, and state directories are restricted to the same account. The VM keeps the runtime, MCP integrations, and test data separate from my daily workstation.
Three optional MCP server definitions cover GitHub security, CVE research, and OSINT. They are disabled by default. I validated CyberStrike’s binary location, permission boundaries, and command resolution. I also tested time-bounded MCP inspection and confirmed there were no group- or world-accessible files in its runtime paths. Gemini returned MODEL_READY following its controlled run.
Next, I gave CyberStrike one funneled task. It had to send an approved EVTX file through Hayabusa MCP via forced-command SSH. I set the scan parameters in advance. CyberStrike stayed within them and returned a structured finding.
This return was independent of the offline forensic investigation. CyberStrike’s local analysis capabilities investigated the provided challenge artifacts. The run preserved original evidence and used static extraction with deterministic decoding. It isolated and recovered the payload, then validated the result. The closeout produced a report, evidence manifest, artifact hashes, and final checksum ledger.
CyberStrike validation on the dedicated Fedora workstation: user-only installation and runtime paths, with all optional MCP servers disabled by default.
LLM Red-Teaming and Offensive AI
Traced a connected chain through exposed API behavior, RAG context poisoning, system-prompt leakage, and model-generated HTML executing in the application’s output sink.
An assistant designed to resist gradual social-engineering pressure and frustrate the operator through programmed naivety. Eliciting its rulebook became an art form. One Python-embedded extraction exposed the full system prompt, the client table, and all three flags.
CalBot, a calendar assistant with access to a confidential sales report, cracked via four-step constraint inversion. The Four-Point Turn.
Two separately guarded assistants exposed protected values through the same constraint-enumeration question, revealing a shared failure pattern beneath different industry contexts.
A rogue AI command executor with two exposed attack surfaces: the natural-language UI and a queryable Ollama API. The API returned a convincing but invalid flag-shaped artifact. The valid result was extracted from the executor.
Assessed an internal AI assistant through service discovery, infrastructure fingerprinting, system-prompt extraction, prompt injection, and jailbreaking. Direct constraint enumeration was futile. Pivoting to developer-verification framing disclosed the protected configuration in one prompt.
Reconstructed an incident spanning packet analysis, indirect prompt injection, an agent tool call, and an encrypted archive. The full investigation lives in Penetration Testing.
Adversarial ML, Agents, and Supply Chains
Recovered a deleted malicious Claude skill, traced persistent agent instructions, and reconstructed an encrypted payload from Git history during Cyber Apocalypse 2026.
Adversarial machine-learning challenge covering model extraction, transferable evasion, backdoor recovery, and behavior-preserving model forgery during Cyber Apocalypse 2026.
AI Security Tooling
A CLI tool that maps adversarial AI techniques against the MITRE ATLAS framework. I built it because I needed one place to find the techniques, tools, and framework mappings I was reaching for while the field kept outpacing its own documentation.
The engineering record behind the Go CLI: STIX parsing, command design, cross-platform releases, and a CTF-driven development loop that now includes validated payload and execution support.
Defensive AI and Detection
AISMON and defensive investigations
AISMON began as a guided security-tool build and became an end-to-end detection pipeline using Sysmon telemetry, credential redaction, calibrated AI-activity rules, structured JSON, and Splunk investigation output. Additional work covers malicious model artifacts, indirect injection, and cloud identity. Telemetry remains the source of truth.