I break AI systems to understand them,
and build what defends them._

An agent loop for autonomous red-teaming: it plans and chains security tools through an MCP-style registry, carries persistent memory across engagements, and gates every finding behind human review. Targets web / API / infrastructure and LLM / agent surfaces.

An autonomous red-teaming system (researcher, attacker, autograder, novelty archive) that discovers LLM jailbreak strategies without hand-written payloads, clusters them into an attack taxonomy, and tests each class against paraphrase and classifier defenses. Open source, responsible disclosure.

A defense that catches prompt-injection attacks on AI agents, where hidden text in a web page, file, or tool output tricks the agent into following the attacker instead of the user. On a labeled benchmark, the strongest method cut successful injections by 82.6% while wrongly flagging only 4.3% of clean responses, then blocks the high-risk ones.

Uses a model's refusal direction and strength (open-weight activations) as a continuous search signal to map the refusal boundary and surface new jailbreak classes, then tests their transfer to closed models and survival against defenses.

A deliberately vulnerable LLM app and an attack framework spanning the OWASP LLM and API Top 10, scoring each exploit to SARIF, paired with a hardened build that closes every class and tests asserting each attack succeeds insecure and fails hardened.

A CI/CD security gate that merges many scanners into one clean report, fails builds only on net-new findings, and uses an LLM to cut false positives.

A vulnerable AWS range, an attack chain that walks IAM privilege escalation up to admin, and a read-only auditor that maps every path back to a fix.

Turn security signals into metrics, SLOs, and dashboards, and collapse alert storms into root-cause incidents (cut a 53-alert storm down to 3 in testing). Plus an MCP injection scanner, a prompt-injection scanner, and an agent SSRF lab.