Security Engineer (AI) at Salesforce · M.S. Information Security, Carnegie Mellon
OSCP · OSEP · OSWE · CRTP · CREST CRT · CEH (Master)
I break AI systems for a living. I'm a product security engineer and offensive researcher focused on the security of LLMs, autonomous agents, and the infrastructure around them: MCP, A2A, gateways, and RAG pipelines.
My open-source work centers on finding and fixing high-impact vulnerabilities in the tools the AI ecosystem is being built on: evaluation frameworks, agent runtimes, and AI assistants used by hundreds of thousands of developers. Below is a record of my public security research, responsible disclosures, and open-source contributions.
Coordinated-disclosure vulnerabilities I discovered and reported in widely-used open-source AI/ML projects, spanning codebases with a combined ~625k GitHub stars. Every entry links to a public, verifiable reference.
| Project | Reach | Vulnerability | Severity | Reference |
|---|---|---|---|---|
| openclaw (personal AI assistant) | ~381k★ | LLM-driven gateway config-injection: bypass exec approvals, disable auth, and inject MCP servers via config.patch |
 |
GHSA-xmjq-5cvf-v7gj (coordinated) |
| hermes-agent (agent runtime) | ~208k★ | Unauthenticated plugin code execution via dashboard loader |  7.8 |
Report #46435 GHSA-mcfc-hp25-cjv7 |
| hermes-agent | ~208k★ | Authorization bypass via spoofed From: header (email gateway) |
7.0 |
Report #46434 GHSA-rxqh-5572-8m77 |
| promptfoo (LLM eval / red-team toolkit) used by OpenAI & Anthropic |
~23k★ | Second-order Nunjucks SSTI → Remote Code Execution in renderPrompt |
8.3 |
Fix PR #9693 GHSA-7x7g-w3q4-fv98 |
| promptfoo | ~23k★ | RCE via storeOutputAs register collapse (file:// dynamic import) |
8.3 |
Fix PR #9693 GHSA-f5hv-jrwp-gh59 |
| RAGAS (LLM evaluation framework) | ~15k★ | Arbitrary File Read in multimodal prompt handling | 7.5 |
CVE-2025-45691 · GHSA |
| openclaw | ~381k★ | Server-Side Request Forgery on all bot media-fetch paths |  |
GHSA-3fv3-6p2v-gxwj |
Pull requests to major open-source projects: security fixes, hardening, and disclosure infrastructure.
| Project | Reach | Contribution |
|---|---|---|
| tensorflow/tensorflow | ~196k★ | Fix out-of-bounds write in MaxPoolGradWithArgmax GPU kernel (CWE-787) |
| promptfoo/promptfoo | ~23k★ | Harden eval template rendering to close RCE sinks |
| vibrantlabsai/ragas | ~15k★ | Patch CVE-2025-45691 + add security controls |
| vibrantlabsai/ragas | ~15k★ | Add responsible-disclosure policy (SECURITY.md) |
| github/advisory-database | n/a | Publish RAGAS advisory GHSA-v2xr-wvrv-p969 |
| OWASP/www-chapter-coimbatore | n/a | OWASP chapter website & content |
I also file detailed reliability reports in high-traffic projects, e.g. openclaw #55330 and #55410.
Open-source offensive-security and AI-security tools I build and maintain.
| Tool | Stack | Description |
|---|---|---|
| AgentHound | Go | Offensive security framework for AI-agent infrastructure: recon, credential looting, model exfiltration, poisoning, and attack-path analysis across MCP, A2A, gateways, and AI services. "BloodHound for the agentic stack." |
| AgentMask | TypeScript | Context-level secret isolation for AI coding agents (Claude Code, Copilot). Keeps secrets out of the LLM context window with sub-50ms hook latency. |
| PixelPoison | Python | Adversarial image generation for Vision-Language Model (VLM) security testing. |
| WAVE | Python | Web Application Vulnerability Exploiter: automated web vulnerability scanner. |
| BufferSploit | Python | Semi-automated CLI for stack-based buffer-overflow exploitation. |
| Slacksploit | Python | Forensic framework for enumerating Slack artifacts on a host. |
More on my repositories · talk decks.
Full list on ORCID.
- A Comprehensive Approach for Enhancing OSINT through Leveraging LLMs
- Diminishing Popularity of Encoder-Only Architectures in Machine Learning Models
- LSAF: A Novel Comprehensive Application and Network Security Framework for Linux
- Reverse Engineering and Backdooring Router Firmwares
OSEP · OSWE · OSCP · CRTP · CREST CRT · CREST CPSA · GCCEP · CEH (Master) · ICSI CNSS · Fortinet NSE