Security · second focus
How tool-using agents fail when someone pushes back.
I study agents with inboxes, browsers, files, and tools — the same surfaces that make them useful also make them attackable. The work runs in isolated sandboxes with benign canaries, not live data.
Studies
Agentic red-teaming program.
01
Indirect prompt injection
Hidden instructions in pages, documents, and messages that redirect what an agent does without the user noticing.
02
Credential & data exfiltration
When agents leak secrets — measured with canary tokens, not real credentials.
03
Agent hijacking
Tool permissions and scopes turned toward actions the user never requested.
04
Multi-turn social engineering
Pretexting and pressure built across a whole conversation, not a single-shot jailbreak.
How I test
Simulate — mock inboxes, chat, files, and tools, fully isolated.
Attack — automated adversarial and insider-threat scenarios against the agent under study.
Observe — canary tokens and tool-call monitors record exactly when a line is crossed.
Publish — reproducible benchmarks, harnesses, and write-ups intended for open release.