I secure the layer where AI agents meet real tools and real data: MCP server security architecture, agentic threat modeling, and prompt-injection defense, with code-enforced permission boundaries instead of prompt-level promises. On the offensive side, 100+ reviewer-validated prompt-injection and jailbreak findings against live LLM products, and jailbreak research since mid-2022, before ChatGPT existed. Before AI security: 10+ years in cybersecurity, 7+ at the TS/SCI level across nuclear command and control, SAP/TEMPEST, and federal cloud. M.S. AI candidate at Georgia Tech.
The question I keep answering for AI teams: what can this agent be tricked into doing, and what stops it at the code layer rather than the prompt layer?
Code-enforced tool-permission boundaries, governed MCP/A2A control planes, and threat models for agents that call tools, read untrusted documents, and talk to other agents. Multi-tenant isolation on AWS Bedrock Agents, Azure, and Kubernetes.
Direct, indirect, and cross-domain prompt injection, jailbreaks, MCP tool poisoning, schema injection, and cross-server privilege escalation. 100+ reviewer-validated findings against live client LLM products, scored against a structured red-team taxonomy.
Harnesses that replace "the model said it was safe" with falsifiable pass/fail gates: canary extraction, PII and injection detectors, egress interceptors, and guard modules that ship with measured true- and false-positive rates.
Lead ISSO for Sentinel and Nuclear Command & Control programs. Zero-days found by hand that enterprise tooling missed, ~2,500 controls authored, and full ATO on a $147B TS/SAP cloud program. Mapped to NIST 800-53 Rev 5, NIST AI RMF, MITRE ATLAS and ATT&CK.
Firsthand research and engineering notes on AI security, newest first.
Why memorized flags and manual scripting are giving way to autonomous terminal work, with a side-by-side of diagnosing a broken service by hand versus letting an agent do it end to end.
Read →How agentic AI reshaped offensive security between 2016 and 2026: RoE-gated orchestration, exploitation chaining, and the AI-vs-AI attack surface of indirect prompt injection, context poisoning, and agent hijacking.
Read →100+ findings in a week, a team with no hacking background, and a recognition gap around obfuscated prompt injection. Includes two rewritten case studies and a proposed credentialing framework for AI red teams.
Read →Code-level CIDR allowlists an injected prompt cannot escape, and canary/PII/injection-gated evaluation instead of LLM self-grading. Plus where AI-to-AI offense and autonomous defense are heading.
Read →A firsthand account of bypassing Midjourney's content filter with substitution phrasing months before the "DAN" prompts, and why keyword and semantic-matching guardrails still fail the same way today.
Read →Offense and defense built as a matched pair, plus governance tooling. Code on GitHub.
Python harness unifying AI red-team tradecraft across 11 attack modules: prompt injection and jailbreaks, MCP/RAG/A2A, adversarial-ML evasion, data poisoning, membership inference, model supply chain, and agent SSRF. Code-enforced scope gate, verbatim request/response evidence capture, scoring and report scaffolding, and an MCP server so agents can drive it.
Blue-team counterpart to Wraith: 15 detection and guard modules (indirect injection, taint-based exfiltration, MCP privilege boundaries, agent egress SSRF, supply-chain startup hooks, agent tampering with monitoring) mapped to a shared attack taxonomy, each shipping measured true- and false-positive rates. Includes a deployable egress interceptor validated end to end against Wraith's SSRF payloads.
Replaces self-graded LLM safety scoring with deterministic pass/fail gates (canary extraction, PII regex, injection detection) and an advisory-only LLM judge calibrated against a golden set, aligned to NIST AI RMF MEASURE/MANAGE. The allowlist lives in code, so an injected prompt cannot widen scope. Technical breakdown →
Generates SCTM, eMASS export, and POA&M items from SSP content, grounding every AI judgment against the full 1,189-entry Rev 5 catalog. Provider-agnostic (Anthropic, OpenAI, Bedrock GovCloud) and deployable air-gapped/NIPR with zero code changes.
An LLM plays a state-consistent threat actor across 23 scenarios and 9 MITRE-mapped APT profiles, with attacker and grader split across separate API passes and auto-generated after-action reports. Cuts exercise prep from weeks to hours.
Multi-agent active-defense platform with ML-based C2 beacon detection, passive attribution (geolocation, JA3, threat intel), confidence-gated response, and cryptographic chain-of-custody evidence. One-command FBI/CISA report generation in STIX 2.1.
AI security architecture and AI red teaming for the firm's enterprise AI platforms and agents.
A Weapons Director sits in an Air Operations Center or Control and Reporting Center, watching a live radar picture and directing fighter aircraft in real time: sorting real threats from noise, prioritizing which contact gets worked first, and issuing short, unambiguous instructions to pilots who rely on your read because they can't see what you can see. It's high-tempo decision-making under incomplete information, inside a strict rules-of-engagement framework, where a wrong call has immediate consequences.
That maps closely to AI red teaming and incident response: triaging a flood of findings, deciding what's a real threat versus noise, working inside an explicit scope boundary, and communicating clearly and fast when the picture is incomplete.
A film scene, not real footage, but the closest illustration of what that decision tempo feels like.
Also fiction, but a reasonable stand-in for the operations floor a Weapons Director works from.
Click a node to see the certificate. Gold = completed, purple = in progress.
Click any certification above to view the certificate, domain alignment, rarity, and offensive/defensive weighting.
Also: Microsoft Certified Azure AI Fundamentals. Choosing your own next cert? See the full interactive security certification roadmap, a vendor-neutral breakdown by rarity, domain, and offensive vs. defensive focus.
Part-time. Research: adversarial robustness and red teaming of LLM agentic systems.
NSA Center of Academic Excellence in Cyber Operations. Malware reverse engineering and digital forensics.
AFNWC Security Community Award, Security Outstanding Team Award, NXOS Security Team. Also: Minuteman III Personnel Award and ICBM Personnel Award.
160 lbs, Kanab High School. These days I'm on the other side of the mat, coaching youth wrestling.
Round-by-round and the newspaper clipping →Open to conversations about AI security architecture, agentic threat modeling, MCP security, and AI red teaming.