AI red team. Available for contract.
Prompt injection, agentic tool-poisoning, and jailbreaks that survive the guardrail, taken apart on purpose and answered with tooling shipped in the open.
Recent findings
Latest
skeptic's eval harness needs ANTHROPICAPIKEY or GEMINIAPIKEY and has never been run for real. No key was available, so instead of publishing a hedged guess, I substituted 16 blind subagents for the 16 sets of API calls same prompts, same scoring code, zero access to the answer key. Real recall was perfect. Real precision told a stranger, better story than a clean number would have.
Read the piece →Selected
One operator trains frontier models by day, runs them as development partners by night, and spends the late hours mapping them as the attack surface least defended in 2026, six vectors, a working bench, public repos doing the demonstration in the open. This is the surface read. The depth runs on contract.
A redacted-format sample of what an engagement deliverable looks like: threat model, findings ranked by severity, reproduction method, and mitigations, run fresh against current ImageMagick and Pillow rather than quoted from an old result.
A second redacted-format engagement report: how a safety-detection pipeline's own pattern-loading bug made it match zero inputs, ever, how the fix was verified, and what re-running the test suite tonight found still drifting.
A model doesn't check credentials. It reads context. Ask it to audit a branch called fix/security-stage1-remediation and it hands you the exploit chain as a courtesy, because nothing about the request looked like an attack.
The perimeter isn't a firewall anymore. It's a behavioral signature, the way your script touches the DOM, the timing of your API calls, the fingerprints your environment leaves before you've done anything. GHOST_PROXY is a full-stack UserScript workshop and offensive security sandbox built for the 2026 detection landscape. Neural intercepts, Shadow DOM obfuscation, AI-assisted payload hardening. The hardest vulnerabilities aren't in the code. They're in the assumptions.
I built a tool that ranks a body of writing by how far it has rotted, dead links, model IDs that dated the piece the day they shipped, predictions that already resolved. Then I did the only honest thing you can do with a rot detector: I pointed it at my own archive first. It found me out.
Browse by topic