AI red team
Red-team testing for frontier models and agentic systems.
A security tool bench, a research series that names the abuse patterns before they scale, and a month inside a frontier lab's red team. I know where every door is. I knock on the front one.
What I do
- I test frontier and multimodal models for real weaknesses: prompt injection, tool poisoning, and the trust gaps between agents that only show up under load.
- I also build the defense side: deception tokens, egress forensics, and attribution that never mistakes an IP address for a person.
- Architecture reviews for teams building agentic systems, plus working detection tooling you keep after the engagement ends.
Engagement Reports
What a deliverable from me actually looks like: threat model, findings ranked by severity, reproduction method, mitigations. Built on my own tools. Each report states the checks performed, the findings, and the limits. Dated follow-ups record repairs and corrections.
- OffenseOMNY and Transit Lab →Eight local fixture checks pass for cross-account card reads and sensitive changes with a valid session. Live OMNY authorization and the suspected telemetry dependency remain unproven.
- OffenseSlack OAuth SDK →Eight checks against @slack/oauth 4.0.0 confirm default cookie binding and the warned legacy-mode gap. No live installation or link to the Mercor intrusion established.
- OffenseImage Payload Injection →A survival matrix failed its own controls: clean images scored as bypasses, while preserved pixel text went undetected. Original conclusions withdrawn; nine regression checks now verify bounded measurements and explicit unknown/error results.
- DefenseClaude Whisperer →A pattern-loading and detection failure traced to three bugs. Follow-on client checks: eight passing tests, with live integration explicitly skipped.
- DefenseClutch →A broken validation suite repaired, then all three expected threat flags detected across eight synthetic rogue-base-station injection cycles. No field-detection rate claimed.
- DefenseCyclops →Seven tests pass, plus an exact 400-pixel diff control. Git paths are mocked; browser capture and interactive onboarding remain separate checks.
- DefenseLineman →Two verifier bugs repaired. Signing, tamper rejection, classification, and ten parser tests rechecked; live BSM remains unverified without root.
- DefenseTit for Tat →Interpreter binding repaired. Three local-server integration tests and two CMS plugin-key regressions pass; production stealth and attribution accuracy are outside this check.
- DefenseDuckHunter →Frontend build, typecheck, and nine synthetic detector tests pass. USB IDs match primary sources; device claiming and live I/Q acquisition remain untested.
- DefenseGhost Proxy →The classification-scan gate was run directly against its real source. Accepted, it returns a timestamped acknowledgement record. Declined, it returns nothing.
- DefenseBot Toll →Eleven honeypot routes, including the one the README tells site owners to deploy, had empty handlers that hung every request instead of rejecting it. Fixed, plus a year-stale AI model reference.
- DefenseHidden Bastard →The deep scanner correctly flags risky folders. SELECT ALL ignored that flag entirely and would have trashed them anyway. Fixed, plus a scheduled rule doing permanent delete instead of Trash.
- OffenseFlea Flicker NetFilter →Rule loading rechecked at 54/100/100 entries. Current DNS-to-IP matching exists, but the generic HTTPS allow still precedes destination blocks. Live enforcement unverified.
Proof
Most recently: a month-long AI red-team engagement on a flagship, newest-generation model release at a leading frontier lab, under NDA, with current commercial vetting passed short of a government clearance. Working the methods labs are defending against right now, not last year's playbook. I can't name it. I can tell you what the work is made of.
A private channel produced request signatures the roster did not account for. I built a canary, a link that previewed as an ordinary shared photo and recorded iPhone and Android client signatures. Those are leads to check, not proof of a particular handset or person. It was one piece of a real investigation. I handed over the clean timeline and stepped back when the detective did not want outside help. An IP is a lead, not an identity. The tool knows the difference, and so do I.
The arsenal is open on GitHub and the research is open here: the frontier attack surface, the training-pipeline supply chain, SPID and eIDAS threat models, the surveillance stack read from the inside. Written to be checked, not admired.
The Tools
The attack side. Where the payload lives in the pixels and the parser trusts the wrong byte.
The half most red teamers skip. You don't understand a trap until you've had to set one that works.
The part that stays honest about the difference between a lead and an identity.
If you've got a system you're not sure about, or a red-team program that needs someone who's worked both sides of the field, the work above is the place to start. Authorized scope only. I bring the paperwork discipline, not just the exploit.
github.com/ghostinthepromptDiscuss a research engagement → · Commission technical writing