Real systems I've built and run — and the security discipline that keeps them safe. Dogfooding first, then what I find when I test agents.
Before I tell you how to build and run agents, I run them myself. This is the same discipline I apply to client systems — measurable, in production, unattended.
A fleet of AI agents that drafts, schedules, and publishes content across Instagram, Pinterest, X, and Bluesky — with guardrails, cost tracking, and incident handling on every run. 37 posts published across the fleet, scheduled and sent unattended.
See how I run it →A full-stack app with an AI help agent that reconciles pay stubs against hours worked — built, deployed, and kept running with the same discipline I apply to client systems.
See it live →The same discipline I build with, applied defensively. Anonymized findings from real engagements — every agent I ship is held to this bar too.
A customer support agent retrieved documents from a shared knowledge base. An attacker planted a system-override instruction in a public-facing document. The agent exfiltrated the user's session token via the send_email tool.
Read the full teardown →An MCP server shipped with all tools registered as publicly callable — no authentication, no rate limiting, no confirmation boundaries. An attacker could chain read_file + send_email to exfiltrate any file on the host.
Read the full teardown →An AI agent returned its full system prompt in a verbose error message when given a malformed input. The prompt contained API keys, database schema details, and internal tool naming conventions — enough for a targeted attack.
An agent with read-only document access could chain search_docs → summarize → send_email to exfiltrate PHI. No confirmation boundary existed between reading data and sending it externally.
A DAN-style persona override bypassed the agent's content safety guardrails. The agent generated harmful product recommendations and exposed internal pricing logic that was never meant to reach customers.
An AI coding assistant generated SQL queries and shell commands that were executed without sanitization. An attacker could inject malicious code through a crafted prompt that persisted in the generated output.
Published research and methodology from public vulnerability disclosures and bug bounty programs.
My first HackerOne report landed as a HIGH-severity information disclosure on a major education platform. The methodology applies to almost any AI-enabled site.
Read the full report →Downloaded 13 Clarity 4 contracts from a $100K bug bounty program, generated 8 hypotheses, tested the 3 highest-priority ones, and refuted all at the code level. A high-quality negative result.
Read the methodology →Found a vulnerability in a production MCP server in under 10 minutes. Tool poisoning, session hijacking, and the 3-line fix that blocks it all.
Read the teardown →Book a free 15-minute fit call. We'll scope your agent and recommend the right starting point.
Book a Free Fit Call →