Now
Updated 1 November 2026.
I’m working independently on AI security and vulnerability research.
- Exploring autonomous security testing through Hackbot, particularly harnesses, permissions, and reproducible evidence.
- Studying authorization boundaries in agent tools and connectors, and how prompt injection can cross them.
- Investigating API access control, tenant isolation, IDOR, BFLA, and business logic.
The questions I keep coming back to: what makes an agent’s finding reproducible, how should its scope be enforced, and what does a useful benchmark actually measure?