Writing
Notes on AI risk, agentic security, and the projects I build.
A resume for two audiences
More and more, the first reader of a resume is an AI agent. So I built this site to be read by both people and agents — Markdown twins, llms.txt, JSON Resume, content negotiation, and a small read-only MCP server.
The agent is an identity
Most AI risk conversations start with the model. I think they should start with the credentials. An agent can only do what its identity allows — so govern the identity.
Agent traces are security telemetry
If you can't replay what an agent saw, decided, and did, you can't investigate it. OpenTelemetry already gives us the format. The SOC needs to treat it like EDR data.
An agent for apps without APIs
Every identity program has a list of disconnected applications that someone provisions by hand. I built a proof of concept where a model drives the browser instead — with a human approving every write and a hashed screenshot behind every step.
Three gates for an offensive agent
I built an MCP server for HackerOne and a bug bounty pipeline around it. The interesting part isn't the 174 tools. It's the three places where the agent has to stop and wait for me.