Field notes from the frontier of AI security.
An engineer building, breaking, and benchmarking AI security systems, writing the practical version in public.
Creator of ASH · Co-author of SIR-Bench and ThreatForest · Speaking at Black Hat USA 2026
Writing
All posts-
Balancing speed and safety: A control framework for AI coding agents
Author-time guardrails, build-time verification, and risk-based human review for AI-assisted development.
-
It’s 2025. Why Are We Still Pushing API Keys to GitHub?
Why hardcoded AI keys keep leaking, why agents widen the blast radius, and what teams should do about it.
-
Building Your Cybersecurity Career Path: A Guide for Beginners
How beginners choose a focus, build proof of work, and grow into security engineering.
Work
Everything-
Automated Security Helper
One command runs nine open-source scanners across SAST, SCA, IaC, secrets, and SBOM, locally or in CI/CD.
-
SIR-Bench
A benchmark for whether an incident-response agent actually investigates, or just restates the alert.
-
ThreatForest
Multi-agent attack trees from source code, with TTP mapping and evidence-based mitigations.
-
AI Leak Watch
A public dashboard of potentially exposed AI provider keys on GitHub, updated monthly.
Get the next field note.
Secure Steps, the newsletter. One practical note on AI security when there is something worth sending.