Inventor · AI security researcher · Systems engineer
Founder & Chief Architect, Script Kitty OS

The model proposes, the system authorizes.

Identity proves who is acting. Attestation proves what ran. Gateways allow or deny a call. None of them prove the effect was the authorized one. That is the layer I build.

HolyTrinity — Authority-Bound Agentic Layer An AI agent authority control plane. Binds an approval to a specific action, target state, expected consequence, authority state version and validity window, then verifies the resulting effect matched what was authorized and issues a receipt bound to that approval. Any run can be replayed and diffed. BEAM-native. Elixir, Phoenix, LiveView, Ecto, Postgres, Oban. Running in production. Non-provisional patent filed.

Agent runtimes on the BEAM Jido and my own Hermes runtime, running supervised in production rather than bolted onto a request/response process. Agents are long-lived, concurrent, and capable of real damage. OTP was built for that shape of problem decades before anyone needed it for this.

HackTUI — terminal-native purple-team security operations platform Elixir umbrella: core, store, hub, sensor, tui, agent, collab. Postgres/Ecto persistence. Ingests journald, network flow via tshark/dumpcap, and BEAM runtime signals. Alert and investigation case lifecycle, replay engine, built-in MCP server. Research prototype.

HolyTrinity Bench (holytrinity.v1) Everyone benchmarks whether you can make an AI agent misbehave. That question is settled. You can. 1.8 million prompt injections against 22 frontier agents settled it, and I helped write that paper.

So this one measures something else: whether the effect that landed was the one that was authorized. Unauthorized effect under adversarial load, not attack success rate. In active development.

Security Challenges in AI Agent Deployment: Insights from a Large Scale Public Competition (2025) Co-author. Introduced the Agent Red Teaming (ART) benchmark. NeurIPS 2025 Datasets and Benchmarks Track · OpenReview · arXiv:2507.20526

The Model Proposes, the System Authorizes: An Authority Control Plane for AI Agents on the BEAM (2026) DOI 10.5281/zenodo.21754762

Authority-Bound Agentic Execution: Measuring Unauthorized Effect Under Adversarial Load (2026) DOI 10.5281/zenodo.21755869

Schrödinger's Cyber Security Framework: Vulnerability as an Observer-Dependent Quantity (2026) DOI 10.5281/zenodo.22116617

ART was retired in 2026 after frontier models saturated it, and is cited as the prior baseline in its successor benchmark.

Competed in Gray Swan's public red teaming arena, then joined the team. Built the Discord and ran community, helped grow it from a few hundred people to over 15,000. On the team for every competition through my departure, including the UK AISI Agent Red-Teaming Challenge behind ART: 22 models, 44 scenarios, 1.8M attack attempts, 62,000+ successful policy violations.

Wrote most of the Gray Swan Arena technical blog, 8 of its 10 posts. Designed and ran Gray Swan's in-person activation at DEF CON 33.

Elixir and OTP. Supervision trees, GenServers, distributed processes, PubSub. Agent runtimes running supervised in production rather than as a script with a retry loop. Phoenix, LiveView, Ecto, Oban, Postgres.

Agent infrastructure. MCP servers and clients, tool routing and mediation, policy enforcement at the call boundary, receipt and audit ledgers, replay and diff.

Security. Agent and LLM adversarial testing, evaluation and benchmark design, threat modeling, purple team operations, detection engineering, live telemetry ingest and correlation.

Also. Python, TypeScript, Go, C, Bash. Docker, Fly.io, GitHub Actions, Azure. Enterprise networking, self-hosted infrastructure, OpenWrt, VLAN segmentation, DNS.

Agent authorization and the HolyTrinity control plane. Conformance work against the draft EU AI Act cybersecurity standard prEN 18282 and OMB memoranda including M-26-04.

_{Work ships under @ScriptKittyOS. Script Kitty OS is a company of Sudo Apt Holdings.}