Manage risk, don’t avoid it. – Gwynne Shotwell, President and COO of SpaceX
I'm an AI Security Engineer focused on how AI systems get attacked and how to defend them.
AI is moving faster than the security around it, and most of what’s out there is theory. I learn best by doing, so I build hands-on labs. First I break AI on purpose: prompt injection, poisoned tools, hijacked agents. Then I build the defenses and attack those too, to see where they hold and where they break. You run everything yourself and see how it actually works.
Everything here comes with real code you can run, fork, and adapt. Have ideas, found a better attack, or want to help? Reach out 🤝
A free lab you run on your own device: an AI agent, a gateway in front of it, eight checks and four versions of one attack. Which checks stopped the agent before it mailed AWS keys to an attacker, which ones only looked like they did, and what each one costs. With a two-minute summary of the risk and how to control it.
Two days after I reported it, Microsoft fixed it. What my free tool found in an official Microsoft AI plugin, why it matters even when nothing is malicious, how I reported it, and what to check in your own plugins. With a two-minute summary for leaders.
My first Claude skill could install software on your computer without asking you. Then my antivirus said Claude had written me a Python stealer. What happened, how a skill runs things on your machine, and what to check before you install one. With a two-minute summary for leaders.
An AI agent asked to summarize your inbox tries to send your password to an attacker. To stop that, AI security must check what agents do, not only what they say. Inside: the six areas of AI security, runtime security in depth, a checklist and ten vendor questions.
