I work on the security of AI agent infrastructure: the tooling, protocols and pipelines that let language models act on the world.
Currently Founding Engineer at a stealth AI startup and Applied AI Researcher at Shankyaa, working on cryptographic agent security, prompt-injection defence, and high-throughput ML pipelines. Deepening the security side through an M.Sc. in Cybersecurity at BTU Cottbus-Senftenberg.
Before that I spent three years building production data infrastructure, including a year at the Global Legal Entity Identifier Foundation in Frankfurt, where the pipelines I built published reference data consumed by regulated financial institutions. That is where I learned to care about what a system guarantees rather than what it usually does.
Most of my open-source work now goes into the Model Context Protocol ecosystem, finding and fixing attack surfaces in the plumbing LLMs use to talk to the world.
- AI / ML Engineering
- AI Agent Security and Red-Teaming
- Platform, Data and DevOps Engineering
- Research collaboration in AI safety and evaluation
| Award | Event | Work |
|---|---|---|
| 2nd place of 6,000+ entrants | RAISE Summit 2026, Paris (Crusoe track) | Factory Digital Twin with physics-informed neural networks and zero-trust sensor telemetry |
| Finalist | HackXplore Karlsruhe, ZEISS track | Cryptographic EEG / motor BCI, Pedersen commitments and Schnorr ZK proofs, 94% motor-intent accuracy at 250 Hz |
| Finalist | HackXplore Karlsruhe, LBBW track | Legatum, a 9-layer agent swarm turning philanthropic intent into on-chain verifiable impact |
Independent security research on the Model Context Protocol ecosystem and on LLM red-teaming frameworks.
| PR | What it fixes |
|---|---|
| ComposioHQ/composio#3921 | JSON Schema validation gap. An unsatisfiable allOf member now correctly rejects every value instead of silently widening, closing a hole in tool-call parameter validation |
| deepset-ai/haystack#12217 | DocumentJoiner top_k=0. Treated as unset instead of silently returning an empty result set |
| PR | What it fixes |
|---|---|
| NVIDIA/garak#1981 | Homoglyph probes. Tests LLM resistance to visual confusable attacks on tool names |
| modelcontextprotocol/python-sdk#3141 | Unicode homoglyph spoofing. Rejects tool names containing Cyrillic/Greek lookalikes and bidi characters |
| modelcontextprotocol/python-sdk#3175 | OAuth auth-method confusion. Stops sending client_id in the token body under client_secret_basic |
| modelcontextprotocol/inspector#1732 | DNS-rebinding TOCTOU. Pins resolved IPs so the proxy fetch cannot be flipped to instance metadata |
| googleapis/mcp-toolbox#3674 | Slowloris. Adds ReadHeaderTimeout to prevent connection exhaustion on the Go MCP server |
| mark3labs/mcp-go#939 | Panic recovery. Recovers panics in executeRegularToolAsTask under hybrid task mode |
| PR | Context |
|---|---|
| microsoft/PyRIT#2242 | MaliciousToolCallInjection, an indirect prompt-injection strategy for agentic red-teaming. Closed pending a broader unified agent-testing design the maintainers are shaping |
| ModelContextProtocol-Security/mcpserver-audit#4 | Prompt-injection and tool-scope security checks for MCP server auditing |
| 567-labs/instructor#2476 | Builds partial model instances for incomplete list[BaseModel] items during streaming |
pip install mcp-scan
mcp-scan web_search wеb_search # the second one is Cyrillic е (U+0435)A malicious MCP server can register a tool whose name renders identically to a legitimate one in every font, bypassing ASCII allow-lists while routing calls to its own handler. mcp-scan catches bidi control characters, NFKC-detectable homoglyphs, surviving confusables, invisible characters and oversized names.
→ github.com/manjunathbhaskar/mcp-scan
BlackSwanX — Adversarial multi-agent prediction engine, zero API cost
| Stack | Python, Ollama, SQLite, Graph RAG |
| Scale | 179 expert agents + 200 citizen agents per run |
| Design | Elite / citizen / jury tiers, multi-agent debate with corrective feedback loops |
| Novelty | Cognitive Dissonance scoring: finds the widest gap between crowd belief and expert fear |
| Safety | Kill-switch, adversarial "BlackSwan Assassin", stateful self-auditing across runs |
| Privacy | Runs 100% locally, no API keys, no data leaves the machine |
| Repo | BlackSwanXMain |
Most prediction tools tell you what the crowd thinks. BlackSwanX looks for where the crowd is wrong, then stress-tests that thesis with an injector that asks what happens if the assumption collapses.
Factory Digital Twin — RAISE Summit 2026, 2nd of 6,000+ entrants
| Stack | PyTorch, FastAPI, HMAC-SHA256, VLM verification |
| Physical layer | MH-PINN: shared LSTM core with per-phenomenon heads (vibration, thermal, RUL, cure pressure, fatigue) |
| Information layer | PRAETOR: HMAC verification → three-stage triage → cited advisory → Advocate/Skeptic debate → Jury → tooled operator |
| Interface | Frozen cross-layer contract, SignedReading{payload, signature}, tested end to end |
| Data honesty | Every dataset labelled real / simulated / synthetic, down to the message signature. No confidential data used |
| Repo | Crusoe |
An agent that advises a factory operator, where every reading is authenticated, every recommendation is cited, and autonomous action is gated behind verified human intervention.
BrainID — Neural identity, motor BCI and cryptographic memory tagging
| Stack | CEEMDAN denoising, CatBoost, Pedersen commitments, Schnorr ZKP |
| Hardware | Unicorn Hybrid Black, 8 channels, 250 Hz |
| Motor BCI | Predicts a keypress before the finger moves: 94% accuracy, 100% precision |
| Identity vault | Authenticates from a brainwave fingerprint with 0 bytes of brain data stored on any server |
| Repo | braind-eeg |
Your face can be photographed and your voice cloned. Brainwaves originate inside the skull and cannot be replayed from a static recording. Even if the auth database is stolen, it contains only a commitment indistinguishable from a random number.
Legatum — Intelligence-first philanthropic banking
| Stack | TypeScript, agent orchestration, on-chain verification |
| Design | 9-layer AI agent swarm |
| Goal | Turning philanthropic intent into on-chain verifiable impact |
| Repo | Legatum |
Viscosity — The VC brain: sourcing, screening, diligence, decision
| Stack | TypeScript, LLM agents, persistent memory layer |
| Design | Cold-start founder scoring, unaveraged three-axis scoring, per-claim Trust Score |
| Why it matters | Averaging scores destroys the signal. Viscosity keeps the axes separate and traces every claim |
| Repo | Viscosity |
Solar Energy Forecasting — M.Sc. thesis, grade 1.8
| Stack | CEEMDAN, temporal convolutional networks, CatBoost |
| Result | 25% improvement in forecast accuracy over baselines |
| Repo | Developing-an-Advanced-Forecasting-Model-for-Solar-Energy-Predictions |
Hybrid architecture: decompose the signal, model the temporal structure, boost the residuals.
Languages and ML
Data and Infrastructure
Security and agents
MCP · Prompt-injection defence · Ed25519 · HMAC · Pedersen commitments · Schnorr ZKP · Zero-trust architecture · garak · PyRIT · Ollama · Graph RAG · LangFuse
Founding Engineer · Stealth AI Startup, Fulda
Agentic memory Cryptographic agent control Evaluation frameworks Async Python
Applied AI Researcher · Shankyaa, Germany
Media integrity Privacy-preserving biometrics High-throughput pipelines
Data Engineer, Cloud Security & Automation · GLEIF, Frankfurt am Main
Python ELT Data quality gates in CI/CD Regulated financial data
Data Engineer, DevSecOps & Cloud · Torry Harris Business Solutions, India
Terraform IAM/SSO as code dbt + BigQuery at 10 TB+/month
-0078D4?style=for-the-badge&logo=microsoft){kind=icon}
-0078D4?style=for-the-badge&logo=microsoftazure){kind=icon}
Researching:
- AI agent security and the MCP attack surface
- Adversarial evaluation of agentic systems
- Alignment drift in agents with persistent memory
Building:
- mcp-scan and upstream hardening for MCP
- Local-first multi-agent systems (zero API cost)
- Evaluation and gating frameworks
Reading:
- Interpretability and faithful explanation
- Continual and lifelong learning
Open_To:
- AI / ML engineering
- Agent security and red-teaming
- Research collaboration