Background

I'm an AI security researcher. My work sits at the seam between offense and detection: red teaming LLMs and agentic systems, and building the runtime monitoring that catches abuse once those systems are live.

I came to it from offensive security. Earlier work included offensive research on industrial control systems and lower-level targets, the kind of work where you learn that a defense is only as good as the one channel its author forgot to check. That instinct carries directly into AI security, where the same lesson keeps reappearing: a filter guards the input it can read and is blind to the one it cannot.

Today most of my time goes to three threads. Red teaming and benchmarking the ways agents get subverted, documented in MCP-Poison-Bench and the two-part writeup on continuous adversaries. Behavioral detection that works from metadata alone, in PARALLAX and KESTREL. And a running log of prompt-injection CTFs, mapping each solve to the guardrail it defeats.

A through-line in all of it: I publish the negative results. A benchmark that shows a defense fails, a detector that scored worse than chance before it was fixed. The honest version is more useful than the impressive one.

You can find the code on GitHub, the résumé here, or reach me at chirag0728@gmail.com.