Agentic AI Security  ·  Authorization Boundaries  ·  Attack Surface Management  ·  Service Mesh Security  ·  ML Runtime Security  ·  Coordinated Vulnerability Disclosure

AI incident manager, cybersecurity practitioner, independent vulnerability researcher, and open-source security tooling contributor.

Current research centers on trust boundaries in multi-agent AI systems; how autonomous agents, service identities, and humans are distinguished (or fail to be distinguished) by the authorization models that gate consequential actions.

Founder of NetGuard 24/7 LLC  ·  coordinated disclosure, cybersecurity tooling, threat intelligence.

Upstream remediations where I authored or co-authored the patch, the advisory, or both.

Featured: Google ADK human-in-the-loop bypass over A2A. Identified and authored the fix for a trust-boundary failure in Google's Agent Development Kit, where a tool confirmation arriving over the Agent-to-Agent protocol could satisfy the human-approval gate gating confirmation-protected tools. The confirmation check keyed on the protocol message role (role="user") rather than on message provenance, so a remote agent could effectively self-approve actions that were designed to require a person. Reported through Google's VRP; public issue #6461, fix merged to main as 9e9eaa6. The patch rejects A2A-originated tool confirmations so machine provenance is preserved across the boundary. That first fix was reverted on Aug 20, 2026 (9a32eba) after it blocked legitimate confirmations; the successor, PR #7134, replaces the channel heuristic with a CallerPrincipal carried on the invocation context: the serving layer records whether it authenticated the caller, and the confirmation processor refuses an approval that lacks verified human provenance, with strict mode behind the feature registry. It is rebased on current main and in review, tracked in #7569; PR #7572 extends the same principal to the ADK API server's /run and /run_sse routes, where a deployment's own authentication can record the caller and an unauthenticated request can no longer stand in for the operator.

Protocol role ≠ security principal ≠ human authority. As agentic systems mature, authorization models have to treat autonomous agents as distinct actors and read the absence of verified human provenance as denial, not consent.

Featured: Envoy jwt_authn confused-deputy fix. Authored the fix for an authorization-boundary failure in Envoy's JWT filter where extract_only_without_validation paired with claim_to_headers produced HTTP headers indistinguishable from cryptographically validated ones, letting a forged alg:none token satisfy downstream RBAC. Reported through Envoy's private security advisory process (GHSA-gr4r-79wp-5w3x, reporter credit accepted); the public PR added a verification_status_header field with runtime-guarded staged rollout. Merged into main on May 4, 2026 as commit 6d005fe.

Featured: Envoy geoip header sanitization. The HTTP geoip filter wrote a geolocation header only when the provider had a value for it and never removed one, so a client-supplied x-geo-country or x-geo-anon-vpn reached the upstream unchanged whenever the lookup had nothing to say: an address absent from the database, a lookup error, or a request whose lookup was skipped. Downstream RBAC, ext_authz or application logic could not tell such a header from one Envoy set. The fix adds an additive Driver::geoHeaderNames() to the provider interface, has the MaxMind provider report its configured keys, and removes them at the start of decodeHeaders before any path that returns without a lookup, behind envoy.reloadable_features.geoip_sanitize_geo_headers. Public issue #48362; merged into main on Oct 16, 2026 as commit 4a0a639.

Active coordinated-disclosure patches submitted upstream to Google and OSS projects. States current as of October 2026.

Additional memory-safety and path-traversal disclosures in TensorFlow, LiteRT, and MediaPipe are under vendor review.