Agentic AI Security  ·  Authorization Boundaries  ·  Attack Surface Management  ·  Service Mesh Security  ·  ML Runtime Security  ·  Coordinated Vulnerability Disclosure

Senior cybersecurity practitioner, independent vulnerability researcher, and open-source security tooling contributor.

Current research centers on trust boundaries in multi-agent AI systems; how autonomous agents, service identities, and humans are distinguished (or fail to be distinguished) by the authorization models that gate consequential actions.

Founder of NetGuard 24/7 LLC  ·  coordinated disclosure, cybersecurity tooling, threat intelligence.

Upstream remediations where I authored or co-authored the patch, the advisory, or both.

Featured: Google ADK human-in-the-loop bypass over A2A. Identified and authored the fix for a trust-boundary failure in Google's Agent Development Kit, where a tool confirmation arriving over the Agent-to-Agent protocol could satisfy the human-approval gate gating confirmation-protected tools. The confirmation check keyed on the protocol message role (role="user") rather than on message provenance, so a remote agent could effectively self-approve actions that were designed to require a person. Reported through Google's VRP; public issue #6461, fix merged to main as 9e9eaa6. The patch rejects A2A-originated tool confirmations so machine provenance is preserved across the boundary.

Protocol role ≠ security principal ≠ human authority. As agentic systems mature, authorization models have to treat autonomous agents as distinct actors and read the absence of verified human provenance as denial, not consent.

Featured: Envoy jwt_authn confused-deputy fix. Authored the fix for an authorization-boundary failure in Envoy's JWT filter where extract_only_without_validation paired with claim_to_headers produced HTTP headers indistinguishable from cryptographically validated ones, letting a forged alg:none token satisfy downstream RBAC. Reported through Envoy's private security advisory process (GHSA-gr4r-79wp-5w3x, reporter credit accepted); the public PR added a verification_status_header field with runtime-guarded staged rollout. Merged into main on May 4, 2026 as commit 6d005fe.

Active coordinated-disclosure patches submitted upstream to Google and OSS projects. States current as of August 2026.

Additional memory-safety and path-traversal disclosures in TensorFlow, LiteRT, and MediaPipe are under vendor review.