I attribute attacks and disrupt adversaries. Now I read the ones that target AI.
Counter-adversary researcher for AI systems. The discipline is attribution: reading how LLM and agent deployments are attacked, and what the method reveals about the actor behind the prompt. Most are mapping the vulnerability. I read the context.
01Attribution is convergence
Attribution was never about a single indicator. It is infrastructure, tradecraft, tooling, and history stacked until the picture is undeniable. AI hands adversaries new tradecraft, and that tradecraft becomes a new axis of the same method.
02Structural beats statistical
Every control on an AI system either decides from a fact the adversary cannot rewrite, or from a classifier it can evade. The first holds when it matters. The second only buys cost and signal, and fails silently when beaten.
I work in AI security, and I approach it the way I approached every adversary before: by reading them. My background is adversary work, years working and leading Counter-adversary Operations teams on nation-state APTs, ransomware crews, and organized threat actors, until the tradecraft and the actor behind it were undeniable. Navy first, then CTI, with a contribution to the Verizon DBIR and support on two CISA #StopRansomware advisories along the way.
The attacks on AI systems, injected instructions, poisoned memory, the rogue prompt, are still early, so most of my work here is theory and hypothesis: running experiments, probing how these systems fail, and asking how you would attribute an attack on a model the way you would on a network. I work through it in the open, because I would rather test ideas in public and help build AI security into a real discipline than wait for the field to settle.
Reach out
CISOs and security leaders, founders and CEOs, thought leaders, podcasters, and fellow practitioners: I am always up for a good rabbit-hole conversation.