Blogs
Long form technical writing on malware analysis, reverse engineering, detection engineering, and GenAI security. Each post reflects independent personal research, independent lab work, and public source analysis.
Published
Why Attackers Don't put AI in Malware
The AI is not in the malware because the payload is the worst place to put it. It is in development, social engineering and vulnerability research.
Are You Actually Using the Model You Selected?
A model picker is not proof of origin. How provenance differs from an AI BOM, and how to record what actually handled a hosted request.
Speak LLM: A Practical Glossary for Better Agent Outcomes
A practical glossary of agent and LLM workflow phrases such as smoke test, blast radius, regression, harness, and negative path, with ready-to-paste prompts.
The Token Problem: KV Cache, Prefill Cost, and Coding Agents
Why a short prompt can still burn a full context window, and how agent harnesses amplify KV cache cost, GPU memory pressure, and usage based pricing.
Prompt Smarter: Leveraging LLM Insights for Enhanced Outcomes
How LLMs process prompts through tokenisation, embeddings, attention, prediction, and sampling, and how that connects to prompt structure, temperature, and agent harnesses.
Token Use Optimizations: How to keep agent sessions fast, cheap, and useful
Agentic tool sessions become expensive when conversation history, file reads, shell output, skills and responses accumulate. Token optimisation tips for agentic CLI work.
Token Economics: Best practices for managing context windows
Claude Code and other agentic CLI tools re-evaluate the full context window on every turn. Techniques for managing context pressure and reducing token waste.
Agent Harnesses, Skills, and Tool Runtimes: The Architecture of Frontier Models
What agent harnesses, skills, MCP servers, and tool runtimes actually do, and why the harness around a frontier model now matters as much as the model itself.
Zero-Day Discovery at Machine Speed and the Defensive Shift Ahead
Anthropic reports frontier LLMs achieving autonomous zero day discovery and exploitation. Defenders need agentic security workflows and memory safe architectures.
Detecting AI Prompt Injection in the Wild
EKFiddle rules and urlscan.io hunting queries for IDPI, AI ClickFix lures, hidden CSS traps, and agent credential exfiltration.
The Evolution of Social Engineering: Weaponizing Web Lures Against Agentic AI
How cybercriminals are adapting SocGholish and ClickFix campaigns to target autonomous AI agents through Indirect Prompt Injection, agent fingerprinting, and the Parallel-Poisoned Web.
Building an MCP Server for Malware Traffic Analysis
How I connected Fiddler traffic capture to an LLM with MCP, then moved execution control into a Python harness.
Cognitive Induction Prompting
Reverse engineering the five step LLM generation pipeline to transform prompting from guesswork into deliberate probability steering.
In Pipeline
From EKFiddle to YARA: Building a Detection Rule Pipeline
The workflow behind converting regex-based web traffic rules into YARA signatures for sandbox deployment.
Coming soonShadow AI on Enterprise Networks: Detection and Hunting
Writing CrowdStrike LogScale and Splunk queries to detect unauthorized LLM usage, AI coding assistants, and GenAI misuse.
Coming soonSupply Chain Attacks: Hash Auditing Across Package Repositories
Building Python tools to perform SHA256 verification across PyPI, npm, GitHub, and HuggingFace during compromise response.
Coming soon