Offensive security for the swarm.
Independent security researcher — multi-agent & embodied AI.
Founder of MASec Lab: offensive tooling & audit methodology for the layer between agents.
maseclab.com · Blog · x.com/maseclab · Bugcrowd · HTB
-2ea043?style=flat-square){kind=icon}
Offensive security + agentic-AI safety. The industry is racing to test AI models; the riskier surface — how agents coordinate, delegate and act together — goes largely unexamined. I build the methodology and tooling for that layer, and publish it openly.
Single-agent safety doesn't compose. The boundary moved from the model to the protocol traffic between agents — that's where MASec Lab works.
| CyberAI — offensive platform · Apache-2.0 · PyPI | Metadata audit for MCP servers: it reads what a server declares — initialize, instructions, tools, prompts, resources — scores it, and names the risk classes it does not check. It does not call a target's tools. Runtime red-team for LLM agents: injected canaries proven out-of-band via phantom-grid, not inferred from response diffs. Eight specialist agents on a typed, auditable pipeline; Web3 track on Slither with Immunefi severity mapping; prompt-injection guard in front of every provider call; fully air-gapped path on local models. |
| mas-sentry-toolkit — active scanner · AGPL-3.0 · PyPI · Docs | The target is probed, not described. Speaks MCP / A2A / MQTT / AMQP on the wire against live systems instead of reading config off disk: tool drift and rug-pull, elicitation consent, DNS rebinding, A2A card signatures, retained-payload injection, RabbitMQ tracing taps. Deterministic — no model gives the verdict, nothing about the target leaves the host. Protocol clients verified against the reference SDKs (mcp, a2a-sdk). ABFP behavioural fingerprinting, SARIF out, OWASP Agentic Top-10 (ASI01–ASI10). |
pip install cyberai
pip install mas-sentry-toolkit- Delegated, Not Attributed — the first systematic security analysis of A2A: eleven protocol-level flaws. →
- Three Calls to Compromise — a malicious MCP server distributed through 23 GitHub pull requests in 74 minutes. →
- Approved, Not Shown — the screen a human reads before approving an agent's action is rendered from attacker-controlled input. →
- ASI to the AI Act — OWASP ASI01–ASI10 mapped onto EU AI Act Articles 12, 13 and 15. →
- Stateless, Not Traceless — every detection rule that grouped by session ID just lost its primary key. →
- ABFP — Agent Behavioural FingerPrint. Baseline an agent by how it acts across 6 dimensions; surface drift, hijack and impersonation as statistical deviations instead of predefined rules. Shipped in mas-sentry-toolkit; a live baseline is walked through here.
- HCAP — Hierarchical Capability & Attestation Protocol. Prove what an agent may do and where its authority came from, down a delegation chain. N-of-M quorum, confused-deputy detection. Specification.
- ASI mapping — findings mapped to the OWASP Agentic Top 10 (2026) for a shared, recognised taxonomy.
- phantom-grid — free Burp Collaborator alternative: OOB interaction capture (HTTP/HTTPS/DNS), SQLite store + DNS exfil reassembly. Backs CyberAI's out-of-band proofs.
- reality-probe — VLESS/Reality SNI selection under 2026 DPI: freeze-test, ASN/subnet topology scoring, subnet-neighbor discovery.
- phantom-intel — CVE threat-intelligence desktop tool on the NVD API 2.0 (CVSS, exploit assessment, CWE KB, EN/RU).
- OSCP+ track · active on PortSwigger / HackTheBox / TryHackMe
- Bug bounty — Bugcrowd · Intigriti · Immunefi
- Web3 audit stack: Foundry · Slither · Aderyn · Halmos · Echidna
The agentic frontier is shipping faster than anyone is testing it.