I’m Josh. I work in AI security. Before that it was cloud security: FedRAMP, continuous monitoring, and the governance side, with years of contract work for Fortune 500 companies and U.S. Intelligence Community programs. Some of that work put me on the attacking side, with sign-off: talking my way past people’s defenses. That’s why the cons that fool an AI agent look familiar to me. They’re the same ones that have always worked on people.
Before that I was in the Army as a cryptologic linguist, trained in Arabic, working intelligence in rooms that ran from the field up to the White House. The subject keeps changing. The skill underneath doesn’t: take a pile of messy information and turn it into something the person who has to decide can actually use.
Nobody has AI agent security figured out yet. So I test instead of guess. I build the agents myself, hand them real tools and real access, and see how they break. When a finding is mine, you get the setup, the runs, and the mistakes. When the good work is someone else’s, I say so and point you to them. When a result stops being reliable, I tell you where.
If you lead security somewhere and you’re weighing an AI agent decision, get in touch. That’s a good use of my time.