Bengaluru, India · he/him
AI Security Researcher & Leader
Hi, I am Clint. I work on AI and security, usually both at the same time. I break things with permission, help fix them, and write about what I learn along the way.
Pushing AI further. Engineering security differently.
01 About
OSCP · CRTO · CHFI · C-AI/MLPen · SC-200
I have spent the last several years getting into systems with permission, then helping the people who own them fix what I found. These days most of my attention goes to AI: how it can make security teams faster, and how it opens up new ways for things to go wrong.
I like clear answers. A lot of security work is noise, so I try to work out what actually matters, explain it plainly, and get it fixed. That is most of the job.
Outside of work I am usually tinkering with a homelab, reading papers I only half understand, or writing up something I learned the hard way.
02 Focus
03 Selected work
A few things I have published or built that show how I think.
Research I did with the Howler Cell team on how a trusted device can be more of an assumption than a fact in Entra ID Conditional Access, and what to tighten so the policy actually holds.
Entra ID Conditional Access; device identity trust assumptions; hardening guidance
A look at how one overlooked certificate authority quietly undermined a Zero Trust setup in Active Directory. The fix is less about new tools and more about looking at the right things.
Active Directory; ungoverned certificate authority; Zero Trust blind spot; defender priorities
A reflected cross-site scripting bug I found in XAMPP 1.7.0 and reported. It got CVE-2019-8920 and a CVSS score of 6.1. Small bug, good lesson in doing disclosure properly.
Reflected XSS; XAMPP 1.7.0; CVE-2019-8920; CVSS 6.1 Medium; NVD listed
How I got a local model from 3 tokens per second to 21 on a modest GPU inside a Proxmox container, with every wrong turn included so you can skip them.
Proxmox LXC; NVIDIA passthrough; MoE model; 3 tok/s to 21 tok/s; full guide
I read the OpenMythos code so you do not have to: the architecture, the training pipeline, and what a locally runnable reasoning model means for people who do security.
Recurrent-depth transformer; architecture + training pipeline; security implications of local reasoning models
04 Experience
Led the offensive security practice and ran exposure-management engagements for enterprise clients. Worked with the Howler Cell research team on identity and cloud access research, some of which is linked below.
Lead offensive security practice; exposure management engagements; Howler Cell research (identity, cloud access)
Security engineering for a telecom group operating across several countries. Mostly application security, web architecture reviews, and data privacy work, all of it remote.
Application security; web architecture review; data privacy; telecom group, multi-country
Started as an intern and stayed on as an analyst. Network and application testing, vulnerability research, and the early days of cyber risk quantification.
Intern then analyst; network and application testing; vulnerability research; cyber risk quantification
From 3 tok/s frustration to 21 tok/s GPU-hybrid inference - a real engineer's guide to self-hosted...
A deep technical dissection of OpenMythos - the community-built Recurrent-Depth Transformer that claims to reverse-engineer Anthropic's Claude Mythos. We crack open the architecture, every novel mechanism, the training pipeline, and the security implications of locally-runnable frontier reasoning models.
07 Contact