Prateek Pulastya
- PR #54OWASP GenAI Red Team LabEmbedding inversion exploit, merged August 2026. The work I’m most proud of.
- 0.79GuardRailMy open-source prompt-injection filter. Held-out recall, after 1.00 on my own data.
- 9.9smolagents sandbox escapeCVSS 9.9 on the huntr report. Arbitrary command execution on the host.
- #1Intigriti quarterly leaderboardPlus a Top 10 Bug Baron placing.
- 42.9%ATSGuardFinds hidden instructions in résumés. Recall on 28 fresh cases.
- 7 to 0SecureFixSAST findings on my own app, before and after fixes.
GuardRail scored 0.79 held out
My first thought was that I’d done something wrong. The held-out score came in behind my own data. But it wasn’t that bad, so I was proud of myself as well.
0.7895 Tier 1 recall, held-out split
Tier 1 recall 0.7895, held-out split
| Evaluation | Tier 1 recall | False positives |
|---|---|---|
| My own corpus (in-sample) | 1.000 | 0.000 |
| Held-out split, rules fitted on the training half | 0.7895 | 0.000 |
| Open-Prompt-Injection | 1.000 | 0.006 |
| BIPIA | 0.480 | 0.017 |
| NotInject (benign only) | none | 0.000 |
Try to get past it
A 25-rule sample of GuardRail’s Tier 1, in your browser. Nothing is sent anywhere.
Why Tier 2 only monitorsIt over-blocks, so it logs instead.
The classifier blocks 40.4% of benign NotInject prompts against Tier 1’s 0.0%, and no threshold separates them. It logs TIER2-FLAG and doesn’t block, so recall is lower. Blocking is available at POST /validate?tier=2.
How Tier 1 scansTwo passes, then Tier 2 fails open.
Normalized text first, keeping | _ - so markers like <|im_start|> still match. Then a de-leeted, separator-stripped pass, which catches 1gn0r3 prev10us 1nstruct10ns. If Tier 2 errors, the request is allowed.
Latency p50 0.14 ms, p95 26.21 ms, p99 32.11 ms on local docker compose and CPU. Tier 1 alone p50 0.09 ms.
The held-out rules were written after I had seen the full corpus, so the refit isn’t perfectly blind. That bias is optimistic, so read 0.7895 as an upper bound.
Against Llama-Guard-3-8BLlama Guard missed 165 of 190. Its taxonomy doesn’t cover injection.
GuardRail, in-sample: recall 1.0000, precision 1.0000, p50 0.16 ms. Llama Guard: recall 0.1316, precision 1.0000, p50 1708 ms on local Ollama and a GTX 1650. Not a fair win, because its S1 to S13 taxonomy doesn’t cover prompt injection.
The rest of the work
AI Red-Team WorkbenchOpen-source scanner for LLM apps.
Runs an OWASP LLM Top 10 attack pack, 30 trials per attack, with hash-chained evidence. Pre-alpha, tested against a mock so far.
42.9% recallATSGuardHidden instructions in résumés, on 28 cases I wrote myself.
0% false positives on 1,200 synthetic résumés. 98.8% in-sample recall on 80 disguised attacks. 42.9% on 28 separate cases I wrote myself.
4 pathsCloudFractureAttacks on a deliberately vulnerable AWS LLM agent, each with a Sigma detection.
A deliberately vulnerable workload, built in Terraform. 4 identity attack paths, from the agent’s execution role to data exfiltration and prompt-store poisoning. A tested Sigma detection for each, IAM fixed to least privilege, attacks re-run and failing. CI runs SAST, SCA, secret and IaC scanning and builds an SBOM.
7/10 firedDetectForgeATT&CK techniques in a Wazuh and Sysmon SOC lab.
7 of 10 ATT&CK techniques fired on live detonation. Each detection has its false-positive profile written down. Gaps listed: T1003.001, T1055, T1021.001.
6 bugsSecureFixPlanted in my own app, with exploits, fixes, Semgrep rules and CI gates.
I built a small app and planted six bugs: SQLi, IDOR, SSRF, XSS, JWT signature bypass, prototype pollution. Each has a working exploit, a fix, a hand-written Semgrep rule and a CI gate. The SAST gate goes from 7 findings to 0.
6 classesExplainable threat detectionIntrusion detection on CICIDS2017, with SHAP on every alert.
CICIDS2017, 6 attack classes, a SHAP attribution on every alert.
4 layersSecure MQTT pipelineTLS, mTLS, HMAC and replay defense on hotel water monitoring.
STRIDE first, then TLS, mTLS, HMAC-SHA256 and replay defense, each tested with attack simulations. TLS adds under 1 ms, mTLS adds 2.1 ms per connection. Top 10% of the externship.
4 guidesSecurity Compliance AcademyFramework guides, plus a cited control crosswalk in progress.
200+ pagesMortgage document intelligenceOCR and LlamaIndex RAG.
Tesseract, PaddleOCR, PyMuPDF, LlamaIndex RAG with Mistral and Phi-2. Compared OCR accuracy, retrieval quality and routing.
Findings, including the duplicates
#1 on the Intigriti quarterly leaderboard.
CVSS 9.9Sandbox escape in smolagents (CWE-94)Disclosed via huntr
A code-injection flaw in the agent sandbox let arbitrary commands run on the host. Disclosed to the maintainers through huntr.
HighPath-traversal bypass in Aikido firewall-javaVia Intigriti
A payload that got past the firewall’s path-traversal detection and still worked as a traversal.
CriticalCORS origin reflection to account takeoverClosed: duplicate (valid)
A REST API reflected any Origin while returning Access-Control-Allow-Credentials: true. The session cookie was scoped to the root domain without HttpOnly. One visit to a malicious page pulled profile data, API keys and marketing contact databases as the logged-in user. Fix: a server-side origin allowlist at the gateway, plus HttpOnly.
CriticalUnauthenticated GraphQL user enumeration, 57M recordsClosed: duplicate (confirmed valid)
Introspection was off, but validation errors exposed a Relay-style users connection with unauthenticated cursor pagination, no rate limit and no depth cap. totalCount returned 57,316,627, confirmed live by a delta of 209,852 accounts over eight days. A full export was reachable in roughly 32 hours at 10 req/s.
HighUnrestricted Google Maps API keys in page sourceTriaged duplicate, P4
Two keys hardcoded in served HTML and a webpack bundle, with no referrer, IP or API restriction. A controlled 50-request test returned 50/50 OK with no throttling, roughly $121/hour of billable abuse from one workstation. CWE-798, OWASP API4:2023.
InformativeDangling Route53 delegation to subdomain takeoverClosed: theoretical exploitability
Certificate transparency showed a staging subdomain with live NS delegation into an abandoned Route53 zone (SOA serial=1). Deleted zones’ nameservers return to a shared pool, so any AWS account could reclaim authority, and the session cookie was root-scoped. Of 11 NXDOMAIN candidates checked with passive DNS and Wayback CDX, one was still delegated.
How I got here
I ended up in event security through a part-time job during my MSc in cyber security in Ireland. Then I was searching for full-time jobs, and I had bills and rent to pay. That’s how I ended up in security.
Nov 2026VolunteerNullcon Berlin
- Supported registration, workshop and technical-track operations at an international security conference.
- Introduced workshop speakers and managed session logistics and audience Q&A.
Apr 2025 to nowIndependent security researcherBerlin
- I test web apps, APIs, AI/ML libraries and cloud services through private bug bounties and coordinated disclosure.
- Fuzzing with libFuzzer and CI Fuzz, static analysis with Semgrep, and my own Python tooling for recon, validation and log analysis.
Dec 2025 to Feb 2026AI systems and document intelligence externOutamation, remote
- Built extraction, classification and search pipelines over 200+ page mortgage documents.
- Wrote up the model trade-offs and built a demo UI.
Aug 2022 to Mar 2025Event security officerSword Security Group, Dublin
- Access control, crowd management and incident response at 10,000+ capacity venues, over 2.5 years.
Feb 2021 to Jun 2021Security analyst (penetration tester)Kratikal Tech, Delhi
- Enterprise penetration testing for clients including GMR and Nykaa, finding 70+ high-risk vulnerabilities.
- Wrote remediation reports mapped to the OWASP Top 10, with prioritized fixes ahead of production.
- Mapped controls for ISO 27001 and NIST CSF assessments.
2020 to 2021Two student internshipsGurugram Police, Ethical Edufabrica
Jun 2021 to Jul 2021. Student intern, cyber security, Gurugram Police, India.
- Supported live cybercrime investigations with Wireshark and Splunk.
- Helped draft GDPR-aligned data-classification and evidence-handling procedures.
- Ran phishing and social-engineering awareness training for staff.
Aug 2020 to Oct 2020. Cyber security intern, Ethical Edufabrica, India.
- Manual penetration testing with Burp Suite, Nessus and Nmap in simulated environments.
- Worked on ransomware-defense strategies and incident-response playbooks in controlled scenarios.
Skills and certificates
- AI and LLM security
- Prompt-injection detection
- RAG security
- AI red teaming
- OWASP LLM Top 10
- NIST AI RMF
- Guardrail architecture
- MCP security
- Adversarial evaluation
Everything elseApplication, offensive, cloud and engineering.
- Application and API
- OWASP Top 10, threat modeling (STRIDE), detection-as-code (Semgrep), Burp Suite Pro, secure code review, secure SDLC, API security, CI/CD security gates
- Offensive
- Penetration testing, fuzzing (libFuzzer, CI Fuzz), Semgrep, Bandit, Nmap, Nessus, vulnerability research, CTF
- Cloud, detection and GRC
- AWS (Security Specialty, SAA), Azure, OCI, IAM least privilege, Microsoft Sentinel, Defender for Endpoint, Splunk, Docker, Prometheus, Grafana, ISO 27001, NIST CSF, SOC 2, GDPR
- Engineering
- Python, PowerShell, ONNX Runtime, GitHub Actions, Pytest, LlamaIndex
- AWS Certified Security, SpecialtyAug 2026 to Aug 2029. Validation number 2917b25633b64577b4f24a213ff67c44Verify
- AWS Certified Solutions Architect, AssociateAug 2026 to Aug 2029. Validation number 0130ce1480db446590875575e918000cVerify
- Certified LLM Security Professional (CLLMSP)Red Team Leaders, June 2026Verify
- OCI 2025 Certified AI Foundations AssociateOracle, August 2025, ID 102394776OCI25AICFA
| MSc Artificial Intelligence | Berlin School of Business and Innovation, Oct 2025 to Apr 2027, in progress |
| MSc Cyber Security | National College of Ireland, Jan 2022 to Feb 2023 |
| BTech Information Technology | Panipat Institute of Engineering and Technology, 2017 to 2021 |
Other certificatesFortinet, CNSS, two externships, my thesis.
| Fortinet Certified Associate in Cybersecurity | Fortinet, Oct 2025 to Oct 2027, ID 7813549201PP | Verify |
| Certified Network Security Specialist (CNSS) | ICSI, UK, July 2020 | |
| Top Performer, Hydroficient IoT Cyber Defense Externship | Extern, April 2026, top 10% of participants | |
| Completer, Outamation AI Document Insights Externship | Extern, February 2026 |
MSc Cyber Security thesis: authentication and authorization in cloud services using blockchain.
What I’ve written
Recently pushed
Email me
- prateekpulastya220@gmail.com
- GitHub
- Medium
- Berlin, Germany