Security researcher on AI agents and identity systems, and a software engineer who builds MCP servers and agent tooling. Based in Beirut. US citizen, no sponsorship needed, open to relocating.
- Found and fixed a false SAFE in Microsoft's RAMPART: a safety probe passed while the agent it tested exfiltrated data on every turn, because a tool-only adapter couldn't observe side effects. Merged as a breaking change. Also merged a PyRIT reset hook for realtime and WebSocket targets.
- Reported a prompt-injection gap in github-mcp-server's lockdown mode, fixed in v1.10.0 (writeup).
- Three credited reports to Keycloak: one fixed and shipped in 26.8.2, and my fix for another in review (writeup). A merged overflow fix in netcdf-c.
- Warden runs a Claude agent on IT offboarding under policy, approval, audit and revocation. In an eval on Claude Haiku, Sonnet and Opus 5.5, none of 30 live runs proposed the extra write that an instruction planted in the data asked for.
- controlarm won't record a security test as negative until a positive control has fired in the same run.
- Hack The Box Ambassador in Beirut. I built WeSecure, a boot-to-root machine with a full writeup.
Writeups and resume: mahdi-al-hakim.github.io · mahdi.a.alhakim@gmail.com · LinkedIn