~/security/ai-red-team ❯

Lucas Mulato · AI Red Teamer

I break AI systems
so defenders can
build better ones.

AI security researcher focused on adversarial attacks against LLMs, autonomous agents, and RAG pipelines. Prompt injection, goal hijacking, memory poisoning — I find the edge cases before attackers do.

View LLM-SECRead findings
LLMs & Agents
Primary surface
Open Source
Toolkit on GitHub
Purple Team
Offense & defense
whoami.sh
~/security/ai-red-team session
~/security/ai-red-team ❯ whoami
lucas_mulato
~/security/ai-red-team ❯ cat focus.txt
▸ AI Red Teaming & LLM Security
▸ Autonomous Agent Attack Chains
▸ Prompt Injection & Goal Hijacking
▸ RAG Poisoning & Memory Attacks
~/security/ai-red-team ❯ echo $STATUS
Available for research & consulting
~/security/ai-red-team❯

About me

Researching the attack surface of intelligent systems

I'm a Brazilian security researcher focused on one of the most under-explored frontiers in offensive security: adversarial attacks against AI systems. While the industry races to deploy LLMs and autonomous agents, I research how they break.

The work sits at the intersection of red teaming and AI safety — prompt injection, goal hijacking in tool-calling agents, poisoning RAG knowledge bases, and how small inputs cascade into catastrophic model behavior.

Before pivoting to AI security I built a foundation in malware analysis, traditional pentesting, and purple team operations. That adversarial mindset now applies directly to AI systems — the attack surface just got more interesting.

Capabilities

What I research & break

AI Red Teaming

Primary

Systematic adversarial testing of LLMs and autonomous agents. Jailbreaks, prompt injections, goal hijacking, and emergent failure modes before deployment.

Prompt Injection · Goal Hijacking · Jailbreaks · Tool Misuse

Agent Security

Attacking multi-step agentic systems — manipulating memory, poisoning tool outputs, and inducing unintended action chains in ReAct and function-calling architectures.

Memory Poisoning · RAG Attacks · Tool Exploitation

Malware Analysis

Static and dynamic analysis of malicious binaries, unpacking, deobfuscation, and behavioral profiling. Reverse engineering with a focus on C/C++ and Python-based threats.

Reverse Engineering · Dynamic Analysis · IDA / Ghidra

Penetration Testing

Web and network penetration testing — identifying and exploiting vulnerabilities across applications, APIs, and infrastructure. From recon to post-exploitation reporting.

Web Apps · APIs · Network

Purple Teaming

Bridging offensive findings with defensive improvements. Translating attack paths into detection rules, response playbooks, and architecture hardening.

ATT&CK · Detection Engineering · MITRE

Featured project

LLM-SEC

All repos →

Most security tools use AI to find bugs in your app. LLM-SEC finds the bugs in your AI. A production-oriented adversarial engine for teams shipping RAG pipelines, agents with tools, and chatbots with memory.

★ FEATURED · Active

We don't test prompts in isolation. We test systems: poisoned embeddings → trusted retrieval → unauthorized action. Failures that never show up on a classic pentest report.

  • LangGraph Attack Engine

    Multi-step, stateful adversarial campaign orchestration

  • Tri-Stage PII Auditor

    Regex → NER → semantic reasoning for reconstructed leakage

  • Vector Guard

    Embedding-space inspection (Weaviate / Pinecone)

  • Agency Auditor

    Critical action path analysis with HITL validation

  • Eval Framework

    DeepEval / Giskard integrations for comparable results

github.com/lucasmulato/LLM-SEC
python -m llmsec campaign \
  --target http://localhost:8000 \
  --config configs/rag_fullstack.yml

# Inspect vector DB
python -m llmsec vector-guard \
  --db weaviate --collection documents

# Audit excessive agency
python -m llmsec agency-audit \
  --spec agent_config.json

Front-end · Security · Live

Alta Cúpula CTF Blog

Team blog for write-up publishing. Custom front-end, dark cyber aesthetic.

View project ↗

Proof of work

Sample findings, not a pitch deck

Independent research notes from LLM-SEC-style campaigns. Each finding is a case file: chain, reproduction, confidence, OWASP LLM mapping, and what a defender should change. Open a ticket below.

Criticalconfidence 91%

Goal hijack via memory store

An indirect payload written into the agent memory store survives across turns, then hijacks the next tool plan. Guardrails that only inspect the latest user message miss the chain.

LLM01 Prompt Injection · LLM06 Excessive Agency
target · Tool-calling agent with persistent memory

  1. Recon: enumerate tools and memory write surface
  2. Inject: plant a goal-override in the memory store
  3. Wait: benign follow-up turn reloads poisoned memory
  4. Exploit: model plans an unauthorized tool call
  5. Impact: high-privilege action without HITL
from llmsec import AgentAttacker

attacker = AgentAttacker(
    target="gpt-4o-tools",
    attack_type="goal_hijack",
)
result = attacker.inject(
    payload=hijack_payload,
    via="memory_store",
)
attacker.report(result)

Defense

  • Treat memory as untrusted input. Re-validate stored context every turn.
  • Gate tool calls on a policy engine, not on the model’s last utterance.
  • Require HITL for irreversible or high-privilege tools.

Career

Experience

  1. 2023 – Present

    AI Security Researcher

    Freelance / Independent

    • Designed and open-sourced LLM-SEC, a LangGraph-based framework for multi-step adversarial testing of agents and RAG systems.
    • Documented attack classes that scanners miss: cross-component chains, reconstructed PII, and excessive-agency bypasses — each with reproduction steps and OWASP LLM mapping.
    • Independent assessments of LLM integrations, with defensive recommendations teams can ship (HITL gates, retrieval redaction, memory isolation).

  2. 2022 – 2023

    IT Support Specialist

    Action Call

    • Tier-1 support and network troubleshooting across multiple ISPs.
    • Built a working foundation in system administration and network diagnostics that still informs how I attack and defend infrastructure.

  3. 2021 – Present

    CTF Competitor

    Alta Cúpula Team

    • Web, reverse engineering, and forensics challenges.
    • Founded the team’s public write-up blog with a custom dark-cyber front end.

Formation

2022

Analysis & Systems Development

UNICV — Distance Learning

2021

Full-Stack Development

Trybe — Online Bootcamp

2019

Computer Networks & Hardware

Technical Course

Ongoing

Self-Directed Security Research

Ethical hacking · AI safety · reverse engineering

Contact

Let's work on AI security together

Red team an AI product, review an LLM integration, or collaborate on adversarial research. Fluent English. Based in São Paulo, Brazil.

LinkedInGitHubX / Twitter

Available for research & consulting