knqzx.

about.

i work on cybersecurity and ai safety. most of it is ai control and agent security: finding and fixing the bugs in the software that runs and contains ai agents.

in practice that means reading other people's infrastructure code, from agent sandboxes and mcp servers to kubernetes controllers, and fixing what crashes it, leaks data or lets the wrong people in. the fixes go upstream as pull requests. when a bug is dangerous before it is fixed, the maintainers hear about it privately first, and i write about it only after the fix is released.

by day i'm a software engineer at infineon in villach, and i'm doing a bachelor's at the university of klagenfurt. everything on this site is personal work, done in my own time and not on behalf of infineon.

mostly go and python, also typescript and rust. the numbers show what that adds up to.

record
  • contributorluthien: open-source tools for auditing ai agents. i do security reviews of the luthien proxy as an outside contributor
  • contributordynatrace open source: merged pull requests across koney, dtctl, the kubernetes operator and others
  • 2026supported by a rapid grant from bluedot impact
  • 2026part of anthropic's cyber verification program
  • 20263 reports to the kubernetes bug bounty passed triage, one high
  • advisory, finderGHSA-mh52-c9f9-q9mx in psi scilog, medium: privilege escalation via mongodb update operators in snippet update requests
  • advisory, creditedGHSA-84fg-x5h4-w8xv in zitadel, high: account takeover in login v2 through a forgeable email verification proof
eventsmadecontact