Workbench
Some of I built, am building or only sketched. Each card says what state it is really in. Click a filter to sort the pile.
Enable JavaScript to see the chart. The cards below carry the same information.
Placement is my own judgement, not a measurement. The chart redraws itself from the cards.
One stroke per project, counted from the cards below.
A synthetic company web app built as a testbed: do defenses designed against automated, model-driven attackers actually stop autonomous AI agents? The 28-day window opened on 2 October 2026. Nobody took part, so I ended it early. No dataset, one honest write-up to come. A better second round is a maybe.
One public report so far, the Elton RAT analysis. My wider focus is APT tradecraft and detection, centred on the TTPs of Volt Typhoon and Salt Typhoon.
A Manifest V3 browser extension that stops API keys, tokens, private keys and recovery phrases from being pasted into AI chat sites. Fully on-device: no server, and secrets are kept only as local HMAC-SHA-256 fingerprints. Open source, English and Polish UI. Available on the Chrome Web Store.
Proof of concept that hides ChaCha20-Poly1305 encrypted payloads in the least significant bits of ONNX model weights. Research into model files as carriers.
Red team proof-of-concept pipeline with AI decoy layer, wasm sandboxing and an Dead-Drop C2 via ML model update. Released publicly.
Dynamic autonomous training environment for offensive security professionals. A mock-up of a company, presents a living, evolving enterprise populated by AI agents
Architecture for collecting APT intelligence at scale: one configured environment cloned into many Firecracker microVMs, Docker Compose distribution, signed logs and cross-node correlation. T-Pot and DShield are the reference points. Proof of concept first, no live exposure.
Dropped before a dataset existed. The concept was to create a catalog of brand-new Windows internals. Currently, any newly added Windows internals are documented in entirely disparate locations, the primary goal was to first consolidate them into a single repository, and potentially subsequently classify each one using the MITRE framework for the benefit of red teams.
Investigations built like a case file, with a story and an atmosphere instead of a bare puzzle. Verification is still running, so there is nothing to play yet.
A free service I designed and ran: technical help and security education for non-technical people, with a focus on phishing awareness and everyday cyber hygiene.