$ whoami
KuniNogu · AI Security, Vulnerability Research & Detection Engineering
I connect AI security and vulnerability research with enterprise incident response, threat hunting, and detection engineering — from finding and remediation review to operational detection.
Find. Prove. Disclose. Detect.
$ trace --trust-boundary
user ──▶ [ AI agent ]
│ tool_call()
▼
╌╌╌╌╌╌ trust boundary ╌╌╌╌╌╌
│ delegated authz
▼
[ MCP server ] ──▶ tools
│
▼
callback ⇄ webhook
→ 4 seams mapped.
→ 1 confused deputy.
interactive — type `help`
fig.01 — trust boundaries across AI agents, MCP servers & callbacks
Verified public evidence
Every credit links to a primary record from the vendor, maintainer, or coordinator.
06
CVE credits
01
vendor credits
04
AI/MCP credits
$ cat start-here.md
One writeup that shows how I work.
A trust-boundary failure in the Splunk MCP Server app's credential-management path allowed stored data to reach unsafe deserialization, enabling an administrator to execute commands on the underlying operating system.
Read the writeup
$ cat focus.md
The integration layer, not the model weights.
Not the model weights — the seams where an AI app meets existing permissions, data, and external tools.
Trust boundaries between agents, MCP servers, plugins, and the tools they are allowed to invoke.
Callbacks, webhooks, and async tasks that re-enter privileged contexts without re-authorizing.
Authorization-bypass and confused-deputy classes in tool calling and delegated-permission flows.
Every finding is paired with KQL / Sigma / SPL so SOC teams can detect it, not just patch it.
Microsoft Sentinel, KQL hunting, and incident response — the defender's half of the loop.
$ ls research/ | head
A trust-boundary failure in the Splunk MCP Server app's credential-management path allowed stored data to reach unsafe deserialization, enabling an administrator to execute commands on the underlying operating system.
Request-controlled locale values could drive unbounded growth of Apache Struts localized-text caches and exhaust the Java heap when no fixed locale was configured.
Drupal AI Agents tools could load content without sufficiently enforcing the required access checks, demonstrating why agent access, tool access, entity access, and field access must be evaluated separately.
$ cat workflow.md
Map the trust boundaries of an AI integration and probe the seams attackers actually reach.
Build a minimal, safe reproducer that proves impact without shipping a weaponized exploit.
Report to the vendor, coordinate a fix, and confirm remediation before anything goes public.
Translate the root cause into detections and IR guidance the blue team can run in production.