ringbuf-signal
rough / proves the point
PoC for the eBPF ring-buffer side channel above. ~a few bits/sec between two unprivileged processes.
Anmol Singh Yadav · Platform Security EngineerIamLucif3r · Independent security research
Istudywheresystemsbreak.
Offtheclock,stillreadingsource.
I work at the layer most people forget exists — right up until it’s the reason something broke.The day job has change control. This is where I just try things.
My work sits underneath the parts most teams look at directly: the kernel, the container boundary, the model’s execution sandbox. I study how those layers fail, then design controls that make failure hard to reach, hard to hide, and expensive to exploit.This is where the after-hours stuff lives — CTF labs, half-built tools, and bugs I couldn't leave alone. Mostly notes to future me.
Platform SecurityCloud & Container SecurityeBPF & Runtime VisibilityLLM & AI Security
Receipts, not adjectivesPinned evidence
Platform Security
Runtime hardening and trust-boundary enforcement for production systems.
Cloud & Container Security
Kubernetes and container isolation, assessed and hardened at scale.
eBPF & Runtime Visibility
Kernel-level detection for privilege escalation and anomalous behavior.
LLM & AI Security
Execution isolation and guardrails for agentic and LLM-driven systems.
Conference Speaking
Talks on API and platform security for practitioner audiences.
The rest is filed under NDA. These are the parts I can actually show you.
CapabilitiesMethods
Six problems. One recurring question: what shouldn’t be reachable?Six recurring questions, kept on the desk until the boundary becomes visible.
Platform and Runtime Security
Hardening the layer applications run on top of — so a compromised process has as little to reach as possible.
Trust-boundary enforcementRuntime hardeningAttack-surface reductionIsolation-first design
Selected workLaboratory
A few things that survived contact with production.A few investigations that stayed interesting after the first answer.
The one I still actively maintainA feed I keep returning to
pwnspectrum
Threat intelligence that ranks what actually matters.
A cybersecurity intelligence and prioritization system. It aggregates public threat feeds, ranks disclosures by real-world impact, and generates contextual summaries so the signal doesn’t drown in volume.
Most feeds hand you everything and call it intelligence. pwnspectrum combines feed aggregation, ranking, and contextual summarization so practitioners can act on what matters instead of triaging noise.
Threat IntelligenceLLM SummarizationRSS AggregationRanking
feed.anmolsinghyadav.com
FaviCreep
Offensive reconnaissance for shadow assets and exposed infrastructure.
GoReconnaissanceAttack Surface Mapping
View on GitHubAWS Key Hunter
Secret exposure detection and monitoring at scale.
GoSecret DetectionCloud Security
View on GitHubWritingJournal
A few pieces I’d still stand behind.Field notes from problems that needed a slower read.
Picked because I don’t wince rereading them.Less announcement, more margin note.
SpeakingNotes
One talk so far. I’m told it went fine.Ideas that escaped the notebook and had to stand in a room.
GRIMMCon
API Security in the Real World
A practitioner walk-through of how trust boundaries actually fail in API-driven systems — real vulnerability patterns, not theoretical ones.
AboutIdentity
What I actually do, in plain terms.The same person, after the formal system diagram is closed.
I’m a Platform Security Engineer. In practice, that means Linux, containers, and Kubernetes — and lately, figuring out what happens when you let an LLM run commands on your behalf.
Most of my work is about boundaries: what a process can reach, what a container can escape, what an agent can actually do versus what its prompt says it can do. eBPF and runtime tracing are usually how I find out the honest answer is “more than expected.”
I write in plain language on purpose. Security writing has a bad habit of sounding impressive instead of being useful, and I’d rather be the second one.
This page is the highlight reel. For the reasoning behind it, the writing section is a better use of your time than my LinkedIn headline.
TryHackMe — Top 1% (0xD)DEF CON 9111 — Safe Mode volunteer
Notes to self
Research notes.
AI Security · Jul 28, 2026
Sandboxing an LLM agent — what "allow-list" actually means at runtime
Every agent framework ships a config that reads like a security control: allowed_tools: [read_file, search, send_email]. It looks like an allow-list. It is not one — it's a suggestion, enforced by whether the model feels like following it that day.
Where the gap actually is
- The allow-list lives in the prompt or the framework's Python layer, not in the process boundary.
- If the agent can shell out, read arbitrary paths, or hit an unrestricted network, the "allow-list" is cosmetic the moment a clever prompt (or a poisoned tool response) convinces the model to ignore it.
- Logging what the agent said it did is not the same as logging what the process did.
What I'm actually testing
Wrapping agent execution in the same primitives I'd use for any untrusted workload: a restricted filesystem view, an explicit egress allow-list enforced at the network layer (not the prompt layer), and syscall-level tracing so "the agent read /etc/passwd" shows up regardless of what the transcript claims happened.
Early read: the honest allow-list is enforced by the kernel, not the system prompt. Everything else is a nice comment.
Junk drawer
Small scripts I wrote at 2 a.m. and never bothered to clean up.
agent-fence
works on my machine
A tiny harness that logs every syscall an LLM agent actually makes, so I can compare it to what its prompt promised.
clockskew-repro
unfinished
Scratch script trying to reproduce the container CLOCK_MONOTONIC drift note reliably. Not there yet.
ContactSignal
Let’s talk about the parts that break.Ping me — I usually respond.
Open to conversations on platform security, container and runtime isolation, eBPF, and AI security — as research, as talks, or as work.Open to thoughtful conversations on platform security, runtime boundaries, eBPF, AI agents, or half-formed questions that are ready to become real work.