Still active duty. 10 years traditional red team, one AI task order in, OSAI underway. Sharing what I learn as I go.
Day job is still traditional red team. Physical and logical, planning and execution. One AI task order through the LLC, OSAI underway. Documenting it now because the crossing is more useful to track in motion than in hindsight.
Most AI security content comes from people who've already crossed. I haven't. Take what's useful.
All views are the author's own and do not represent any current or past employer. Content is published in a personal capacity.
Same kill chain. Different substrate. Traditional red team maps cleanly to AI red team once you know which concept goes where. Living index, built as I go.
A full attack graph mapping every stage from recon to report across RAG, agent, multi-agent, MCP, and model-layer surfaces. Each chain branches into a naive path and a parallel evasion path.
use scroll to zoom — drag to pan — click the controls to reset
Frameworks I actually use, mapped side by side so the gaps show.
What earns a place in the toolkit. No vendor pitches.
Where to actually break things. Self-hosted beats guided every time.
Papers worth reading. Distilled for operators.
For traditional pentesters going AI. Written from the middle, not the other side.
Methodology notes from actual engagements. Technique over name-dropping.
The reflexes transfer. Just not cleanly. First attempt at naming the deltas.
Skipping the changelog summary. What I tried, what worked, what's marketing, and where it still has gaps for engagement-grade probing.
Persistence in classic ops is about staying in. In agentic systems, it's about staying influential. Same instinct, different substrate. Worked example with a vector store.
Distilled for people who have to actually exploit or defend this in the next 30 days, not the next conference cycle.
The writing here is personal. Formal work lives at Crow's Nest, an LLC for offensive security across traditional and AI systems.
crows-nest.tech ↗