BIACKR0SE

Jaafer Rahmani · AI Security Researcher

AI red teaming // security engineering

[ 00 // thesis ]

I break models to make them harder to break.

Security engineer and PhD researcher in adversarial machine learning. I work both sides of AI security: red-teaming machine learning and LLM agents, and engineering the ML-driven detection that defends critical infrastructure against attackers who adapt.

IEEE ETFA 2026 IEEE WFCS 2026 ECML PKDD 2026 MDPI Sensors IEEE IDAACS IEEE ICEST CVE-2026-58196 MITRE ATT&CK OWASP

[ 01 // the record ]

10 peer-reviewed papers IEEE / Springer / MDPI, 2025-2026

7 accepted in 2026 alone adversarial ML, LLM agents, OT security

1 CVE in AI-agent infrastructure CVE-2026-58196, fixed upstream

[ 02 // operating domains ]

AI Red Teaming

Adversarial ML and LLM-agent offense. Evasion, model extraction, data poisoning, prompt injection against agent pipelines, and breaking AI-agent infrastructure, proven against the ML that defends live industrial networks.

adversarial-ml / llm-agents / evasion / prompt-injection / cve

Security Engineering

The build side of the same fight. ML-driven SIEM and IDS for critical infrastructure, OT/ICS protocol security across Modbus, CAN, and PROFINET, MITRE ATT&CK mapping, detection hardened against adaptive evasion, fixes disclosed upstream.

siem / ids / ot-ics / att&ck / disclosure

[ 03 // selected work ]

Proof of
damage.

CVE CVE-2026-58196: SSRF in ToolHive Host-side SSRF in an MCP runtime's auth discovery, reaching cloud instance metadata from outside the container sandbox the tool exists to enforce. Full writeup, fixed in v0.31.0. Framework KEYSER Stateful adversarial campaign evaluation against ML-based intrusion detection in industrial automation. To appear at IEEE ETFA 2026. Tool AutoMCP Elastic purple-team MCP server. Extracts security alerts, analyzes them, responds, and runs counter-reconnaissance.

[ 04 // peer-reviewed ]

Peer-reviewed
research.

featured // latest acceptance

When the Analyst Scans for the Attacker

SOC teams are wiring LLM agents into alert triage. This paper asks what the adversary gains. The answer, on a deployed agentic analyst in an OT network: expose one extra alert field to the model, and a crafted alert steers the agent into scanning the live PLC it is meant to protect. Three vulnerabilities in the agentic layer, one matched mitigation each, and the hostile scan drops from 52 of 100 runs to 0 on the patched pipeline.

SHIELD-AI @ ECML PKDD 2026 / Springer CCIS / to appear

When the Analyst Scans for the Attacker: Subverting Agentic LLM Security Operations in OT Networks SHIELD-AI @ ECML PKDD 2026, Springer CCIS to appear

KEYSER: Stateful Adversarial Campaign Evaluation of ML-Based Intrusion Detection in Industrial Automation IEEE ETFA 2026 to appear

Adversarial Robustness Evaluation of a Multi-Layer OT Intrusion Detection System via Automated C2 Red Teaming IEEE ETFA 2026 to appear