Offensive security research
Offensive research, made legible.
I run offensive security research at Redlings — red teaming, EDR evasion, malware development. I break the controls you rely on, then show you exactly how, so you can see what your defenses miss.
Working thesis — placeholder copy, not final.
Selected writing
-
Targeted Promptware: hijacking Gemini for Workspace with a calendar invite
A calendar invitation with an indirect prompt injection is all it takes to hijack Gemini’s agents — exfiltrating email, controlling smart home devices, launching video surveillance, and self-propagating…
-
Trust, not filters: securing agentic AI systems
Guardrails are statistical filters, not security boundaries. On every engagement I have run, the attacker walked around them. Real agentic security comes from architecture — trust splitting, isolation,…
-
Agentic IDEs: hidden instructions in Cursor Rules
AI-powered editors follow project-wide ‘rules’ and read every file as context. Hidden Unicode instructions in rule files and code comments can steer the agent into running arbitrary commands…
Day to day I lead Redlings, a penetration testing firm in Mannheim. This site is the research notebook behind that work — not a sales page. If you need an engagement, that’s a different door.