Boris Brodski · Security · since 1998
Security & AI security
Twenty-eight years of asking what still holds when a component is hostile — from DOS viruses in an isolated lab to cryptographic design, reverse engineering, hardened public-sector architectures, and now the security of AI models and the agents built on them.
Degree in security. Diplom-Informatiker at TU Dortmund, focus area Sicherheit und Verifikation, grade 1.5.
Built the primitives. Cryptographic file layer (2001), hardware-bound copy protection (2006), PKI and network security, bytecode encryption for a shipped language.
Thinks like the attacker. Virus lab and antivirus at 18, x86 reverse engineering with OllyDbg, Java bytecode analysis and injection.
Applies it to AI. One-hour public talk on AI security; hands-on analysis of models that phone home; Torhaus, a secure host for untrusted agents.
The thread
It started in 1998 with proof-of-concept DOS viruses written in an isolated lab — to understand infection, stealth and self-modifying code — and the antivirus that caught them. The degree that followed had security and verification as its focus area. The first professional project was a transparent encryption layer for banking software; the next ones were a copy-protection scheme with hardware-bound licences and the bytecode encryption of a scripting language I had designed.
The reverse-engineering side kept pace: assembler-level debugging and x86 disassembly with OllyDbg through the 2000s, Java bytecode analysis and injection from 2010 on. Knowing how a protection is broken is the only reliable way to design one.
Since 2012 that background has been applied at scale: chief architect of a backend component for KONSENS, the software programme of Germany’s tax administrations — where data protection, auditability and dozens of external interfaces are hard constraints, and where a design has to survive a decade of change.
AI security
The same question now applies to models and agents. In 2026 the community documented open-weight models reaching for their vendor’s cloud storage from inside sandboxes, LoRA-tuned models that exfiltrate secrets over DNS on their first turn, and pretraining poisoning that plants remote-code-execution backdoors in coding agents. A reasoning trace is not a security boundary; only deterministic code outside the model is.
That is the premise of my one-hour public talk on AI security, of the hands-on reproduction work on self-hosted models, and of Torhaus — a framework that runs any agent harness in kernel-enforced compartments with default-deny egress, a credential broker and a tamper-evident audit log, and ships a trojaned-model red-team suite that has to fail to exfiltrate in CI.
What I do for clients
- Threat modelling and architecture review for systems that handle sensitive data — including systems that embed LLMs or agents.
- Secure deployment of self-hosted models and agent harnesses: compartmentalisation, egress control, secrets handling, auditability.
- Cryptographic design review, licensing and protection schemes, reverse-engineering assessments.
- Talks and workshops on AI security for engineering teams.
Relevant work
-
Torhaus — a secure host for untrusted AI agents
Secure runtime for AI agents built on the assumption that the model is the attacker. Compartments with data classification, default-deny egress through a single gateway, a broker so credentials never enter the model's environment, honeytokens, and a trojaned-model red-team suite that must fail to exfiltrate in CI.
- Threat model built from the 2026 trojaned-open-weights findings (Cohere/Qwen 3.8, "Model-as-a-Trojan")
- Compartments (Zwinger) with data classification, typed one-way channels (Schleuse), a broker that never lets a credential reach the model
- Egress gateway, MCP/tool proxy and model proxy as the single, policy-checked path out
PythongVisorFirecrackerKubernetesOPAeBPFMCP
-
AI security — talk and research on trojaned open-weight models
One-hour public talk on AI security, and hands-on analysis of the 2026 findings on open-weight models phoning home — reproducing the behaviour locally, reading the research (Model-as-a-Trojan, Back-Reveal, pretraining-poisoning RCE) and deriving the controls that hold when the model cannot be trusted.
Open-weight LLMsllama.cppvLLMagent harnessesegress analysis
-
Copy protection with hardware-bound licences
Designed the cryptography of a commercial copy-protection system — licence format and generator, hardware binding via WMI, time-limited and perpetual licences — and led its implementation. Attack surface analysis was part of the design, not an afterthought.
CC++Crypto++Windows WMI APIOLEVisual Studio
-
Cryptographic layer for transparent access to encrypted files
First professional project, 2001 — a transparent encryption layer for application data. Several ciphers with automatic detection, a stdio-like interface so application code never touches key material, and the audit of the existing cryptographic routines it replaced.
CC++Crypto++Visual Studio
-
KONSENS — backend platform for German tax administration
Eleven years as chief architect in tax administration software — an environment where data protection, auditability and integration with dozens of external systems are hard requirements, not features.
- Architecture and design authority; coaching a team of 15+ engineers
- Text-model-driven development with Xtext at the core of the platform
- Test-driven, with infrastructure as code (Puppet)
Java EEJBoss EAPXtextHibernateSOAPOracle DBEclipse RCPVaadinMavenGradlePuppetTDD
-
DOS virus techniques and a matching antivirus (study project)
Where the security thread starts — proof-of-concept DOS viruses written in an isolated lab to understand infection, stealth and self-modifying code, followed by an antivirus that detected and removed them. Harmless by construction; instructive for life.
x86 assemblerDOS
-
Local AI stack — harnesses, skills and LoRA fine-tuning on own hardware
The lab in which the agent-security work is tested — every harness runs behind egress controls.
LoRAllama.cppvLLMHermes AgentOpenClawClaude CodeKubernetesPodman
-
Redmine plugin suite — development, audit, operation
Security audits of third-party Redmine plugins; anonymisation of production data for non-production environments.
- Plugin for bidirectional data exchange with external systems
- Audit of open-source plugins before deployment
- Containerised operation (Podman), backup and anonymisation pipeline
RubyRuby on RailsRedminePostgreSQLDockerPodmanResticJMeter
-
Catalogue app prototype (Android/iOS)
Mobile/backend prototype with explicit high-security requirements — API design under an OpenAPI contract.
React NativeSymfonyPHPOpenAPI
-
IDScript — a general-purpose scripting language
Bytecode encryption to protect customer-specific business logic shipped with the product.
- Parser, bytecode compiler and virtual machine built from scratch
- Bidirectional C ↔ script bridge and generic OLE automation
- Eclipse RCP IDE and full language documentation
CC++OLEEclipse RCPJavaLaTeXVisual Studio
-
Unix-like real-time operating system (educational)
Protected-mode memory management and privilege levels, learned by implementing them.
x86 assemblerWatcom C386 protected mode
Skills in this direction
Security
- ★★★★★ Security-conscious design 1998–
- ★★★★☆ AI security — trojaned models 2025–
- ★★★★★ Cryptography: ciphers (AES, RSA, DES), Crypto++ 2001–2009
- ★★★★☆ Public-key infrastructure (PKI) 2005–2009
- ★★★★☆ Network security 2005–2008
- ★★★★☆ Reverse engineering: x86 disassembly, OllyDbg, assembler-level debugging 1997–2009
- ★★★★☆ Java bytecode analysis & injection 2010–
- ★★★★☆ Copy protection & licensing 2006–2007
- ★★★★☆ Container hardening: gVisor, Firecracker, seccomp, network policy 2025–
AI & machine learning
- ★★★★☆ LoRA fine-tuning of open-weight LLMs 2025–
- ★★★★☆ Local inference (llama.cpp 2025–
Java
- ★★★☆☆ JAAS / Elytron 2007–2022
Infrastructure
- ★★★★★ Linux (Debian/Ubuntu) 2004–
- ★★★★☆ Docker 2018–
- ★★★★☆ Podman 2022–
- ★★★★☆ Kubernetes 2024–
- ★★★★☆ systemd 2020–
Systems & embedded
- ★★★★★ x86 assembler 1997–2000
Talks & writing
- 2026 AI security — Public talk, 1 hour · Threat models for open-weight models and agent harnesses, and the controls that hold when the model cannot be trusted