Independent security research
I investigate how AI agents cross trust boundaries when untrusted content meets connected tools. My work focuses on reproducible authorization failures, persistent state changes, and evidence that survives skeptical review.
01 / Selected work
These projects examine behavior observed in researcher-controlled accounts. Public summaries intentionally omit operational payloads and private vendor correspondence while disclosure remains active.
Two-account testing examined whether attacker-controlled Google Keep content could shape Gemini tool use and produce persistent, victim-attributed note mutations. Evidence combined screen capture, native Keep state, Activity records, and network traces.
Read the public research note →Unique canary URLs distinguish creation-time rendering from later agent retrieval. A controlled run recorded repeated Google PageRenderer requests with per-request Cloudflare identifiers.
Read the methodology →Burp captures, Google Takeout artifacts, activity trails, version history, video, and webhook events are aligned into a single chronology. Hash manifests preserve the relationship between reviewer-facing clips and source recordings.
02 / Recognition
Recognition belongs on a research portfolio when the wording matches the vendor’s record. This entry distinguishes an offer from a bounty, CVE, or published award.
Microsoft Security Response Center
Microsoft offered Special Mentions recognition in connection with a submitted security report. The recognition is separate from a bounty or CVE, and the underlying technical details remain confidential.
Disclosure boundary: the underlying technical details remain confidential. Microsoft’s term is “Special Mentions”; this site does not claim a bounty or CVE.
Microsoft Researcher Recognition Program →03 / About the work
Shultis Labs is an independent security-research project focused on AI-agent authorization, indirect prompt injection, and evidence engineering. Testing uses controlled accounts, synthetic data, explicit pre-state capture, and coordinated disclosure.
03 / Research notes
Detailed exploit material stays private during coordinated disclosure. These notes publish the experimental reasoning, controls, and evidence practices that can be discussed safely.
04 / Method
A useful reproduction separates retrieval, rendering, instruction consumption, and native action. Each layer gets its own control and its own timestamp.
Researcher-owned accounts, fictional records, unique markers, and one deliberately limited action.
Record permissions, content, ownership, clocks, and clean logs before introducing the trigger.
An HTTP callback proves a request. Native state and Activity prove a Workspace mutation.
Hash source artifacts, document transformations, and keep claims narrower than the available evidence.
05 / Capabilities
My work combines application-security testing with the less glamorous part that often decides a report: clean experimental design and understandable evidence.
TESTINGIndirect prompt injection, cross-service tool use, identity and authorization boundaries, persistent mutations, and browser-assisted workflows.
EVIDENCEHTTP capture, JSONL telemetry, native product history, Takeout exports, timeline reconciliation, video indexing, and integrity manifests.
06 / Contact
I’m interested in junior security research, product security, AI red teaming, and application-security roles where persistence and evidence quality matter.