ABOUT / JOSH SHULTIS
Research that can
be checked.
I’m an independent security researcher based in Edmonton, Alberta, Canada. My focus is how agentic AI systems handle untrusted content, connected tools, and authorization boundaries.
What I’m working toward
I’m building a research practice and looking for paid work where careful investigation matters: AI security, product security, application security, and evidence tooling. The technical examples here are a way to inspect my methods directly.
What I bring to a difficult case
Persistence, HTTP and API analysis, Burp Suite traffic inspection, and a habit of asking what an artifact actually proves. I preserve contradictory records and failed tests instead of editing them out of the story.
My engineering work supports that approach: Security RAG for source-linked retrieval, Cipher for deterministic comparisons, and local role-separated review for challenging interpretations.
How I use AI
AI helps with bounded analysis, code, and independent challenge. It does not approve findings. Evaluators check explicit output contracts; original evidence and human review decide what can be claimed. Method scores and corrective feedback do not train model weights.
Explore the engineering →