Securing LLM pipelines · Architecting offline systems · Building for places where infrastructure doesn't

• 🧠 AI security & applied research — prompt-injection defenses for multi-agent LLM pipelines; offline/edge AI systems.
• 🏗️ Full-stack engineer — architect and ship web + mobile products end-to-end (React/Next.js, Node, Flutter, Python).
• 🏆 2x Hult Prize 1st Runner-Up (2024 & 2025) · Aspire Leaders Global Finalist (Harvard Business School faculty).
• ⚔️ Hackathon veteran — CoESS Cybersecurity Hackathon (offensive security) · NEC Ingegium core architect.
• 🎓 Computer Engineering (final year) @ Nepal Engineering College (NEC).
• 📍 Kathmandu, Nepal — I build for places where connectivity is unreliable.

Real bugs, fixed in real projects — each one links to the evidence. Work still in review is marked as such and linked, so the status is checkable rather than asserted.

Open-source security tooling I built:

• agentbound — cross-language (Python / TypeScript / JavaScript / Go / Java / GitHub Actions) static detector for AI-agent tool-boundary bugs: reserved-name omission, last-wins tool dicts, fail-open confirmation gates, unauthenticated agent CI dispatch. It found the gemini-cli issue above, and it detects the published CVE-2026-44246 vector. Rule severity tracks what the agent may actually call rather than what the job's permissions block grants — the distinction that separates nnU-Net's two hardening commits, whose permissions blocks are identical. Released v0.1.9, and usable as a GitHub Action in three lines of YAML.
• mcp-nameguard — checks the tool names an MCP server advertises against the names agent frameworks put on the wire themselves (cross-server tool shadowing). It reports two grades, because they are different facts: GUARDED names the framework refuses at registration, and UNGUARDED names the framework owns and does not defend. The second is the more useful finding — and the Go and Java ADK frameworks currently have no reserved-name guard at all, so every one of their wire names is unguarded. Grew out of a gap I found and reported in google/adk-python — #7144 / #7145 — and the guards for the Go/Java ports are in review. Released v0.4.6.
• trajectorycheck — trajectory-level evaluator for AI agents: scores tool selection, argument correctness, side effects and cross-run determinism, catching the "looks correct but is broken" failures output-level evals miss. Released v0.1.2.
• agentic-workflow-injection — reproducible vulnerable/fixed fixtures for agentic workflow injection, with detector coverage measured rather than asserted, and a mitigation guide that ranks the controls by whether each depends on the model choosing to comply. Released v1.0.0. Built because there was nothing to test a rule against. The mitigation guide is published at sushant-me.github.io/agentic-workflow-injection. The case study is the one nobody had written down: nnU-Net hardened CVE-2026-44246 in two commits, and the commit titled "hardened issue and PR agents" still left the agent able to comment — so a detector that treats before/after as a binary marks the middle revision fixed. It also shows "fixed in v2.4.1" is not checkable from the tag, which contains no agent workflow at all.

flowchart LR
    A[Next.js Frontend<br/>App Router + NextAuth] -->|REST /api| B[NestJS Backend<br/>JWT + server-side sessions]
    B --> C[(PostgreSQL<br/>Prisma ORM)]
    B --> D[Payment Providers<br/>eSewa · Khalti]
    B --> E[SMS Gateway<br/>Sparrow / Mock]
    B --> F[AI Security Layer<br/>prompt-injection guard]
    A --> G[Flutter Apps<br/>NEC · PU campus]
    F --> B

Edge-Native Semantic Firewall — can a 3.8B model on one laptop act as an autonomous agent's action-verification layer?

I ran 1,800 generations on Phi-3-mini (4-bit, held inside a 4.2 GiB VRAM budget, no cloud calls) across 600 policy scenarios, comparing three ways of asking the model to judge a proposed action: free-form text, JSON-constrained output, and JSON with a mandated Chain-of-Thought field order.

The result inverted the assumption. Constraining the output format without requiring the reasoning step produced the least safe evaluator of the three — that arm approved 46.2% of the actions the policy would have blocked or escalated, worse than unconstrained free-form at 17.2%. Requiring the rule attribution first cut it to 23.5% and lifted hard-denial accuracy from 62.5% to 90.8%.

It still approved 6 of 208 irreversible actions, and it was more permissive than free-form on ambiguous cases that should have reached a human. So the paper concludes a model this size can serve as one layer of a defence-in-depth stack and not a sole control — and we withdrew three earlier claims, including a "100%" headline, that our own measurements falsified.

Every number is checkable: the corpus generator, the harness, all 3,000 recorded generations (1,800 across the three conditions, 600 with a declared action vector, 600 replication), and the paper are in the repo. Reproducing a negative result and publishing it is the part I'd point at.

→ Code · corpus · raw outputs · paper

_{Also in progress, not yet public: EmbodiedOS (offline robotic control with local LLMs) and GhostSignal (ESP32 Wi-Fi CSI sensing for locating movement under rubble). Kept off the list until there's an artifact worth linking.}

• 🧠 AI Intern — Eminence Ways (May 2026 – Aug 2026)
• ⚡ Software Engineer Intern (Tech Lead) — Avatar Tech Solutions (Dec 2025 – Jun 2026)
• 🌍 Fundamentals Program Intern — Nobel Learning PBC, USA (Dec 2025 – Aug 2026)
• 💻 Freelance Full-Stack Developer — Self-employed (Aug 2023 – Present)

• Email: [email protected]
• Open to internships, research collaborations, security consulting, and hackathon teams — if you work on AI safety, offline systems, or Nepal-focused tech, reach out.