AboutDemir Ata Albuz
About
I'm Demir Ata Albuz, training myself as an AI red teamer and purple teamer: learning to break AI systems while learning how to defend them.
Why this blog exists
In AI security, the best textbook is real incidents. Here I take publicly disclosed AI security incidents and read them from both sides: what the attacker saw, what the defence missed, and what I would have done. Every analysis follows the same six steps and is mapped to the OWASP LLM Top 10 and MITRE ATLAS, so over time the posts become a searchable incident archive.
Analyses rely only on public sources, and every claim is sourced at the end of the post.
My learning path
- TryHackMe: the AI security path and core penetration testing rooms.
- Hack The Box Academy: the Web Penetration Tester path.
- AI red teaming: Lakera Gandalf (levels 1-7 solved), Gray Swan Arena, HackAPrompt.
What I build
In my own lab, with local models (Ollama, LM Studio), I build both offensive and defensive tools:
- Offensive AI Labs: a local red-team harness for agent tool abuse, ML evasion and model-file supply chain experiments.
- Agent Reliability Test Bed: a closed sandbox that measures tool-calling agents against indirect prompt injection, excessive agency (OWASP LLM06) and data leakage scenarios.
- LLM Audit Layer: a FastAPI proxy between user and model that blocks injection attempts and masks Turkish personal data (KVKK).
- TürkBench: a Turkish LLM reliability benchmark; 6 sets, 52 scenarios, rule-based scoring.
How I work
Authorised environments only: my own machine, HTB Academy, TryHackMe. Run the attack, record the result.