Skip to content
Edictum Labs, home
Research area

AI
security

Agents, inference, and native execution. AI systems now run code, call tools, and reach real files, networks, and services. The security question is what they can do, not what they say.

Propose a collaboration
Targets
Agents · Inference · Runtimes
Focus
Execution & authorization
Location
Europe · Remote
The shift

An AI system that can act is a system that can be made to act.

The risk is not that a model says the wrong thing. It is what the system around it is allowed to do.

Once a model can call tools, run code, or read data, the security question is no longer about language. It is about what the system can do. Hostile input from a user, a retrieved document, or an upstream model becomes an attempt to make it act against real systems.

We study AI systems the way we study any other software that runs with privileges. We ask what they can reach, then show how far hostile input gets.

Targets

Where AI systems expose risk.

The boundaries that matter once inference is wired into tools, data, and infrastructure.
  • AI agents and tool-execution boundaries
  • LLM application and prompt-handling security
  • Inference runtimes and native execution paths
  • Model-serving infrastructure and isolation
  • Authorization between agents, tools, and data
  • Supply chain for models, weights, and extensions
Approach

How we test AI systems.

01

Treat the agent as untrusted

An agent that can call tools acts with real permissions. We measure which files, network hosts, and internal services it can reach when an instruction, a document, or a model output turns hostile.
02

Follow the native code

Inference runs through native libraries, custom kernels, and model-serving stacks. We read the memory handling and trust checks behind the high-level API, because that is where the corruption bugs are.
03

Test the authorization, not the prompt

Prompt injection is a symptom. Impact depends on what the system may do once injected, and on whether tool, data, and identity boundaries hold against hostile input.
04

Separate demo from deployment

A model that behaves in a demo can still expose a real system in production. We test the code that connects inference to the resources it touches, not the model alone.
AI security

Studying agents or inference runtimes?

If you are looking at tool-execution boundaries, the native code behind inference, or authorization between agents and data, we are open to joint research, coordinated disclosure, and shared tooling. Write to the person doing the work.

Open to
Joint research · Disclosure · Tooling
Reply
Direct, from the researcher
Location
Europe · Remote