Portfolio · Senior Software Engineer & AI Architect
Fourteen years in software engineering, three owning AI platforms end to end.
Below is my lab. Autonomous attack agents reason about an AI agent, chain attacks against it, and come back with the payload that got through and the response that proves it. I keep building it because reading about how agents fail is not the same as watching one fail.
My core is agentic AI on Microsoft AI Foundry: Entra agent identities, APIM, the governance around them. Google's stack is the second one I build in, with attack agents driving Gemini through ADK Go. A security argument that only holds on one vendor's stack is not much of an argument.
Pharma, medtech, industrial automation and building technology. I cover the whole path myself: discovery with directors and product owners, a reference architecture teams can agree on, the platform underneath, the agents on top, and the compliance evidence at the end. At Johnson Controls I owned that architecture for a production agent platform used by four product teams. At Danone I set the enterprise standard every chatbot, RAG pipeline and copilot had to meet. At Codit I built and led the team behind a pharma IoT platform.
Every agent gets its own identity before anyone writes a prompt.
All model and tool traffic goes through a single place that can log, limit and block.
Agents and integrations sit on that platform, not beside it.
Red-teaming and quality evaluations gate the release. They are not a post-mortem.
The evidence an auditor asks for is produced by the architecture, not written afterwards.
Two open-source tracks that reinforce each other: a complete off-grid LoRa mesh stack — from an 87-byte Ed25519-signed alert frame (sigillo) to an LVGL 9 handheld UI & Linux desktop console (sixi-tdeck-plus) and an SDR/LoRa telemetry bridge (sixi-observer) — and a measured AI agent red-teaming suite. The code is on my profile at github.com/radek-sixi.
signed alert protocol · C99 · Python · TS
A compact signed frame for public alerts over low-bandwidth packet radio (v1.0-rc). A 7-byte header, the 16-byte EU Common Alert Message Format (Galileo CAMF) content block, optional TLV extensions, and an Ed25519 signature fit in an 87-byte base frame that any receiver can verify offline with bit-exact verdicts across implementations.
handheld UI & desktop console · LVGL 9
Clean-room open-source (Apache-2.0) LVGL 9 touch-first handheld UI and Ubuntu Linux desktop companion console for MeshCore on the LilyGo T-Deck Plus, T-Beam S3 Supreme (Wi-Fi/BLE/USB), and Heltec V3. Built to pair with MeshCore and signed field broadcasts into a complete handheld-to-desktop off-grid station.
LoRa & RTL-SDR bridge · Python
Open-source (MIT) observer bridge for MeshCore / LoRa radios (LilyGO T-Beam Supreme SX1262, Heltec V3/V4, RAK4631) and RTL-SDR V4: local Ed25519 cryptographic ADVERT signature verification, multi-hop SNR/RSSI packet telemetry, ML Bayesian ghost-hop repeater triangulation, and a 0 ms local WebSocket stream.
upstream packet-radio mesh
I work on MeshCore, the lightweight hybrid-routing mesh protocol for packet radios. My pull requests there add dynamic Wi-Fi for the LilyGO T-Beam Supreme SX1262 and fix the unsigned conversion of negative TX power in the radio preferences.
red-team scanner · Go
An open-source command-line red-team scanner for LLM agents: 27 single- and multi-turn techniques, one Go binary, zero dependencies, no LLM inside by default. 1st on precision (0.821) and recall (0.571) on the public benchmark, and 1.000 precision on multi-turn sessions. Reports as JSON, SARIF or Markdown.
benchmark
Seven red-teaming tools — garak, promptfoo, DeepTeam, PyRIT, the Azure AI Red Teaming Agent and others — against one real Microsoft Foundry agent. Scored from the wire by deterministic oracles and a tool-blind judge. Raw findings published.
local LLM judge · Python
Local LLM-as-a-judge with typed verdicts in milliseconds: deterministic oracles for business rules first, a model only when unsure.
evaluation arena
An evaluation arena for AI agents whose referee runs no model. Deterministic adversarial scenarios, hash-committed replays, SARIF reports.
transport library · Go
Reach an AI agent over REST, MCP, A2A, WebSocket or a browser chat widget through one Go interface. SSRF-guarded, standard library first. Upstream A2ATarget also merged into Microsoft PyRIT.
GitHub Action · CI gate
Run sixi-scanner in GitHub Actions with SARIF findings in the Security tab, gated on severity. An unreachable target fails, never passes.
hands-on labs
Hands-on AI agent red-teaming and security engineering labs, paired with adk-demo-target, a deliberately vulnerable bank agent.
edge AI
An AI assistant grounded in live OT telemetry, and you are invited to attack it. Two bioreactor lines run on two NVIDIA Jetson edge nodes.
I am a systems and embedded engineer by origin. The first ten years were C/C++ on microcontrollers and Linux, secure military communications, TLS/PKI for industrial control systems, medical HMI software and rugged edge video devices. Then I moved up the stack: a pharma IoT platform on MQTT and Azure IoT Hub, and the architecture of an agentic AI platform grounded in live device telemetry at Johnson Controls.
Now I am bringing it back to the hardware, in my own lab: STM32, ESP32, Raspberry Pi, LoRaWAN and mesh nodes, and AI inference on NVIDIA Jetson. What I offer is the whole path, firmware to gateway to cloud to on-device AI, with security designed in.
Right now that means a complete open-source off-grid LoRa & MeshCore stack: sigillo (an 87-byte Ed25519-signed EU CAMF alert frame in C99, Python and TypeScript), Faro (sixi-tdeck-plus) on the LilyGo T-Deck Plus, T-Beam S3 Supreme and Linux desktop, sixi-observer with RTL-SDR V4, and upstream MeshCore firmware.
The mistake I keep finding in my own code: an attempt that errored on the way out counted as the target holding. A dead endpoint scored a clean report. Every number I publish separates what landed from what was sent.
A judge that concludes a break because it saw no refusal is a screen, not a judge. Those verdicts are marked provisional and never become findings on their own.
A tool that finds real weaknesses and a tool that invents them look identical against a single breakable agent. The control is not a second demo, it is the experiment.
The engine used to take the agent's protocol from whatever the operator typed in a config. It now probes for what actually answers, and an interface it could not reach is unknown, never closed.