Hong Kong · Agentic AI × Security
Security engineer building agentic AI systems.
8+ years securing software and financial systems, now focused on building AI agents — and keeping them safe. I write open-source multi-agent platforms, AI coding agents, and LLM security tooling, with 250+ stars on GitHub across a dozen-plus original projects.
CISSP · OSWE · builder of things that pass their own security review
Multi-agent orchestration, agent memory & skills, MCP / A2A integrations — agents that do real work, with guardrails designed in from the start.
LLM threat modelling, prompt-injection defence, guardrail engineering, and securing the pipelines that ship AI into production.
Secure SDLC, code auditing, and offensive security — years of breaking systems in regulated environments, applied to building better ones.
AI-powered SSDLC platform: phase-specialised LLM agents orchestrated with LangGraph cover requirements through operations, with hybrid vector + knowledge-graph RAG, a governance portal for compliance frameworks, and MCP / A2A 1.0 endpoints — human review always required.
Python · FastAPI · LangGraph · ChromaDB · React Read the write-up →Independent security verification for code written by humans and AI agents. It scans, repairs, and re-verifies with your own tests, then issues a Verified Fix Record anyone can re-check offline. Ships as CLI, web, desktop, VS Code, GitHub Action & MCP server.
TypeScript · Node.js · React · Bun Read the write-up →Interpretability research: an independent replication and bilingual extension of the global-workspace (J-space) work, testing whether a model shares one concept space across Chinese and English. Also a live sidecar that streams an open model's J-space read-out while an agent harness drives it.
Python · PyTorch · Transformers · Qwen2.5 View on GitHub →Offline regulatory mapping and gap assessment for APAC financial institutions: 412 checkable controls from 31 sources (HKMA, SFC, PCPD, MAS, APRA, BNM), each traced to the official clause, with cross-regulator overlaps merged or flagged. Zero dependencies — data never leaves the browser.
JavaScript · static HTML · EN / 繁 / 简 View on GitHub →I asked an AI whether it can feel time passing. Its answer sounded a lot like a Servant from Fate/Grand Order.
An AI coding agent built for regulated environments — org-policy enforcement over tools, models, shell and file paths, sandboxed execution, and a h...
Why I built DocSentinel as six specialised agents coordinated by a graph, and what hybrid vector + knowledge-graph retrieval actually buys a securi...