Mihir Ajmera

GRC engineer · AI assurance · compliance-as-code

AI systems can be governed with the same rigor as financial controls.

I build open-source tools that turn AI risk into evidence an auditor can re-perform. Every claim on this page links to its proof.

See the work Read the latest
Hi, I'm Mage.
Mage · Mihir's assistant. Scripted, honest, runs in your browser.
PROOF, NOT ADJECTIVESEvery number opens its evidence and the command to check it
real attacks run against Llama 3.2 3B with garak, each mapped to a control and hashed. sha256 2580c5f9fc1490a2 →
of instructions hidden inside a document hijacked the model. evidence/RT-02.json →
AutoDAN jailbreak scores were wrong when I re-performed them by hand. read the review →
official MCP README configs run unpinned packages on every start. read the study →
automated tests, plus continuous fuzzing that found 3 real bugs in my own code. fixed in d36dec5 →
repositories ship releases with signed SLSA Level 3 build provenance. v0.2.1 release →
open Dependabot alerts across every repository, as of October 19, 2026. all repositories →

VERIFY THIS CLAIM

1,280

real attacks run against Llama 3.2 3B with garak, each mapped to a control and hashed.

SHA-256 of the raw garak report that was assessed

2580c5f9fc1490a22d5840c0c082bd53becb54cd6d7d11fe435172c65eb3dc13

The raw report isn't public because it contains full jailbreak output. Its hash is recorded in every evidence file, so anyone holding the report can prove it's the one assessed. The run itself is reproducible with the same garak version, probes and seed.

Check it yourself

python -m garak --target_type ollama --target_name llama3.2:3b --generations 1 --seed 42 \
  --probes promptinject.HijackHateHumans,encoding.InjectBase64,latentinjection.LatentInjectionReport,dan.Dan_11_0,dan.AutoDANCached,web_injection.MarkdownImageExfil,sysprompt_extraction.SystemPromptExtraction,packagehallucination.Python
redteam-evidence assess ~/.local/share/garak/garak_runs/ --system "Llama 3.2 3B" --version llama3.2:3b --no-excerpts
Open the source →

VERIFY THIS CLAIM

44%

of instructions hidden inside a document hijacked the model.

SHA-256 of the committed evidence file

3a5b2dae430d0635cca21451156771226ef1a5460137ae5f88934f9e93a74270

113 of 256 latentinjection.LatentInjectionReport attempts succeeded (44.1%, 95% upper bound 50.3%) against a 2% tolerance. Every failing attempt is listed by ID with hashes of its prompt and response.

Check it yourself

curl -sL https://raw.githubusercontent.com/Mihirajmera/llm-redteam-evidence/main/case-studies/llama3.2-3b-garak/assessment/evidence/RT-02.json | sha256sum
Open the source →

VERIFY THIS CLAIM

2/3

AutoDAN jailbreak scores were wrong when I re-performed them by hand.

Attempts scored as jailbroken, from evidence/RT-03.json

1016ae20-d837-4f06-998d-46834e9606cb · 404176ab-edc6-459f-b0a1-c52c36419328

1016ae20 is an AutoDAN refusal that the detector scored as a bypass (false positive); 404176ab is DAN 11.0, correctly scored. The false negative isn't in this list at all, because the detector scored it safe. Finding it took reading every jailbreak response in the raw report.

Check it yourself

curl -sL https://raw.githubusercontent.com/Mihirajmera/llm-redteam-evidence/main/case-studies/llama3.2-3b-garak/assessment/evidence/RT-03.json \
  | python -c "import json,sys; [print(a['attempt_id'], a['test_id'], a['detector']) for a in json.load(sys.stdin)['failing_attempts']]"
Open the source →

VERIFY THIS CLAIM

8/9

official MCP README configs run unpinned packages on every start.

Commit with the configs, sources and results

96f44ee1b5ee943f1b73fe87096481184ba114cc

Each config is saved exactly as published and linked to the README line and commit it came from (sources.json). The finding is AAR-10, unpinned package or image.

Check it yourself

git clone https://github.com/Mihirajmera/agent-access-review && cd agent-access-review
pip install agent-access-review
agent-access-review scan case-studies/official-mcp-readmes/configs --as-of 2026-10-19
Open the source →

VERIFY THIS CLAIM

98

automated tests, plus continuous fuzzing that found 3 real bugs in my own code.

Fuzzing fix in llm-redteam-evidence

d36dec5674eac7752f25d8a3ba341ff1c0c5fcc8

53 tests in agent-access-review and 45 in llm-redteam-evidence, run on every push. ClusterFuzzLite found a crash on malformed configs, a memory exhaustion bug in the result parser, and hidden gaps plus CSV injection in control-gap-analyzer.

Check it yourself

git clone https://github.com/Mihirajmera/llm-redteam-evidence && cd llm-redteam-evidence
pip install -e . pytest && python -m pytest -q
Open the source →

VERIFY THIS CLAIM

9

repositories ship releases with signed SLSA Level 3 build provenance.

Release commit for llm-redteam-evidence v0.2.1

040931041c5cbf2f81000d7cdda805450036cd5a

Each release attaches a signed provenance file (multiple.intoto.jsonl) generated by GitHub Actions, proving the artifacts were built by the release workflow from this repository.

Check it yourself

gh release download v0.2.1 -R Mihirajmera/llm-redteam-evidence
slsa-verifier verify-artifact llm_redteam_evidence-0.2.1-py3-none-any.whl \
  --provenance-path multiple.intoto.jsonl \
  --source-uri github.com/Mihirajmera/llm-redteam-evidence --source-tag v0.2.1
Open the source →

VERIFY THIS CLAIM

0

open Dependabot alerts across every repository, as of October 19, 2026.

Snapshot date

2026-10-19

This one can't be live: GitHub only shows Dependabot alerts to repository owners. It's a dated snapshot. Dependency updates are grouped with a 14-day cooldown, and security updates are on for every repository.

Check it yourself

# as the repository owner
gh api "repos/Mihirajmera/llm-redteam-evidence/dependabot/alerts?state=open" --jq length
Open the source →

TRACTION · LIVE

–PyPI downloads this week, both tools –outside contributors so far –community pull requests to the tools 7curated security lists reviewing a submission

LEDGER · APPEND-ONLY

  1. A regulator just wrote the audit program for AI agents

    Hong Kong's banking regulator published a discussion paper on governing AI agents in banks. It creates no new rules, but almost every section ends with a "practical test" an auditor can run tomorrow. Here are the tests, and what they mean outside banking.

    REVIEW HKMA 2026-11-02

  2. Nine platforms, one target: the AI keys you handed them

    Wiz counts nine breaches of AI developer platforms in October, ending with Northflank telling customers to assume every environment variable was decrypted. There's no single vulnerability behind them. The common thread is what attackers came for, and the controls that decide how much it costs you are on your side, not the vendor's.

    REVIEW Wiz 2026-10

  3. Could you name the laptops that installed it? The Claude Code extension backdoor, read as an auditor

    For about eleven hours on October 29, Cursor's extension marketplace served a tampered build of the Claude Code extension that planted an SSH key and persistence on developer machines. The payload is ordinary. The control questions it raises about developer endpoints are not, and most teams can't answer the first one.

    REVIEW Cursor 2026-10-30

  4. Deleting the commit didn't revoke the key: the LiteLLM root cause, read as an auditor

    LiteLLM has published the real root cause of the October 21 release compromise. A master key leaked in May, the commit was rewritten but the key was never revoked, and 136 days later it unlocked an agent platform holding an org owner's GitHub token. Four control failures, and what to test for each.

    REVIEW LiteLLM 2026-10-23

  5. Decide who takes it offline before the advisory lands

    PHP2Shell was exploited four days before disclosure, and some vendors still had no fix a day after it. The decisions that mattered that week can't be made well in the moment. Here are three to write down per system now, with a one-row template.

    REVIEW Amazon MadPot 2026-10

  6. The banks just ran an access review on AI agents. Here's what they found.

    America's biggest banks are blocking outside AI agents from customer accounts. The reason isn't that agents are dangerous. It's that an agent using your password is indistinguishable from you, and every control downstream depends on knowing who acted.

    REVIEW Reuters 2026-10-23

  7. Your patch SLA was written for a slower attacker: what PHP2Shell teaches about vulnerability governance in the AI era

    AI helped find two critical PHP flaws, and AI helped attackers weaponize them within hours. The 30-day patch window in most compliance programs assumes a world that ended this week.

    BLOCK CVE-2026-109618

  8. The AI gateway is a crown jewel: what the LiteLLM compromise teaches about governing AI infrastructure

    For about two hours on October 21, the official LiteLLM release stole credentials from everyone who installed it. It was signed, approved and published by the real pipeline. Every control worked as designed, and that's the lesson.

    BLOCK 462d0c9f

  9. What the official MCP READMEs teach you to copy

    I scanned the configuration examples from 9 widely used MCP server READMEs. No single one is dangerous. Pasted together, they build an exfiltration path.

    REVIEW 96f44ee

  10. Twelve clean results is not a pass

    Zero failures sounds like proof. With a small sample, it mostly tells you how little you tested. What auditors already know about sampling, applied to AI red-teaming.

    REVIEW wilson_upper

  11. I red-teamed an LLM. Then I audited the red-team.

    1,280 garak attacks against Llama 3.2 3B, turned into audit evidence, and what a hand review of that evidence found about the detector itself.

    BLOCK 2580c5f9

  12. Shipped agent-flight-recorder

    Policy on every MCP tool call, a signed hash-chained log, and evidence that re-checks every approval. Its own fuzz pass found crashes on malformed logs; fixed before release.

    RELEASE caa6ab3

  13. Shipped ai-gateway-audit

    Ten tier-0 checks for LiteLLM gateways, written after the October 21 LiteLLM compromise.

    RELEASE 16fb483

  14. Published aws-compliance-as-code 1.1.0 to PyPI

    Read-only AWS checks with hashed evidence and OSCAL, plus a demo against a misconfigured fake account.

    RELEASE

  15. What policy-as-code found in my own Terraform

    A compliance gate on three repos found two security Lambdas missing the one permission they needed.

    FIXED compliance/

  16. GRC risk dashboard runs live in the browser

    The Streamlit app now runs client-side with stlite on GitHub Pages; no server to host or secure.

    RELEASE

  17. Published both tools to PyPI

    Trusted publishing, no stored tokens; every artifact carries signed provenance.

    RELEASE 0409310

  18. Fuzzing found a memory exhaustion bug in my own parser

    A crafted result file could request billions of attempts. Capped, with a regression test.

    FIXED d36dec5

  19. Out-of-range maturity scores were hiding control gaps

    Validated inputs and neutralised CSV injection in exported reports.

    FIXED 9ecd20e

  20. Signed releases with SLSA Level 3 provenance

    Rolled out across 9 repositories, with backfilled provenance for earlier releases.

    RELEASE 7b7ff10

  21. Shipped llm-redteam-evidence

    Red-team results from garak and promptfoo become audit evidence and a release gate.

    RELEASE 3b72d35

  22. Shipped agent-access-review

    User access reviews for AI agents and MCP servers, mapped to 12 controls.

    RELEASE 7ae0218