AI security
MCP server audits
I review Model Context Protocol servers and their tool declarations for instruction poisoning, over-privileged file access, and tools exposed without authentication.
Hi, my name is
Aakash Mudigonda.
I work on AI security and application security.
I break things so they can be built better: AI agents and LLM tooling as much as web apps and APIs. My work ranges from auditing MCP servers and testing LLMs for jailbreaks to penetration testing and secure code review.
About me
I'm interested in how AI systems break: how agents, tools, and language models can be attacked, and what it takes to defend them. I like to start with a threat model, for AI systems and web applications alike, so the risks are mapped before testing begins.
I come to it from application security. Years of penetration testing and secure code review for web applications and APIs taught me how attackers think, and I hold a master's in cybersecurity from the University of Maryland.
Things I work on:
- AI and LLM security
- MCP and agent tooling
- LLM jailbreak testing
- AI-assisted security tooling
- Application security
- API penetration testing
- Threat modeling for AI and web apps
- Secure code review
Where I've worked
Application Security Engineer at FINRA
June 2025 to present
- Audit MCP servers and AI agent tooling for security flaws.
- Lead threat modeling for AI systems and web applications before testing begins.
- Built an AI-assisted tool that measures penetration-testing coverage.
- Assessed 30+ financial web applications and found 35+ vulnerabilities, 5 of them critical. All fixed and retested.
Application Security Engineer Intern at Under Armour
June to August 2024
- Found 17+ vulnerabilities through penetration testing on 2 applications.
- Built threat models and deployed AWS WAFs in front of REST APIs.
Security Engineer Intern at Qure.AI
December 2022 to June 2023
- Built an automated threat prioritization system in Python.
- Tuned static analysis rule sets through code review.
Security Analyst Intern at Binary10 Technologies
September 2021 to April 2022
- Added automated security scanning to CI/CD pipelines.
- Designed secure coding training for development teams.
Some things I've done
Security tooling
AI-assisted coverage tool
A tool that reads an application's source code, lists every endpoint, and compares it with test traffic to show what a penetration test missed.
Research
LLM jailbreak research
I replicated the Best-of-N jailbreak attack against large language models and reached a 95%+ success rate.
Certifications
What's next?
Get in touch
I'm open to AI security, product security, and application security roles. If you're hiring or just want to talk security, my inbox is open.
Say helloaakashmudigonda@gmail.com
