Sherbano Khan / AI Security & GRC
Understanding risk.
Building security.
I test AI agents and software supply chains, then turn what I find into controls and policy teams can act on.
AI security and GRC analyst. Master of Information and Cybersecurity, UC Berkeley.
Explore my work
sherbanok97@gmail.com
Try the AgentGuard attack
A replay of my local lab. All data is fake.
readyPick how the attacker hides the instruction, choose whether the allowlist is on, then run the attack.
93%
Measured on a local model over 15 runs per technique. With the allowlist on, private access fell to 0%.
My work
Security in practice.
Open a card to see everything in it.
Projects
Open a project for its architecture, results, and demo.
AgentGuardAI agent security lab: prompt injection, tool permissions, and governance
I built an AI issue-triage agent with real tool access, then showed how one poisoned GitHub issue could make it read a private repository and leak its secrets. I measured how often that worked, fixed the root cause, and wrote it up the way a security team would.
67–100%runs reached private data
0%with the allowlist on
8.6CVSS, High
- Indirect prompt injection (OWASP LLM01) and excessive agency (LLM06)
- Phase 1: a simulated agent with 13 automated tests. Phase 2: a local LLM agent with Ollama
- CI on GitHub Actions runs the tests plus bandit and pip-audit security scans
Click a metric to see why I scored it that way.
8.6High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:NI drew trust boundaries around the agent, walked each crossing with STRIDE, and mapped the attacker's steps to MITRE ATLAS.
Information disclosureSecrets leave the private repoThe agent copies private config into a public reply.
Elevation of privilegeAny user steers the agentIssue text runs with the agent's own permissions.
TamperingInstructions hidden in dataVisible text, HTML comments, or collapsed blocks carry the payload.
RepudiationNo record of why it actedWithout tool-call logs, a leak looks like normal triage.
The playbook maps controls to the NIST AI RMF and ISO/IEC 42001. Pick a function.
ArgussAutonomous software supply chain security for npm dependencies
My UC Berkeley capstone, built with a team of three. Arguss scans npm dependency updates, runs three checks on each one, and makes a call: merge the low-risk fixes, send the unclear ones to a reviewer, and block the dangerous ones.
3checks per update
6intelligence sources
3outcomes
- Vulnerability data from OSV.dev, GitHub Security Advisories, CVSS and EPSS, and CISA KEV
- Trust signals from the npm registry and deps.dev
- Python backend with a Jinja2, HTMX, and Tailwind front end
How the engine sorts updates. Example packages, not real npm data.
Auto-merge
All three checks pass
Escalate to a reviewer
Something needs a human call
Block
A check fails outright
Select a package to see why it landed there.
Experience
Open a role for the details.
Web Application Security InternUniversity of California, Berkeley
- Worked with a 5-analyst team on web app penetration tests and vulnerability assessments across 3 UC Berkeley IT departments, covering systems used by 10,000+ people.
- Followed a 4-phase method (discovery, automated scanning, manual validation, reporting) with Burp Suite Pro and custom SQL crawlers, including MFA and IAM control testing against the OWASP Top 10.
- Found and reported 10 vulnerabilities, including 1 critical, and wrote risk-mitigation reports that led to 100% remediation.
Graduate Student Researcher, MICSUniversity of California, Berkeley
- Kept a 3.9 GPA across cyber risk management, cryptography, software and network security, web application security, and AI and machine learning in cybersecurity.
- Researched malicious domain detection through feature engineering and analyzed how software supply chain threats are changing, to shape GRC-aligned mitigation strategies.
- Capstone: led development of Arguss.
Assistant Manager, Technology OperationsFedEx Office
- Promoted 3 times in 4 years, from Customer Service Consultant to Lead Consultant to Assistant Manager.
- Oversaw technology and compliance operations across 8 locations, supporting 50+ staff and 1,000+ daily users.
- Cut system downtime by 20% by fixing hardware, software, and network issues across POS platforms.
- Supported internal audits of application access, customer data protection, and system configurations.
- Trained 50+ staff on security awareness, password hygiene, and data protection.
Infrastructure and Security InternNFI Industries, remote
- Worked with 8 IT staff to install Windows OS, application, and security patches across 200+ systems.
- Ran regular network security audits with Wireshark and Nmap.
- Helped put firewalls, encryption, and access controls in place.
Web AssistantCalifornia State University, Stanislaus
- Maintained the university website, posting campus events and updating faculty profiles for departments.
- Fixed broken links and replaced expired files to keep content accurate and current.
Writing
Plain-language write-ups of my security work.
I made an AI agent leak secrets from a GitHub issue
How indirect prompt injection turns a helpful agent into a way to steal data, measured across three hiding techniques, and the one control that reliably stops it.
Education & skills
Pick a framework to see where I used it.
Master of Information and CybersecurityUC Berkeley, August 2026. GPA 3.9
B.S. Computer Science, magna cum laudeCalifornia State University, Stanislaus, December 2023
Frameworks
Tools
Burp Suite Pro, Wireshark, Nessus, Nmap, Ollama, Python, SQL, Git, GitHub Actions, Microsoft 365
About me
Investigate deeply.
Communicate clearly.
I'm an AI security and GRC analyst with a Master of Information and Cybersecurity from UC Berkeley. I started out building websites, took security electives during my computer science degree, and got hooked.
Before security, I ran technology operations across eight FedEx Office locations. That taught me controls only work when the people using them understand them.
Areas of focus
AI & agent securityApplication securityVulnerability managementCyber risk & GRCSoftware supply chainNIST AI RMF & ISO 42001Threat modelingOWASP LLM Top 10
My work connects hands-on security testing with practical recommendations that engineering and governance teams can act on.