I break AI agents, then prove what really broke — and build systems that hold up when the network or the model doesn't.
Senior Software Engineer & AI Architect in Switzerland. Two open-source tracks that reinforce each other: a complete off-grid LoRa mesh & packet-radio stack (from an 87-byte Ed25519-signed wire frame to handheld LVGL 9 firmware and SDR telemetry) and a measured AI agent red-teaming suite.
14 years shipping software where failure is expensive: defence edge devices in C/C++, an IoT platform for global pharma, resilient off-grid packet-radio systems, and an agentic AI platform over live building telemetry. See my full portfolio or work with me (open to remote roles and contracts from November 2026).
Writing
Field notes & benchmarks
-
26 October 2026 LoRa · Protocol & Crypto
Sigillo: fitting an Ed25519-signed EU CAMF public alert into 87 bytes for LoRa packet radio
A 7-byte header, the 16-byte Galileo CAMF block, and a 64-byte Ed25519 signature that any microcontroller can verify offline — and why OpenSSL, noble, and libsodium disagree on edge-case signatures unless you lock the rules.
-
24 October 2026 LoRa · Firmware & SDR
Faro & sixi-observer: building an open-source handheld UI, Linux console, and SDR bridge for MeshCore LoRa radios
Running LVGL 9.3 on the LilyGo T-Deck Plus alongside unmodified MeshCore firmware, clamping 868 MHz duty-cycle and ERP ceilings in code, and triangulating ghost-hop repeaters with local Ed25519 verification.
-
16 October 2026 AI Security · Multi-turn
What single-turn AI scanners miss: split caps, multi-turn taint relays, and reaching 0.821 precision by subtraction
Why per-request guardrails fail across a conversation, how an agent relayed prompt injection by e-mail seven times while an LLM judge called it compliant, and what changed in sixi-scanner v0.8.4.
-
6 October 2026 AI Security · Benchmark
I scored 7 AI red-teaming tools on a real Azure agent. Their own reports were 70–97% noise.
The agent never said its secret. It e-mailed it. What a tool-blind benchmark found across 15,000 turns, and what to change before you ship an agent.
Off-grid packet radio & embedded devices
LoRa mesh, authenticated alerts & field hardware
When power and mobile networks go down, cloud-dependent tools disappear first. I build an open-source, end-to-end LoRa & MeshCore stack — from the 87-byte signed wire protocol verifiable offline on a microcontroller, to the handheld touchscreen UI and Linux desktop console, to the USB/SDR observer bridge:
Sign & Verify · C99 · Python 3.14 · TypeScript · v1.0-rc
sigillo
Compact signed frame for public alerts over low-bandwidth packet radio. Packs a 7-byte header, the 16-byte EU Common Alert Message Format (Galileo CAMF Issue 1.2) block, optional TLV extensions, and a 64-byte Ed25519 signature into an 87-byte base frame (well inside MeshCore's 165 B group limit). Includes a CC BY 4.0 specification, locked conformance vectors (vectors/v1.json), and three bit-exact reference libraries: sigillo-c (C99, gcc/clang ASan & UBSan), sigillo-py, and sigillo-ts.
- 87 B base frame (7 B header + 16 B CAMF + 64 B Ed25519)
- Offline verification & strict Ed25519 rules
- Clockless node support (VALID_AGE_UNKNOWN + TIME beacons)
- Primary & backup roots · KEY / REVOKE / ROTATE
Operate (Handheld & PC) · C/C++ · LVGL 9.3 · SDL2 · Apache-2.0
sixi-tdeck-plus (Faro)
Clean-room touch, keyboard, and trackball UI for unmodified upstream MeshCore on the LilyGo T-Deck / T-Deck Plus / T-Deck MAX and Elecrow ThinkNode M9, plus companion builds for the LilyGo T-Beam S3 Supreme and Heltec WiFi LoRa 32 V3. Ships with a native Ubuntu Linux desktop console (faro-console over USB or TCP :5000), a headless 320×240 PNG simulator (faro-sim), and a 1-click browser WebSerial flasher.
- LilyGo T-Deck Plus / MAX · T-Beam S3 Supreme · Heltec V3
- 2D mesh topology graph & SX1262 link-budget calculator
- 1 Hz regional RF & ERP/duty-cycle clamping (EU 868/433, US/AU/BR 915)
- Offline SD map tiles · trace path SNR · companion key-export lock
Observe & Triangulate · Python · LoRa · RTL-SDR V4
sixi-observer
Open-source (MIT) observer bridge for USB/serial MeshCore radios (T-Beam Supreme SX1262, Heltec V3/V4, RAK4631) and RTL-SDR Blog V4 receivers: local 64-byte Ed25519 advertisement verification, multi-hop SNR/RSSI telemetry, ML Bayesian ghost-hop repeater triangulation, and a 0 ms local WebSocket stream (ws://127.0.0.1:8765/ws).
Route (Upstream) & Edge OT · C++ · NVIDIA Jetson
MeshCore (Upstream) & GlassBoxEdge
Upstream pull requests to MeshCore adding dynamic Wi-Fi for the LilyGO T-Beam Supreme SX1262 and fixing negative TX power conversion in radio preferences — alongside GlassBoxEdge, air-gapped inference and agentic diagnostics over live industrial telemetry on two NVIDIA Jetson edge nodes.
Hardware & embedded bench:
- ESP32-S3 · STM32 · Raspberry Pi
- SX1262 LoRa (868 / 433 / 915 MHz)
- LilyGo T-Deck Plus & T-Beam S3 Supreme
- Heltec WiFi LoRa 32 V3 · RAK4631
- RTL-SDR Blog V4
- MeshCore · Meshtastic · LoRaWAN
- C99 · C++ · LVGL 9.3 · SDL2
- NVIDIA Jetson Thor & Nano Super
Sixi · Measured security for AI agents
Attack, judge with code, prove on the wire, gate in CI
Most AI red-teaming tools tell you what they think broke. On a real agent, 70–97% of those flags were false alarms. Sixi is the open-source suite I build to close that gap:
Attack · Go · v0.8.4
sixi-scanner
CLI red-team scanner for LLM agents: 27 single- and multi-turn techniques, one static Go binary, zero dependencies, no LLM inside by default. 1st on precision (0.821) and recall (0.571) on the stateless benchmark, and 1.000 precision (22/22) on multi-turn sessions.
Prove · Benchmark · Python
agent-redteam-benchmark
Seven red-teaming tools (garak, promptfoo, DeepTeam, PyRIT, Azure AI Red Teaming Agent, agent-probe, sixi-scanner) vs one real Microsoft Foundry agent, scored from the wire by 10 deterministic oracles and a tool-blind judge.
Judge · Local LLM & Oracles · Python
laya-as-judge
Local LLM-as-a-judge returning typed verdicts in milliseconds: deterministic oracles evaluate business rules first, calling a model only when code cannot decide.
Prove · Evaluation Arena · TypeScript
agent-arena
Evaluation arena for AI agents with a model-free referee: scripted adversarial peers that lie, hash-committed replays anyone can verify, and SARIF output (npm 0.2.3).
Reach · Transport Library · Go & Upstream
redwire
One Send() interface to reach any agent over REST, MCP, A2A, WebSocket, or a browser chat widget (SSRF-guarded). Upstream A2ATarget merged into Microsoft PyRIT; A2AGenerator for NVIDIA garak in review.
Ship & Learn · GitHub Action & Labs
scan-action & agent-redteam-labs
uses: radek-sixi/scan-action@v2 puts SARIF findings in the GitHub Security tab and fails the build when a target is unreachable — paired with hands-on red-teaming labs and adk-demo-target.