Projects

How these projects fit together#

Almost everything below is downstream of the same question: how do you build systems that delegate real work to LLMs and autonomous agents without losing control of what they actually do? Each project is a different bite at that. Some are production systems with users. Some are research benchmarks I built because I wanted answers I couldn't find anywhere else. A few are infrastructure tooling that exists because secure AI development has dependencies that aren't yet off-the-shelf.

The work splits roughly along four lines:

• Agent security and sandboxing. Permission models, runtime monitoring, and the day-to-day infrastructure that decides what an autonomous agent is allowed to touch and how cleanly you can revoke that access later. This is the largest cluster of work and the one that feeds back most directly into what I ship at Dropbox.
• Prompt-injection defense. Reproducible benchmarks and tooling for measuring how LLM applications hold up against direct, indirect, and tool-chained injection. Not because I think the attack class can be eliminated, but because we shouldn't be shipping defenses we can't measure.
• OAuth and identity for AI. MCP and agent ecosystems shifted the principal model — the entity making a request is increasingly a model, not a person — and the older OAuth patterns weren't designed for that. The projects in this area focus on token lifecycle, scoping, and revocation that actually work for agent traffic.
• Personal infrastructure and research toolkits. Smaller, scoped tools that solve a specific problem I had — secure communications, research workflow plumbing, task management — and that I've open-sourced because the underlying problem isn't unique to me.

What to look for on each card#

The cards below show the project's title, status (active / maintained / experimental / archived), tech stack, a short description, and the achievements or design goals that mattered most to me. The Learn more link drops into a longer write-up that covers the motivation, the architecture decisions, and what worked or didn't. Where source is public, you'll see a GitHub link as well — most of these are MIT or Apache-2.0 and PRs are welcome.

If you're scanning for something specific:

• For production-grade work, look for active status and a non-trivial tech stack.
• For research artifacts, look for experimental status and benchmark/eval-style descriptions.
• For reusable infrastructure, the tags will call out OAuth, MCP, sandboxing, or observability.

The projects that don't appear here are either internal to Dropbox or still pre-release. If you're working on something adjacent — agent sandboxing, MCP server hardening, prompt-injection benchmarking, OAuth for agentic systems — I'd love to compare notes. Email me from the contact page.