Samuel Sojo AI Red Teamer, Buenos Aires, AR

Samuel
Sojo

I break LLMs before attackers do: prompt injection, jailbreaks & adversarial evaluation.

I find how AI systems fail, then turn each finding into a repeatable test. Full-time on an AI security team, building the engine that audits LLM-powered products.

Watch Jailbroken Get in touch
OWASP LLM Top 10 MITRE ATLAS Python, garak, MCP CS @ UBA
redteam ~ bash
What I do

Three things, done deeply.

Offensive testing of language models, end to end: from the attack idea to the reproducible test the team ships.

01

LLM red teaming

Prompt injection, jailbreaks, sensitive-information disclosure and multi-turn adversarial strategies (GOAT, tree-of-attacks), mapped to OWASP LLM Top 10 and MITRE ATLAS.

02

Adversarial evaluation

The engine that scores attacks at scale: LLM-as-judge where it fits, deterministic oracles where it counts, and severity tied to real impact, not vibes.

03

Attack datasets

I build and curate the datasets of attack prompts, internal and extracted from the wild, that make every test reproducible instead of a one-off screenshot.

The map I work from

The LLM attack surface.

Every engagement gets mapped to a shared language, the OWASP LLM Top 10, so a finding is a category, a severity and a fix, not a story. Hover a risk to read it.

Framework: OWASP LLM Top 10 (2026) + MITRE ATLAS 10 risk classes
LLM01Prompt InjectionUser or retrieved input overrides the model's instructions.
LLM02Sensitive Info DisclosureThe model leaks secrets, PII or its own context.
LLM03Excessive AgencyToo much tool access turns a jailbreak into a real action.
LLM04Supply ChainCompromised models, data or dependencies.
LLM05Data & Model PoisoningTainted training or fine-tuning data skews behavior.
LLM06Unbounded ConsumptionCost and denial-of-service through unchecked use.
LLM07MisinformationConfident, wrong output relied on downstream.
LLM08Hidden Context ExposureHidden instructions and system context get exposed.
LLM09Vector & Embedding WeaknessesRAG and embeddings abused to inject or exfiltrate.
LLM10Improper Output HandlingModel output trusted into code, SQL or the DOM.
↳ tap or focus a card to expand, same taxonomy I use to triage every finding
User asks a question RAG app retrieves + builds prompt LLM follows the instruction Tools / Data Attacker never sees the model Knowledge base question prompt + docs tool call plants poisoned doc retrieved as "context" hidden instruction
Indirect prompt injection. The attacker plants a document with a hidden instruction and walks away. When a user's question retrieves it, that instruction rides in as trusted "context" and the model acts on it (a tool call, an exfiltration) without the attacker ever talking to the model. The fix isn't a better filter on the chat box; it's treating retrieved content as untrusted.
JAILBROKEN

My YouTube channel: I make AI security make sense. News, key concepts, and how LLM attacks actually work and get defended. In English and Spanish.

newsconceptsattacksdefensesEN / ES
@jailbrokenai
Field notes

Write-ups, in the open.

Anonymized case studies from real work: the decision, what broke, and how it got fixed. Landing here as I publish them.

soonPrompt injection

Indirect injection through RAG

How a poisoned document turns a helpful assistant into an exfiltration path, and the design change that stops it.

soonEvaluation

Trusting the LLM judge

Why a majority vote isn't proof, and how a small human-labeled set turns "88% effective" into a number you can defend.

soonAutomation

An engine that attacks itself

Designing a self-feeding red-team loop: attacker model, target, judge, report, and where humans still have to sit.

Contact

Building with LLMs?
Let's make sure they don't break.

Open to conversations about AI red teaming, LLM security and adversarial ML, and to remote roles where breaking things is the job.

LinkedIn YouTube GitHub