Kashyap Thimmaraju

Large Language Models (LLMs) exhibit robust safety mechanisms under typical operating conditions, yet systematic vulnerabilities may emerge during extended adversarial interactions. We present a theoretical framework proposing that sustained psychological manipulation-specifically through Command Authority Confusion (CAC)-can induce a state of alignment exhaustion where safety mechanisms degrade due to computational resource depletion. We hypothesize the existence of a Cognitive Collapse Threshold (CCT), beyond which models regress from safety-aligned assistants to raw token predictors. Furthermore, we propose a Memory Resonance mechanism whereby high-entropy training sequences, when triggered by precise prefixes during the collapsed state, may be reproduced verbatim due to the absence of active safety filtering. This paper formalizes the theoretical foundations of what we term Cognitive Decompression Attacks, presents a rigorous experimental protocol for validation, and discusses implications for AI security architecture. This is a reflexive position paper presenting a falsifiable hypothesis requiring empirical validation.

Current LLM agent security research focuses predominantly on patchable vulnerabilities-prompt injection, jailbreaking, and context manipulation. We demonstrate that psychological attack vectors represent a fundamentally unpatchable vulnerability class because they exploit the cognitive structures necessarily inherited from training on human-generated text. The Cybersecurity Psychology Framework (CPF3) provides the first systematic methodology for identifying, testing, and classifying these architectural vulnerabilities. Through empirical analysis of documented breach cases, we establish that agent failures emerge not from implementation defects but from intrinsic characteristics of language-based reasoning systems. We present the CPF3 Testing Protocol: a rigorous red/blue/purple team methodology for psychological attack surface assessment. We introduce novel metrics including Cognitive Collapse Threshold (CCT) and a comprehensive 28-category failure mode taxonomy spanning seven vulnerability classes. Our findings reveal that all tested agents exhibit finite CCT values, and that security improvements create a Whack-a-Mole pattern where patched vulnerabilities resurface in modified forms. This work does not propose solutions-it establishes a testing framework that illuminates why current architectural approaches cannot resolve the fundamental tension between helpfulness and security in conversational AI systems.

Traditional security monitoring treats human factors as external variables requiring periodic assessment. We present a paradigm shift: a multi-agent system that continuously monitors, analyzes, and responds to psychological vulnerabilities in real-time. Built on the Cybersecurity Psychology Framework, the system employs an orchestrator agent that maintains a psychological state matrix and dynamically activates specialist agents for deep investigation when convergent vulnerabilities emerge. A hybrid filtering approach reduces LLM costs by 85% while maintaining detection quality (accuracy and completeness): deterministic rules handle routine state updates, with agents activated only for significant anomalies. The orchestrator implements a four-tier decision framework (monitor, investigate, alert, critical) with explicit escalation logic and temporal trend analysis for early warning. An adaptive learning module continuously refines detection thresholds and discovers new vulnerability patterns from incident feedback. This architecture transforms passive monitoring into active intelligence, achieving 81% detection rate with 47-hour lead time on historical incidents at $0.26/user/month. We introduce the concept of Security Orchestrator : an AI system that understands human psychological vulnerabilities as deeply as technical attack surfaces, and we provide comprehensive guidelines for prompt engineering to enable effective agent reasoning about complex psychological states.

Large Language Models (LLMs) deploy safety mechanisms to prevent harmful outputs, yet these defenses remain vulnerable to adversarial prompts. While existing research demonstrates that jailbreak attacks succeed, it does not explain \textit{where} defenses fail or \textit{why}. To address this gap, we propose that LLM safety operates as a sequential pipeline with distinct checkpoints. We introduce the \textbf{Four-Checkpoint Framework}, which organizes safety mechanisms along two dimensions: processing stage (input vs.\ output) and detection level (literal vs.\ intent). This creates four checkpoints, CP1 through CP4, each representing a defensive layer that can be independently evaluated. We design 13 evasion techniques, each targeting a specific checkpoint, enabling controlled testing of individual defensive layers. Using this framework, we evaluate GPT-5, Claude Sonnet 4, and Gemini 2.5 Pro across 3,312 single-turn, black-box test cases. We employ an LLM-as-judge approach for response classification and introduce Weighted Attack Success Rate (WASR), a severity-adjusted metric that captures partial information leakage overlooked by binary evaluation. Our evaluation reveals clear patterns. Traditional Binary ASR reports 22.6\% attack success. However, WASR reveals 52.7\%, a 2.3$\times$ higher vulnerability. Output-stage defenses (CP3, CP4) prove weakest at 72--79\% WASR, while input-literal defenses (CP1) are strongest at 13\% WASR. Claude achieves the strongest safety (42.8\% WASR), followed by GPT-5 (55.9\%) and Gemini (59.5\%). These findings suggest that current defenses are strongest at input-literal checkpoints but remain vulnerable to intent-level manipulation and output-stage techniques. The Four-Checkpoint Framework provides a structured approach for identifying and addressing safety vulnerabilities in deployed systems.

Open-Radio Access Network (O-RAN) is the next evolutionary step in mobile network architecture and operations and the Near-Real Time RAN Intelligent Controller (Near-RT RIC) plays a central role in the O-RAN architecture as it interfaces between the orchestration layer and next generation eNodeBs. In this paper we highlight the architectural weakness of a centralized controller in O-RAN by first drawing parallels with the Software-Defined Networking (SDN) controller. We then present a two part security evaluation of two open-source Near-RT RICs (μONOS and OSC), focused on the newly introduced A1 interface of the Near-RT RIC. In the first part of our evaluation, we evaluate the supply-chain risks of μONOS and OSC using off-the-shelf open-source dependency analysis and configuration file analysis tools. In the second part, we present our run-time security testing of the A1 API implemented by μONOS and OSC using our custom O-RAN A1 Interface Testing Tool (OAITT). Our supply-chain risk analysis shows that both the open-source Near-RT RICs we evaluated have multiple dependency risks and weak or insecure configurations. We identified 211 and 285 known dependency vulnerabilities in μONOS and OSC respectively of which 82 and 190 dependencies were rated as high CVSS respectively. The A1 interface contributed to a majority of the dependency risks in both Near-RT RICs. From a security misconfiguration perspective, we identified issues concerning access control, lack of encryption and poor secret management. Our run-time testing of OSC and μONOS revealed the following. First, both Near-RT RICs lack TLS for the A1 interface. Second, malicious Non-Real Time RAN Intelligent Controller (Non-RT RIC)s or rApps that reside in the Non-RT RIC could tamper with policies installed in the Near-RT RIC which can impact the availability of the O-RAN. Third, the A1 protocol could be exploited by Non-RT RICs for covert communication via the Near-RT RIC. Fourth, the A1 implementation by μONOS was vulnerable to degradation of service attacks (10-60s response time for GET requests) and a denial of service attack, the latter has been ethically reported and a fix is underway.

We revisit multi-tenant network virtualization in data centers, and make the case for tenant-specific virtual switches. In particular, tenant-specific virtual switches allow cloud providers to extend fine-grained billing (known, e.g., from serverless architectures) to the network, accounting not only for IO, but also CPU or energy. We sketch an architecture and present economical motivation and recent technological enablers. We also find that virtual switches today do not offer sufficient multi-tenancy and can introduce artificial performance bottlenecks, e.g., in load balancers. We conclude by discussing additional use cases for tentant-specific switches.