AI security
I'm Ahmed Amhdour, a self-taught aspiring AI Security Engineer developing security work for AI applications, retrieval systems, and autonomous agents.
I’m also a GITEX AFRICA 2026 Cyber & AI Achiever Award recipient — Rising Star (Individual), recognized in Marrakech for my work and direction in cybersecurity and AI security.
My focus is on understanding where identity, sensitive data, retrieval, models, tools, agents, and external services cross trust boundaries. I approach AI security through source-code analysis, threat modeling, controlled security labs, architecture tracing, adversarial testing, and reproducible evidence.
Rather than focusing on a single framework, I study security principles that transfer across modern AI systems.
Recognition
Projects
I study the security of enterprise AI assistants that connect employees with organizational knowledge, language models, retrieval systems, and agent tools.
My work focuses on authentication and authorization, private conversations and files, secure document ingestion, RAG permissions, prompt injection, agent actions, MCP-style integrations, secrets, sandboxing, logging, supply-chain security, incident response, and secure deployment.
I study self-hosted AI applications that provide users with access to local and remote language models.
My security focus includes session security, user isolation, model-provider configuration, API-key protection, file uploads, tool permissions, prompt injection, sensitive-data exposure, logging, and deployment hardening.
I study AI knowledge systems that ingest private documents and use retrieval-augmented generation to answer questions.
My focus includes document ownership, ingestion security, retrieval authorization, vector-search permissions, embedding privacy, indirect prompt injection, permission revocation, sensitive-data handling, retention, deletion, and secure multi-user access.
I study AI platforms that connect users with multiple models, providers, tools, and external services through a common application.
My security work focuses on identity, API authorization, provider credentials, conversation privacy, uploaded content, model routing, tool permissions, external integrations, logging, output handling, and preventing untrusted AI-generated content from becoming trusted authority.
Engineering
Across these systems, I concentrate on the security problems that remain important regardless of the underlying technology:
Authorization · RAG Security · Agent Security · Prompt Injection · Tool Security · Sensitive Data Protection · Identity · Sandboxing · Supply-Chain Security · Observability · Security Evaluation · Incident Readiness
My working methodology is:
Inspect → Trace → Predict → Test → Observe → Explain → Improve → Retest
I want security conclusions to be based on evidence rather than assumptions. I therefore distinguish between source analysis, planned experiments, controlled lab results, independently demonstrated work, and real production experience.
My goal is to help build AI systems where data access is intentional, agent authority is constrained, actions are independently authorized, failures are observable, and security claims can be demonstrated with evidence.
Focus
Who is allowed to access this object?
Does retrieval preserve the caller’s permissions?
Does this tool action stay within the authority granted?
The four platform profiles apply the same focus on identity, sensitive data, retrieval, tool authority and trust boundaries to different AI application contexts.
Find my email, mobile phone and message form on the Contact page, or explore my GitHub profile.