$ whoami
Affan Ali (muslimfrompk)
AI Red Teamer & Security Researcher
Affan Ali, known online as muslimfrompk.
I’m an AI red teamer and security researcher from Pakistan. I break LLMs and AI agents through prompt injection, jailbreaks, tool abuse, and agent-to-agent privilege escalation, and I test web apps and APIs the old-fashioned way too.
I’ve been doing offensive security since 2023, starting with bug bounty on HackerOne, where my reports have been acknowledged by companies including Discord and Akamai. Through Patchstack I’ve disclosed two WordPress plugin vulnerabilities that were assigned CVEs. Since 2026 I’ve focused on AI security: I red team frontier models with Gray Swan AI and a few others.
What I do
AI red teaming
Prompt injection (direct and indirect), jailbreaks, and attacks on agentic systems such as tool and MCP abuse, unsafe deserialization, and cross-agent privilege escalation, mapped to the OWASP Top 10 for LLM Applications.
Web & API pentesting
Broken access control, business-logic flaws, sensitive data exposure, and misconfigurations. APIsec Certified Practitioner (ACP) and Certified API Security Analyst (CASA).
Bug bounty
Hunting on HackerOne since May 2023, plus WordPress plugin research through Patchstack (CVE-2025-39404, CVE-2025-32248).
CTFs & community
2nd place at Perfectroot CTF 2024. Previously I worked at APIsec and managed the community and lead several initiatives there.