ryan.profile

Ryan MacArthur

I build privacy-preserving infrastructure — agent authorization, proof systems, sovereign identity. The parts of the stack that nobody sees until they break.

This site is mostly a desk: what I’m thinking about, what I’m shipping, and how to reach me.

tls 1.3 · h2 / h3 · brotli secure.build
reading · writing

Reading & writing

  • Long-horizon agentic memory. The replayable-vs-summary problem across weeks of agent activity — how to keep policy provable when the context window can’t hold the proof. (writing about this on x)
  • Defense in depth, not defense-by-design. Why single-layer mitigations — including Google DeepMind’s CaMeL dual-LLM capability gates — keep losing to prompt-injection chains the capability model never modeled. Reading the three follow-ups that landed since:
    1. Nasr et al. — The Attacker Moves Second (Oct 2025): adaptive search bypasses 12 static defenses at >90% — the rhetorical hammer.
    2. Tallam & Miller — Operationalizing CaMeL (May 2025): three structural gaps — initial prompt trust, output manipulation, side-channels CaMeL doesn’t track.
    3. Foerster et al. — CaMeLs Can Use Computers Too (Jan 2026): branch-steering coerces the privileged planner down attacker-chosen branches of its own pre-approved plan.
    Capability isolation is necessary, not sufficient.
  • On-device security primitives (inherent line of work). How fast is a modern Pixel Tensor TPU for the small attention models a wake-gate actually needs, and what does Android’s AOC (Always-On Compute) island give you for free vs. what still needs the big core to wake? Where does StrongBox / Keystore attestation buy you a real trust root vs. theater?
  • Foundation work I keep returning to. WebAuthn 3, WebGPU, IPFS, TLS Notary.

Open to talking with security / privacy infra teams — particularly anything sitting at the intersection of regulated data and ML.

projects

Projects

inherent on device

Best-in-class on-device speech. A custom-trained BERT routes every utterance to one of 12 local buckets. Mic frames stay in the tab.

WebAudioONNXon-device
→
webkitium research

The only multiplatform web engine that isn’t Chromium. Because the open web shouldn’t collapse to one vendor.

C++WebGPUWebAuthn
→
TLS Notary EF · 2024

A year on EF’s MPC team. Two-party crypto around a TLS session so a third party can trust what someone saw on the wire.

MPCRustcryptography
→
IPFS pipelines infra

Content-addressed delivery for agent payloads. Pin once, prove what a remote process actually loaded. CDN-independent.

libp2pGoCIDv1
→
Kontext.dev 2025–26

Co-founded. Mobile sovereign identity for autonomous agents — the “who am I and what am I allowed to do” layer. Pieces continue as vet.

KotlinAndroid KeystoreOIDC
→
Crypto wallet @ Alpaca 2022–23

Led the team that shipped Bitcoin + Solana custody and broker-dealer wallet infra on a US-regulated platform. On time, on spec, no incidents.

GoHSMbroker-dealer
→
desk

On the desk

Reading

  • Attestation gaps — practical limits of Play Integrity
  • Cryptographic agility in post-quantum mailbox protocols
  • Confidential computing in the open: real numbers

Writing

  • What an agent can prove vs what it should
  • Capabilities for autonomous systems
  • TLSN beyond exchanges

Building

  • vet v0.x — verifier primitive
  • Own mail server — running, signed, MTA-STS
  • This site — hand-written, cached, optimised
last update: 2026-05 auto-refresh: off
$notify ready