// security research · api · ai · cloud · iot & robotics

benson.break().build()

Hi, I'm Benson Muchoki. I find the cracks before attackers do — then help developers seal them for good.

read blog →work with me
whoami.ts
1// whoami.ts
2const benson = {
3  name: "Benson Muchoki",
4  base: "Nairobi, Kenya",
5  roles: ["Security Researcher", "Security Consultant", "IoT & Robotics Instructor", "Innovator"],
6  hunts: ["API", "AI", "Cloud"],
7  available: true,
8};
9 
10benson.break().fix().build(); // in that order.
zsh — 80×24

benson@sec:~$

➜ ~ cat README.md

about benson

I'm a security researcher who hunts vulnerabilities in APIs, AI systems and cloud infrastructure before the bad guys get there. When I find a hole, I don't just file a report and vanish — I work side by side with developers until the fix ships. I also advise teams on building security in from day one. Off the clock, I swap exploits for circuit boards: I teach IoT and robotics and build inventions that sense, move and think. Break it. Fix it. Build it better.

  1. 01

    find()

    Hunt for vulnerabilities in APIs, AI and cloud — before attackers do.

  2. 02

    fix()

    Work with developers until the patch ships, and advise teams on doing it right.

  3. 03

    build()

    Teach IoT & robotics and invent things that sense, move and think.

➜ ~ ls skills/

skills

break/

  • API Security
  • AI / LLM Security
  • Cloud Security
  • Vulnerability Research

fix/

  • Patch Guidance
  • Secure Code Review
  • Security Consulting
  • Threat Modelling

build/

  • IoT
  • Robotics
  • Prototyping
  • Innovation

teach/

  • IoT Instruction
  • Robotics Instruction
  • Hands-on Workshops

➜ ~ git log --oneline -3 blog/

latest posts

No posts yet.

all posts →

➜ ~ ls projects/ | head -3

featured projects

▸ api-bola-hunter

Sample project — replace from /admin. Toolkit for spotting broken object-level authorization in REST and GraphQL APIs by replaying requests across accounts.

▸ llm-redteam-notes

Sample project — replace from /admin. Prompt-injection and data-leak test cases for chatbots and AI agents connected to real tools.

▸ cloud-misconfig-audit

Sample project — replace from /admin. Checklist and scripts for finding public storage buckets, over-privileged roles and leaked keys.

all projects →