Local models
Quantised open-weight models on consumer hardware. What fits in 12 GB, what it costs in quality, and where the ceiling really is.
Bite-sized experiments in AI, infrastructure, and security.
Gribbite is an independent technology lab. I run models on my own hardware, wire up agents, automate the tedious parts of cloud operations, and then test how all of it behaves when something hostile shows up. The work gets built, broken, and written down here.
- focus
- Local inference, agent workflows, detection engineering, identity
- inference host
- NVIDIA Titan X · 12 GB VRAM · 32 GB system RAM
- runtime
- llama.cpp with quantised GGUF builds — currently Qwen-family models
- cloud
- Azure and a Microsoft 365 lab tenant with hybrid identity
What the lab works on
Six threads, all of which end up touching each other. Nothing here is theoretical — each one exists because I needed to know how something actually behaves.
Agents and workflows
Small, scoped agents that do one job well: tool use, retrieval, and the plumbing that keeps them from wandering off.
AI security
Prompt injection, tool-call abuse, data exfiltration through model context. Treating an agent as a workload that needs a threat model.
Detection engineering
Writing, tuning, and breaking detections in KQL. Testing whether a rule survives contact with noisy production telemetry.
Identity and access
Entra ID governance, access packages, lifecycle automation, and the failure modes that only show up at scale.
Automation and tooling
PowerShell and Graph automation for the work that shouldn't need a human twice. Scripts that other people can read.
Current projects
Each project page carries the setup, what was measured, and what turned out to be wrong.
active
Local LLM workbench
A repeatable rig for loading, quantising, and comparing open-weight models on a single 12 GB card — and finding the point where a smaller model stops being worth it.
- llama.cpp
- GGUF
- Qwen
- PowerShell
ongoing
Agent guardrails
Giving a tool-using agent real permissions in a throwaway tenant, then trying to talk it into doing something it shouldn't. Notes on what actually held.
- Agents
- Prompt injection
- Graph API
active
Detection bench
A small harness for writing KQL detections against simulated activity, measuring false positives before a rule ever reaches production.
- KQL
- Sentinel
- Defender
- Atomic Red Team
From the shelf
The reference material I keep going back to, filtered down to things worth your time.
Running models locally
Inference runtimes, quantisation formats, and where to find weights that are actually licensed for what you want to do.
Securing AI systems
Threat models, red-team frameworks, and risk guidance that predates the current wave of vendor marketing.
Detection and identity
Query languages, detection rule libraries, and the identity documentation worth reading end to end.
Working on something adjacent?
If you're building with local models, hardening agents, or writing detections, I'm happy to compare notes.