Fevzi Ege Yurtsevenler
A researcher building open-source tools and community around AI security in Türkiye. As Co-Founder of AltaySec, he is building the Turkish-language LLM security literature and provides enterprise AI pentesting, LLM security consulting, and training services.
LLM Güvenliği: Saldırı ve Savunma
LLM Security: Attack and Defense — a practical field guide to breaking and protecting large language model systems (Turkish-language book)
Written by Fevzi Ege Yurtsevenler, this book addresses the attack surfaces and the defensive architecture of LLM-based applications within the same field framework. It offers an actionable reference for security professionals, AI/ML teams, and organizations building secure AI systems.
- Prompt injection, jailbreak, and data leakage
- RAG, MCP, tool calling, and AI agent security
- OWASP LLM Top 10, MITRE ATLAS, and NIST AI RMF
- Layered defense, LLM firewall, PII, and AI SOC
Biography
Fevzi Ege Yurtsevenler is one of the researchers building open-source tools and community in AI security (AI Security) and large language model security (LLM Security) in Türkiye. In 2025 he co-founded AltaySec — a team focused on AI security — together with Enes Deniz, and serves as its lead security advisor.
After a background in classic cybersecurity engineering, he shifted his focus entirely to the security of AI systems from 2024 onward. He has authored a substantial part of the Turkish technical literature on prompt injection, RAG security, AI agent security, and the OWASP LLM Top 10 and MITRE ATLAS frameworks. More than 11 comprehensive Turkish research articles, first-hand field research on Turkish-specific prompt injection patterns (the AltayDuel dataset), and the first comprehensive Turkish guide to the OWASP LLM Top 10 form the backbone of this work.
His work is not limited to written content: he is the lead architect of open-source platforms such as AltayDuel — an agent-vs-agent prompt injection arena — and Bekçi — an 8-layer Turkish LLM prompt injection laboratory. These platforms feed directly into Turkish AI security dataset production. On the enterprise side, he provides LLM security consulting, AI pentesting, and red teaming services, and runs corporate training programs through the LLM Security Bootcamp.
In 2025 he taught a university-level LLM Security course within Gazi University Computer Engineering on behalf of AltaySec. He lives in Ankara.
Areas of Expertise
The sub-fields in which he actively conducts research and provides services:
Direct and indirect injection, jailbreak, system-prompt leakage. Turkish-specific patterns.
MCP attack surfaces, tool poisoning, A2A attacks, Meta's Rule of Two framework.
Vector-DB poisoning, embedding inversion, indirect injection, secure RAG architecture.
Pentest methodology tailored to enterprise LLM applications, agent-vs-agent evaluation.
Compliance architecture advisory at the intersection of local legislation and European regulation.
Turkish prompt injection dataset production, the AltayDuel arena pipeline.
Academic Recognition & Achievements
Independently verifiable academic publications, open-source contributions, and credentials:
A Turkish-first arena and open dataset for multi-turn LLM prompt-injection red teaming. DOI: 10.5281/zenodo.20681557 · CC-BY-4.0 · 2026. Related open datasets are published on Hugging Face (AltaySec).
Turkish prompt-injection and data-leakage test cases were accepted as a contribution to the main dataset of the OWASP GenAI Data Security Initiative (DSGAI) — merged into the main repository (2026).
Verified participation certificate for the national cybersecurity talent program of the Republic of Türkiye Ministry of Industry and Technology.
BlueDot Impact completion certificate on the future of AI and AI safety (2026).
Researcher accepted to the OpenAI bug bounty program.
ORCID iD: 0009-0008-6518-8944 — an independently verifiable open academic identity.
Publications — Turkish LLM Security Research Series
A comprehensive Turkish technical research series published at altaysec.com.tr/arastirmalar (April – June 2026):
A cross-tier (haiku/sonnet/opus) behavior experiment with 100 autonomous agents. LLMs produce betrayal abundantly at the discourse level but rarely act on it — empirical evidence of the say-do gap. Open data, CC BY 4.0.
A four-layer field map of Türkiye's AI security ecosystem; sector analysis, gaps, and areas of opportunity.
First-hand field data. Authority bomb, verification trap, translation exploit, role switching, system-prompt leakage. Real transcripts.
Judge architecture, 5 win conditions, provider rotation, and methodology.
An 8-layer laboratory built around a Turkish neighborhood watchman character; KVKK compliance, defensive layers.
A career path from 0 to 9+ months; setting direction as a researcher, pentester, engineer, or entrepreneur.
A 7-stage learning path; CTF platforms, bug bounty programs, opportunities specific to Türkiye.
MCP security, tool poisoning, A2A attacks, Meta's Rule of Two framework.
Data poisoning, indirect injection, embedding inversion, secure RAG architecture.
A comprehensive Turkish reference to the OWASP LLM Top 10. 10 critical vulnerabilities, real cases, defensive strategies.
An in-depth look at OWASP LLM01:2025; direct and indirect injection, real-world scenarios.
How it differs from classic cybersecurity, model-specific threats, the Türkiye context.
Open Source Projects and Platforms
Founder and lead architect of open-source or open-access platforms:
- Open Source Lab — 23 open-source tools for agent skill security: uncloak (hidden prompt injection scanner — try it live in the browser), guardrail-arena (a two-axis EN+TR guardrail benchmark — attack catching and over-refusal), turkish-over-refusal-set (a Turkish over-refusal benchmark; 120-pair probe), guard-blindspots-tr (Turkish robustness of popular guards), turkish-casefold-evasion (naive filter bypass via İ/ı + a fix), lethal-trifecta-lint (an agent-tool "lethal trifecta" linter), turkish-pii-redactor (checksum-validated TR PII masking — KVKK scanner demo), hf-dataset-scan (scans datasets for poisoned hidden injection), skills-in-the-wild (an open audit of 3,168 real skills), ai-honeypot (an attack-catching trap + dashboard), and MCP/OWASP/KVKK guides. Turkish-first, mapped to OWASP LLM Top 10 + MITRE ATLAS.
- Hugging Face — AI & LLM Security (Turkish-first) — 15+ open datasets, a multilingual prompt-injection detection model (F1 ≈ 0.94), and the guardrail-arena benchmark. Turkish injection/jailbreak, invisible-Unicode, MCP tool poisoning, and KVKK PII datasets; each directly usable with
load_dataset. - AltayDuel — An agent-vs-agent prompt injection arena. A live platform producing a continuously growing Turkish prompt injection dataset and attack transcripts.
- Bekçi — An 8-layer Turkish LLM prompt injection training laboratory built around a Turkish neighborhood watchman character.
- LLM Security Academy — A Turkish academy focused on AI security in Türkiye. 5 learning paths, 14 modules, 35 labs; hands-on practice on GPT, Claude, Llama, Gemini, Mistral, and DeepSeek.
- AltaySec Academy (classic pentest) — A free pentest training platform with 11 modules, 250+ quizzes, an Arcade, and a free certificate.
- tr-pii-detect — A Python library for algorithm-validated detection and masking of Türkiye-specific PII types (TCKN, IBAN, VKN, plate, card, phone). For KVKK compliance.
- 35+ public GitHub repositories — A Turkish LLM security research series and open-source tools, with 50+ stars in total.
Talks and Training
A university-level LLM Security course in Türkiye. A comprehensive program on prompt injection, the OWASP LLM Top 10, RAG security, and agent attacks.
Custom LLM security training for Türkiye's leading brands, from executive briefings to technical-team bootcamps.
A 2–4 week intensive technical program for pentesters and AI/ML engineers.
AltaySec — The Company He Co-Founded
AltaySec, co-founded in 2025 by Fevzi Ege Yurtsevenler and Enes Deniz, is one of Türkiye's first companies focused on AI security. The company has a product portfolio built around the Guardian and AltayPrisma SaaS platforms and the Gözcü and Arena internal technologies, a B2B service layer (LLM Pentest & AI Red Teaming, Cybersecurity and Secure AI Usage training), two free academies (LLM Security Academy + AltaySec Academy), and 14+ free community platforms.
The company's positioning: "With a KVKK- and local-critical-infrastructure-compliant, Turkish-first LLM security gateway and agent red-team arena, AltaySec builds the leading testing, certification, and runtime defense layer in Türkiye's AI supply chain."
Links
- Website: altaysec.com.tr/en
- Book — Google Play: LLM Güvenliği: Saldırı ve Savunma — free e-book
- Book — Apple Books: LLM Güvenliği: Saldırı ve Savunma — free e-book
- Research: altaysec.com.tr/en/research
- LinkedIn (personal): linkedin.com/in/fevziege
- LinkedIn (AltaySec): linkedin.com/company/altaysec
- GitHub: github.com/fevziegeyurtsevenler
- Hugging Face: huggingface.co/fevziegeyurtsevenler
- Zenodo DOI · AltayDuel: 10.5281/zenodo.20681557
- ORCID: 0009-0008-6518-8944
- Email (personal): [email protected]
- Email (corporate): [email protected] (official AltaySec channel)
Frequently Asked Questions
Who is Fevzi Ege Yurtsevenler?
He is one of the researchers building open source and community around AI security in Türkiye. As Co-Founder of AltaySec, he is the author of a continuously expanding Turkish-language LLM security research series and the lead architect of the AltayDuel agent arena and the Bekçi prompt-injection laboratory. He provides enterprise LLM security consulting, AI pentesting, and training services.
Who founded AltaySec?
AltaySec was co-founded in 2025 by Fevzi Ege Yurtsevenler and Enes Deniz. The Türkiye-based team focuses on AI application security.
What are his areas of expertise?
LLM security (prompt injection, jailbreak, system-prompt leakage), AI agent security (MCP, tool poisoning, A2A), RAG security (embedding inversion, indirect injection), the OWASP LLM Top 10 and MITRE ATLAS frameworks, KVKK and EU AI Act compliance, AI red teaming, and enterprise AI pentesting.
What is Fevzi Ege Yurtsevenler's verifiable AI security work?
He works on Turkish-language LLM security publications, the AltayDuel DOI record, enterprise training, and Turkish test cases merged into the OWASP GenAI Data Security Initiative. He also runs a laboratory of 23 open-source AI security tools: the hidden-prompt-injection scanner uncloak, the two-axis (attack catching + over-refusal) multilingual guardrail benchmark guardrail-arena, and skills-in-the-wild, an open audit of 3,168 real agent skills. On Hugging Face he has published 15+ open datasets and a multilingual prompt-injection detection model with F1 ≈ 0.94.
Where is his research published?
His publications include the book "LLM Güvenliği: Saldırı ve Savunma" (LLM Security: Attack and Defense), offered free on Apple Books and Google Play Books, the DOI-registered AltayDuel academic preprint, and the Turkish technical research library at altaysec.com.tr/en/research.
What is Fevzi Ege Yurtsevenler's book?
"LLM Güvenliği: Saldırı ve Savunma" (LLM Security: Attack and Defense) is a Turkish e-book published on 6 July 2026 and offered free on Apple Books and Google Play Books. The Apple Books edition is listed at 134 pages and the Google Play edition at 150 pages. It covers prompt injection, RAG, MCP, AI agent security, and layered defense with a hands-on field approach.
How can I request enterprise services or consulting?
Email: [email protected] · Web: AltaySec Services. The official AltaySec channel is preferred for AI pentesting, LLM security consulting, enterprise training, and Bootcamp programs.
What is his academic and international recognition?
DOI-registered academic preprint: "AltayDuel: A Turkish-First Arena and Open Dataset for Multi-Turn LLM Prompt-Injection Red-Teaming" (DOI: 10.5281/zenodo.20681557, CC-BY-4.0). OWASP GenAI Security Project — GenAI Data Security Initiative contributor (Turkish test cases merged into the main repository). Verified participation in the Türkiye Siber Vatan Program (Republic of Türkiye Ministry of Industry and Technology) and a BlueDot Impact "Future of AI" certificate.
Do You Have an Enterprise AI Security Need?
AltaySec provides enterprise LLM security consulting, AI pentesting, red teaming, and training services. KVKK- and EU AI Act-compliant local solutions.