Luke
Wescott.
Detection Engineer II at Sublime Security. I turn interpretable signals into better email security verdicts, and research prompt injection, calendar phishing, and AI-generated attacks.
Luke
Wescott.
Detection Engineer II at Sublime Security, working across detection engineering and machine learning to turn interpretable signals into better email security verdicts. I research prompt injection, calendar phishing, and AI-generated email artifacts. M.Sc in AI & Machine Learning. Off the clock: French lessons, hockey, books, and new music.
- Research prompt injection, Unicode tags, and calendar phishing
- Bridge the ML and Detection Engineering teams
- Maintain 800+ detection rules for hundreds of global customers
- Help lead and grow the detection team
- Built detection-as-code pipelines — +40% threat detection
- Automated detection with Python + SPL — −30% false positives
- Drove detection use cases through threat modeling
- Built proprietary SOC automation tooling — +50% tuning efficiency
LATEST RESEARCH
Hiding attacks in plain sight with invisible Unicode tag characters ↗
How invisible Unicode tags hide adversarial instructions in email aimed at AI scanners and tools.
Jul 2026 · PHISHINGCalendar phishing attacks expanding across service providers ↗
Research into malicious calendar invitations sent through legitimate service providers.
Jun 2026 · PHISHINGSurge in callback phishing attacks abusing auto notifications, verifications, alerts, receipts, and more ↗
How attackers embed callback lures in automated notifications from trusted services.
MEDIA & INTERVIEWS
The rise of calendar phishing
A conversation with Catalin Cimpanu about calendar-based phishing campaigns.
Invisible prompts and inbox AI agents
Discussing hidden Unicode instructions in invoice scams targeting AI agents.
Calendar phishing explained
Commentary on calendar scams.
Remember Postini?
Discussing callback phishing hidden in automated notifications, alerts, and receipts.