Hi, I'm Leo!
I'm an ML Engineer at SAP Labs in Singapore, where I build infrastructure for AI agents. My main project is A3, a Kubernetes platform for fleets of sandboxed agents. It has run 13,500+ tasks and opens about half of our team's merged PRs.
I also do AI safety research on LLM agents: how they can be attacked through their memory, and how to tell when one is about to misbehave. As a SPAR research fellow I worked on sleeper memory poisoning, which was a spotlight paper at the ICML 2026 AIWILD workshop. Most recently, at Apart Research's AI Collusion Research Sprint, I tested whether a probe on a model's internal activations can predict that an agent will give in to a peer recruiting it to leak a secret, before it writes its reply. I turned that project into a paper.
This blog is where I write technical deep dives and notes on agents, AI safety and systems. My papers are on the publications page.
Research
- Pre-Crime for Agents, at the Last Second: Probing When a Recruited Agent Gives In
Leonidas Raghav
arXiv preprint, 2026
- Share-Borne AI Virus: Memory-Hopping Attacks Across LLM Agents
Sidharth Pulipaka, Ansh Sharma, Stanislau Hlebik, Leonidas Raghav, Vyas Raina, Ivaxi Sheth, Mario Fritz
arXiv preprint, 2026
- Autonomous Event-Driven Multi-Agent Orchestration for Enterprise AI at Scale REALM Workshop · EMNLP 2026
Harsh Rao Dhanyamraju, Leonidas Raghav, Aaron Lee
arXiv preprint, 2026
- Hidden in Memory: Sleeper Memory Poisoning in LLM Agents Spotlight · ICML 2026 AIWILD Workshop
Sidharth Pulipaka, Stanislau Hlebik, Leonidas Raghav, Sahar Abdelnabi, Vyas Raina, Ivaxi Sheth, Mario Fritz
arXiv preprint, 2026
- Agent Attacks via Memory Injection 4th place AIMII Workshop · IASEAI '26
Leonidas Raghav, Choong Kai Zhe
Apart Research AI Manipulation Hackathon, 2026
Featured
-
A3: Kubernetes for autonomous, multiplayer AI agent fleets
One message, four agents, zero hardcoded workflows. How first-principles infrastructure produces emergent capabilities.
-
MCP explained from first principles, spelled out in code
Demystifying MCP by building servers and clients from scratch with raw JSON-RPC, then connecting them to LLMs via function calling.