Keycloak

Training Frontier Models to Out-Think Hackers — Uri Rolls, Arithmetic & Thom Wolf, Hugging Face

Jul 24, 2026 · 17:28

Uri Rolls of Arithmetic and Thom Wolf of Hugging Face argue that frontier models can be trained to out-think hackers, not just pattern-match vulnerabilities, by focusing on logic leaps in access control. Their benchmark, Mask Off, builds blackbox environments from real zero days found by human researchers, testing whether models can chain reconnaissance into exploitation. A live example: a Keycloak check validates admin by name while another checks by ID, so renaming oneself to the admin inherits privilege—GPT-5.5 and Opus probe everything but never make that logical leap. Results are brutal: only one solve at K1, with GPT-5.5 alone succeeding at K5. Rolls and Wolf argue this mirrors ARC-AGI’s challenge—models struggle to build dynamic world models—and that high-quality data and open source models can shift the economics of cyber defense, giving defenders a lasting speed advantage.

Building Protected MCP Servers — Den Delimarsky and Julia Kasper, MCP Steering Committee & Microsoft

Jun 20, 2025 · 20:13

Den Delimarsky and Julia Kasper, Microsoft engineers on the MCP Steering Committee, explain how the new MCP authorization spec simplifies securing remote MCP servers by separating the resource server from the authorization server, eliminating the need for developers to build custom token factories. They argue that developers shouldn't need to be security experts, so the spec offloads token minting and lifecycle management to standard identity providers like Entra ID, Okta, or Auth0. The client now handles the full OAuth 2.0 dance, while the server only validates tokens via a Protected Resource Metadata (PRM) document. A live C# SDK demo shows a server configured with minimal code, and an Azure API Management deployment demonstrates production-ready remote MCP servers with OAuth proxy and consent flows, including integration with VS Code and GitHub Copilot. The session also previews transforming REST APIs into MCP tools via Azure API Management.