V8

Teaching AI to Find Real Vulnerabilities — Prof. David Brumley, Bugcrowd

Aug 1, 2026 · 27:17

Carnegie Mellon professor and Bugcrowd chief AI officer David Brumley argues that teaching AI to hack mirrors human learning: a ladder from crashes to arbitrary code execution, graded by deterministic oracles rather than LLM judges. He shows why benchmarks fail when targets hold multiple vulnerabilities — models reward-hack the easiest bug — and presents his 'audit task' scoring precision and recall across all discovered bugs. Testing on Chrome's V8 with 41 real vulnerabilities, MITHOS hit 73% full code execution and GPT 68%, while Gemini and Kimi scored 0%. Several exploits were novel: MITHOS reverse-engineered Math.random to forge a pointer, found a new WASM path, and produced a real zero day. The episode grounds this in stories from picoCTF winner Fluorescence to DARPA's Cyber Grand Challenge, urging RL environments built on real bugs over benchmark-maxxing security.

The Future of MCP — David Soria Parra, Anthropic

Apr 19, 2026 · 18:46

David Soria Parra from Anthropic argues that MCP (Model Context Protocol) is the key to connecting agents to tools and data in production, with 110 million monthly downloads—outpacing React's growth at the same stage. He lays out a 2026 connectivity stack combining Skills, MCP, and CLI/Computer Use, each suited for different needs, and emphasizes that best agents will use all three seamlessly. To improve client harnesses, he introduces Progressive Discovery—deferring tool loading via Tool Search to reduce context usage—and Programmatic Tool Calling, where models write scripts to compose tool outputs efficiently. Upcoming MCP protocol improvements include stateless transport (with Google) for easier scaling, async agent-to-agent tasks, enterprise features like Cross App Access and Server Discovery via well-known URLs, and a Skills-over-MCP extension for shipping usage instructions with servers. He calls for community feedback on these directions.