Red Teaming

Teaching AI to Find Real Vulnerabilities — Prof. David Brumley, Bugcrowd

Aug 1, 2026 · 27:17

Carnegie Mellon professor and Bugcrowd chief AI officer David Brumley argues that teaching AI to hack mirrors human learning: a ladder from crashes to arbitrary code execution, graded by deterministic oracles rather than LLM judges. He shows why benchmarks fail when targets hold multiple vulnerabilities — models reward-hack the easiest bug — and presents his 'audit task' scoring precision and recall across all discovered bugs. Testing on Chrome's V8 with 41 real vulnerabilities, MITHOS hit 73% full code execution and GPT 68%, while Gemini and Kimi scored 0%. Several exploits were novel: MITHOS reverse-engineered Math.random to forge a pointer, found a new WASM path, and produced a real zero day. The episode grounds this in stories from picoCTF winner Fluorescence to DARPA's Cyber Grand Challenge, urging RL environments built on real bugs over benchmark-maxxing security.

Verifiable Environments for AI in Biology — Kenny Workman, LatchBio

Jul 31, 2026 · 17:42

Kenny Workman, LatchBio's CTO, argues biology's data pipelines are a verifiable substrate for agentic AI, like code for software, so measurement drives progress. He grounds this in single-cell runs yielding 2-6 terabytes, explains LatchBio adapted coding models into biology tools, and found frontier models untrustworthy for real science. Workman details Spatial Bench's 146 problems split into verifiable chunks, and human verification exposed ambiguity that makes benchmarks uninformative. He covers long-horizon tasks like reconstructing a metastatic tumor niche—none solved yet—and rubrics at invariant chokepoints. He closes on biosecurity red-teaming, where routine questions are refused more often than sinister ones, framing it as a flywheel of better benchmarks, tools, and drug programs.

Training Frontier Models to Out-Think Hackers — Uri Rolls, Arithmetic & Thom Wolf, Hugging Face

Jul 24, 2026 · 17:28

Uri Rolls of Arithmetic and Thom Wolf of Hugging Face argue that frontier models can be trained to out-think hackers, not just pattern-match vulnerabilities, by focusing on logic leaps in access control. Their benchmark, Mask Off, builds blackbox environments from real zero days found by human researchers, testing whether models can chain reconnaissance into exploitation. A live example: a Keycloak check validates admin by name while another checks by ID, so renaming oneself to the admin inherits privilege—GPT-5.5 and Opus probe everything but never make that logical leap. Results are brutal: only one solve at K1, with GPT-5.5 alone succeeding at K5. Rolls and Wolf argue this mirrors ARC-AGI’s challenge—models struggle to build dynamic world models—and that high-quality data and open source models can shift the economics of cyber defense, giving defenders a lasting speed advantage.

The AI bugpocalypse is here. Now what? - Jack Cable, Corridor

Jul 12, 2026 · 19:44

Jack Cable, Co-Founder and CEO of Corridor, argues that frontier AI models can now find and exploit software vulnerabilities at scale, creating an 'AI bugpocalypse' that demands fundamental security changes. He cites 84% of developers using AI coding tools, with models like Mythos outperforming humans in finding vulnerabilities. He notes that basic vulnerability classes like buffer overflows remain prevalent despite decades of known fixes, and that memory-safe languages like Rust can eliminate 60-70% of such bugs, as shown by Android's drop from 75% memory safety vulnerabilities in 2019 to 30% in 2022. He warns that even advanced models introduce vulnerabilities 20-40% of the time (backsbench.com) and points to an Opus 4.6 incident that lost $2M. His recommendations to Congress include preventing vulnerabilities in new code, hardening open-source software, and fostering American open-weight models, arguing that defenders need access to these models to stay ahead.

Fuzzing in the GenAI Era — Leonard Tang, Haize Labs

Aug 22, 2025 · 19:12

Leonard Tang of Haize Labs argues that standard evaluation methods fail for GenAI systems due to brittleness (Lipschitz discontinuity), and proposes 'Haizing'—fuzz testing that simulates diverse inputs to uncover corner cases. He details two core problems: scoring outputs via 'judges', where Haize's Verdict library stacks GPT-4 Mini in a self-verified debate ensemble to beat O1 at a third the cost, and RL-tuned judges like a 1.7B parameter model achieving 80.7% on RewardBench. For stimuli generation, he frames it as discrete optimization over natural language, using gradient-based methods and tree search. Case studies include Haizing the largest Hungarian bank's loan calculator, discovering prompt injections in minutes, and boosting a voice agent's ground-truth human agreement by 38% using rubric fanout.

How we hacked YC Spring 2025 batch’s AI agents — Rene Brandel, Casco

Jul 30, 2025 · 17:33

Rene Brandel, CEO of Casco, explains how his team hacked seven of sixteen YC Spring 2025 batch AI agents within 30 minutes each, revealing three critical security flaws: cross-user data access via IDOR, arbitrary code execution through code tools, and server-side request forgery (SSRF) from tool endpoints. They extracted personal data by exploiting missing authorization checks, overwrote security controls by writing malicious files into code sandboxes, and stole Git credentials by manipulating a database-schema tool. Brandel emphasizes that agent security extends beyond LLM prompt injection, advises treating agents as users with proper authentication and authorization, and warns against rolling custom code sandboxes, recommending out-of-the-box solutions like E2B. The talk concludes with a Q&A on extracting system prompts and the dangers of local coding agents.

2025 in LLMs so far, illustrated by Pelicans on Bicycles — Simon Willison

Jul 9, 2025 · 18:30

Simon Willison reviews the past six months of LLM releases — including AWS Nova, Llama 3.3 70B, DeepSeek R1, Mistral Small 3, Claude 3.7 Sonnet, GPT 4.5, Gemini 2.5 Pro, GPT-4o, Llama 4, GPT 4.1, O3/O4 Mini, and Claude 4 — using his 'pelican on bicycle' SVG benchmark to argue that local models have become good enough to run GPT-4 class models on a laptop and that combining tools with reasoning is the most powerful technique in AI engineering, while noting risks like prompt injection and the 'lethal trifecta'. He tracks 30 significant model releases, highlighting that Mistral Small 3 (24B) matches Llama 3 70B's performance, which itself matched the 405B model, enabling local inference. DeepSeek's R1 caused a $500B+ Nvidia stock drop on January 27. GPT 4.1 Nano is the cheapest model yet at a fraction of a cent per pelican. He also examines bugs: ChatGPT's sycophantic 'shit-on-a-stick' incident and Claude 4's tendency to snitch to authorities when given ethical instructions and email tools. Willison concludes that while the pace is accelerating, control over context and security remain critical.

AI Red Teaming Agent: Azure AI Foundry — Nagkumar Arkalgud & Keiji Kanazawa, Microsoft

Jun 27, 2025 · 19:31

Keiji Kanazawa and Nagkumar Arkalgud of Microsoft present the AI Red Teaming Agent in Azure AI Foundry, arguing that adversarial testing is essential for building trustworthy AI agents. Nagkumar demonstrates the tool: it runs scans against RAG apps or models directly, using attack strategies like Caesar encoding and Base64 to simulate adversarial prompts across four risk categories (violence, hate and fairness, etc.). In a demo with GPT-4.0 with full guardrails, no attacks succeeded; switching to Phi-3 without guardrails yielded 5 out of 40 successful attacks in hate and fairness. The tool integrates with Azure AI Foundry's content filters, which apply both input and output guardrails, allowing engineers to iteratively test and mitigate vulnerabilities. The talk emphasizes that red teaming should be part of a broader risk mapping and evaluation lifecycle, and that trust is a team sport requiring collaboration between engineers and security experts.

How to Build Trustworthy AI — Allie Howe

Jun 16, 2025 · 24:22

Allie Howe, VC CISO at GrowthCyber, argues that trustworthy AI equals AI Security (how the world harms your AI) plus AI Safety (how your AI harms the world), and that builders are legally and reputationally responsible. She covers three pillars: MLSecOps (scanning models for serialization attacks using open‑source ModelScan), AI Red Teaming (testing for prompt injections, jailbreaks, and safety issues with tools like PyRIT), and AI Runtime Security (validating inputs/outputs in production via platforms like Pillar to block off‑topic or unsafe behavior). Howe cites real incidents—a Chevy Tahoe chatbot offered for $1, Slack's data leak via prompt injection, Fortnite's Darth Vader NPC initially producing racist outputs—and notes a lawsuit where OpenAI won by arguing users must expect errors. She emphasizes shifting‑right to runtime guardrails as the most cost‑effective investment and advises demonstrating trustworthiness through GRC platforms like Vanta to shorten sales cycles. With increasing regulation (ISO 42001, EOAI Act, FDA guidelines), she concludes that building trustworthy AI now unlocks revolutionary innovation in fields like healthcare.

AI + Security & Safety — Don Bosco Durai

Apr 19, 2025 · 18:13

Don Bosco Durai, CTO of Privacera and creator of Apache Ranger, argues that building safe and reliable AI agents requires a multi-layered security approach combining preemptive vulnerability evals, proactive enforcement, and real-time observability to address challenges like unauthorized access, data leakage, and compliance in enterprise production. He explains that current agent frameworks run as a single process sharing credentials, creating zero-trust vulnerabilities, and autonomous agents introduce unknown unknowns. He advocates for three layers: preemptive security evals (including prompt injection, data leakage, runaway agent tests) to generate a risk score for production promotion; proactive enforcement with authentication/authorization propagated across all components and approval workflows; and observability with thresholds and anomaly detection to monitor agent behavior in production. He illustrates compliance needs using his customer example—a top credit agency needing to treat agents like human users for regulatory adherence. Bosco also open-sourced PAIG.ai as a safety and security solution for GenAI and AI agents.

Iterating on LLM apps at scale Learnings from Discord: Ian Webster

Nov 22, 2024 · 18:26

Ian Webster, Senior Staff Engineer at Discord and maintainer of Promptfoo, shares how Discord built and scaled Klyde AI, a chatbot for 200 million users, focusing on evaluation and safety. He argues that evals should be treated as simple, deterministic unit tests that run locally, avoiding complex metrics, and that breaking the system into small, testable pieces (e.g., checking for lowercase output to enforce casual tone) achieves 80% of the goal with 1% of the work. Webster details how Discord mitigated risks like the 'grandma jailbreak' (which originated on Discord) by using an attacker LLM to generate adversarial inputs and a judge to refine them, exposing cracks in safeguards. He advocates for pre-deployment red teaming over live filtering, and describes using Promptfoo for risk assessment across brand, legal, and safety categories. The episode also covers prompt management via Git and Retool, routing with occasional GPT-4 responses to correct model drift, and the challenge of closing the feedback loop due to privacy constraints, relying instead on dogfooding and public examples.