[ Schedule ]

You must budget tokens for model safety. The major model providers do it, so should you. This talk will discuss a variety of approaches, including their downsides, and give you the tools to incrementally improve your own environment.

Abstract pending.

Letting an LLM agent loose on a live CAN bus, using a consumer portable power station as the target. The harness, permission gates, instrumentation and physical isolation it took before an agent could safely touch real hardware.

AI agents live a solitary life, spending most of their time stuck in (at best) a virtual reality. This talk follows the journey of letting them out into the real world to perform CAN bus reverse engineering. Recent LLMs have crossed the line from CAN an LLM perform this, into HOW can an LLM carry this out - and this talk explores what that shift looks like using hardware, not software. Using a consumer portable power station as a target, I'll walk through the harness, permission gates, instrumentation, feedback loops, and safety controls needed before an agent can interact with a live embedded system.

Two Windows bugs found with a frontier model, the first in just over an hour, and the human direction it took to get there. Then the same hunt replayed on open-weight local models to measure how much frontier capability survives.

At the frontier, the first legitimate 0-day finding appeared 1 hour, 16 minutes, 5 seconds after the initial request. Two Windows system-service 0-days anchor this talk: an information disclosure developed into an attacker-steerable privileged read, and a use-after-free developed through lifetime analysis, controlled reclaim, and heap grooming into write-what-where. I walk through the pattern behind both discoveries, from reconnaissance to validation, PoC, and closure. The speed is real, but it was not autonomous. The frontier model needed direction, correction, encouragement, and help with tools. It initially refused the PoC. That human work is part of the result. The talk exposes the process behind a successful bug hunt at the frontier, then comes back to test how large the gap to local models really is and what it takes to close it. I replay the hunt with the latest open-weight models, including Qwen, Gemma, GLM, and more. Same target. Same context. Same tools. Short tests isolate individual capabilities. Full runs ask whether a model can discover, validate, use the tools, reject false leads, and finish. If a local model fails, I add one measured piece of scaffolding and try again. How much frontier capability survives locally, and how much help does it need?

Voltage-glitching a commercial NPU to make an edge-AI camera see phantoms, or nothing at all, with LLM agents left to search the fault space overnight. Why neural accelerators are an emerging hardware attack surface.

Edge AI systems power everything from smart cameras and drones to robots and autonomous machines. These devices rely on neural processing units (NPUs) to run computer vision models (CNNs) that decide what the system "sees." But what if you could convince the hardware to see something else… or nothing at all? And what if you can have an LLM do the heavy lifting? Is there no limit to AI relevant abbreviations in a talk title?

In this talk, we show how classic hardware fault injection techniques can manipulate AI inference on real edge devices. By injecting precisely timed voltage glitches on a commercial NPU SoC, we can perturb neural network execution without modifying the model, firmware, or software stack.

Using a Rockchip RK3568 platform running YOLOv5, we demonstrate a range of effects: objects that suddenly disappear, phantom detections appearing out of nowhere, drifting bounding boxes, and the occasional confidently wrong answer. The system keeps running happily, completely unaware that its perception has been tampered with.

Exploring the enormous fault parameter space, however, is tedious for humans. So instead of turning knobs manually, we let LLM-driven agents take over. These agents analyze detection outputs, adapt glitch parameters, and autonomously search for effective fault conditions, running overnight while we sit back (or sleep).

The talk walks through the full attack workflow: observing inference execution through electromagnetic emanations, aligning glitches with neural network stages, and using autonomous agents to optimize the attack. We conclude with implications for the security of edge AI systems and why neural accelerators may represent an emerging hardware attack surface.

A technical look into BinChomp, an autonomous N-Day pipeline focused on the Windows Kernel.

Inside the event-driven agentic detection and response system Slack's SecOps team has run in production since April 2026, told through a no-notice red team exercise it caught, correlated and mapped end to end before an analyst was notified.

Slack's Security Operations team has built an event-driven, agentic detection and response system, in production since April 2026. An event router creates observer agents that each watch one slice of the environment (an alert rule, a repository, a service), learn what normal looks like there, and emit structured signals. Watchdog agents read across those signals, correlate what no single observer can see, and autonomously launch agentic security investigations, which are surfaced to human analysts in Slack for real-time collaboration. Every agent action is recorded in a searchable event stream, so the team can audit and analyse agent behaviour. This talk tells the story through a real, no-notice red team exercise: an adversary simulation caught, correlated, and mapped end to end before an analyst was notified. It draws out the design principle behind it: don't model the attack, model the environment, and give it a memory.

Traditional Static Application Security Testing (SAST) is highly effective at identifying syntax-based vulnerabilities like SQL injection or Buffer Overflows, but completely blind to RBAC Privilege Escalation. These bugs do not violate language syntax; they violate application-specific business logic. A tool cannot detect them without deeply understanding the "business context": what roles exist, what permissions they imply, and how objects relate to their owners. This talk presents a paradigm shift in AppSec: Semantic-Grounding SAST. We introduce AuthMatrix, an agentic scanner we developed internally that extracts business context directly from source code to construct a dynamic "Knowledge Base." This knowledge base codifies complex roles, feature flags, and app specific user role boundry (e.g., ignore the difference between superadmin and admin). Guided by this context, LLM-based subagents execute semantic reasoning to hunt for authorization discrepancies with 89-94% precision. Attendees will learn how to build agentic pipelines that reconstruct business semantics, paving the way for automated logical vulnerability detection in massive, enterprise-scale web applications.

A three-month study adjudicating 630 agent-generated vulnerability findings against the code at the reported line. In their data, precision depended more on method than model, the more expensive frontier model did worse on static analysis, and verification is still the bottleneck.

LLM agents can already carry some vulnerability investigations from discovery to exploitation. In one of our tests, an agent decompiled a stripped binary, identified an overflow, and produced a working exploit against a live service. That result led us to a broader question: how often do agent-generated findings survive code-level verification?

Verification requires tracing attacker-controlled data to a sink, checking whether a real request can reach it, and deciding whether the weakness is exploitable. This process determines whether a client can act on the report or will lose trust in it. Today, a human still has to read the relevant code line by line. That manual review becomes the bottleneck in an automated pipeline, yet published results rarely measure it.

This session reports a three-month study of two models across multiple targets, including source code, real Java repositories, stripped ELFs, live web applications, Android APKs, and Solidity contracts. Across these targets, we collected 630 findings and adjudicated each one against the code at the reported line rather than the model's summary.

Precision depended more on method than model. Confirmation-based approaches reached 79-100%, while static analysis of real codebases reached 65-77%. On the static-analysis target, the more expensive frontier model performed worse: 285 findings with 99 false positives, compared with 169 findings and 39 false positives from the cheaper model. These results led us back to verification. A binary true-positive/false-positive verdict proved too crude, and an LLM judge drifted toward "uncertain" as the workload grew. We also document reproducible pipeline failures that looked like clean results.

Prompt injection gets treated as a text problem, something that arrives over an API. But more and more of what an LLM reads into context starts in the real world: a swiped badge, a scanned barcode, an NFC tap, a Wi-Fi probe. With a Flipper Zero, a Rubber Ducky, or a $5 printed label anyone can drop an injection string into one of those channels and let it ride through the scanners, logs, and SIEMs until a downstream agent reads it and does what it says. You get nothing back when you plant it. It's blind prompt injection, and it fires later. The talk will walk the attack path, discuss some of its nuances, and finally demo and release a new open source prompt injection field kit working with Pineapple Pagers, Flipper Zeroes, and many more. Bring your devices and let's map this surface together.

AI can dramatically reduce the time it takes to complete a task, but verifying the result often takes just as long as doing it yourself. This talk explores how to build AI workflows where conclusions are grounded in traceable source material and reproducible analytical pipelines.

Capture the Narrative is a CTF-style massively multiplayer wargame in which 288 Australian university students ran LLM-powered bot campaigns to swing a simulated election. The competition, what it taught, and the dataset it produced for future research.

LLM-powered bots are influencing social media around the world, amplifying the effects of misinformation and disinformation. Detecting if content is being promoted or manipulated by such bots is difficult, both for casual observers of social media platforms as well as for platform operators faced with continuous "cat and mouse" development by malicious adversaries. To address both challenges, we produced "Capture the Narrative", the world's first CTF-style massively-multiplayer wargame for social media manipulation. Over four weeks in 2025, 288 students formed 70+ teams from Australian universities and competed in a multiplayer competition to manipulate an in-house social media platform we called "Legit Social". They were aiming to swing a simulated election in a fictional country, a task which they ultimately completed by moving the electorate by 1.8 percentage points. In this talk I will introduce the competition, as well as discuss its outputs, which include the associated awareness campaign as well as a collaboratively developed dataset made up of survey data, developed bot software, and recorded bot activity for the thousands of bots producing millions of artificial posts to amplify in-game misinformation.

Succeeding as a threat analyst in the Google Threat Intelligence Group requires building deep domain-specific intuition to navigate our massive internal systems and the unique combined intelligence of Google and Mandiant. Because human intuition doesn't scale as fast as our adversaries, we need to augment our workforce with an army of AI analyst agents to meet a threat landscape that is rapidly growing in volume and sophistication.

This session explores how we are building AI to operate in this complex environment. I’ll share how we're training these agents to work alongside our human analysts, what is actually working in practice, and what this means for the future of threat intelligence.

Exploitation is a ladder, not a coin flip. ExploitBench grades LLM agents across 16 capability flags against real V8, from first crash to arbitrary code execution, and shows where today's models actually stop.

Benchmarking LLMs on vulnerability discovery and exploitation capabilities — results and lessons learned.

Fuzzers reach the vulnerable code and still miss the bug because coverage tracks lines, not state. StateLens has an LLM identify security-relevant internal states offline and lets a conventional fuzzer do the search: 68 previously unknown bugs across six production JavaScript engines.

Structural coverage is the dominant metric for evaluating fuzzers, yet many bugs in JavaScript (JS) engines are triggered by specific internal states that are not captured by line or branch coverage. As LLMs have demonstrated strong reasoning capabilities, an increasing trend is to use them for auditing code or generating fuzzing inputs. However, directly using LLMs for JS engines is not practical due to huge code bases, high False Positive (FP) rates, and high cost.

We propose StateLens, a novel approach that combines the strengths of LLMs and fuzzing through the unique lens of state coverage. Instead of asking an LLM to directly generate fuzzing inputs or predict vulnerabilities by auditing, StateLens uses it offline to identify security-relevant internal states and synthesize feedback probes; a conventional fuzzer then performs the online search at high throughput.

Across six production JavaScript engines, StateLens uncovered 68 previously unknown bugs, at least 35 with confirmed security implications. Some of our bugs have been publicly acknowledged or rewarded by Google, Meta, and Apple. Compared with state-of-the-art (SOTA) JS engine fuzzers, StateLens finds more bugs in the same time frame.

We have seen an incredible increase in AI's offensive capabilities. Presumably, that is why we are all here! AI is putting sophisticated hacking capabilities into more hands enabling attackers to operate at a larger scale than ever before through automation. As a Red Team, we think a lot about what adversaries will try next. In this talk, I will discuss how we predict different types of real-world attackers will leverage AI, ranging from industrialized social engineering and low-cost bespoke tooling to supply chain attacks and machine-speed system exploitation. I will share our experiences designing, building, and deploying our own offensive AI tools, ranging from human-in-the-loop copilot-style tools to (near-)autonomous Red Team exercise campaigns.

The Australi.ai co-founders on how agentic AI is commoditising the artisanal skills cyber careers were built on, and why Australia should build that capability domestically rather than rent it from foreign vendors.

Australian cybersecurity is entering its own industrial revolution, and most of the profession has its head in the sand. The skills that defined cyber careers, artisanal, tightly held and expensive, are being commoditised by agentic AI faster than anyone wants to admit. A skilled pen tester is still valuable, but a competent operator running a swarm of agents is a different category of capability altogether. The same compression is hitting assurance, SecOps and GRC. The work that used to require a specialist is increasingly a repeatable process.

This is not a distant projection. Open models have now crossed the threshold of reliability for long-horizon agentic tasks, which means the capability no longer depends on a large budget or a deep investment in tooling. That lowers the barrier to entry for everyone, including those who will use it to do harm, and it can be stood up for a fraction of what most businesses assume. The result is a K-shaped profession: a minority who harness the tooling accelerate away, while everyone else risks being left behind.

Cole Cornford and Ben Gittins, founders of Australi.ai, argue this future does not have to be so unevenly distributed. The large model companies are already making these decisions for us, releasing product after product designed to pull practitioners into their ecosystems. The same forces driving the disruption can instead be turned into cheap, open, domestic capability, so Australian businesses can conduct business the Australian way rather than renting their core competence from foreign vendors.

This talk covers what is actually happening across Australian cybersecurity, why it amounts to an identity crisis for the profession, and what practitioners and businesses can do about it. The focus is defensibility and economic viability, not the compute hype cycle that dominates most AI conversations. Attendees leave with a pragmatism-over-hype view of where the work is going, the data to back it up, and a concrete set of next steps for today, tomorrow and later.

A first-hand account of working with AI agents to turn two macOS vulnerabilities into controlled kernel read/write and root, and a look at where the models helped, where they did not, and what that means for modern mitigations.

Powerful frontier models have been increasingly successful at turning money into vulnerabilities in mature attack surfaces. Recent models have also begun to show a promising ability to turn vulnerabilities into proof-of-concept exploits. Given the speed of change around model capability, it's no surprise the security community has had a hard time assessing the jagged edges of capability when it comes to agent assisted exploit development. We share our experience working with agents to exploit two interesting vulnerabilities in a macOS to gain controlled kernel read and write and how we gained root code execution from there. We'll discuss the exploit techniques we used, how we worked with AI to discover, implement, and refine them. Finally, we reflect on when and how our model use was efficient for exploit development (for reasoning, tool development, analysis, or not at all).

AI is transforming how we work, how we build software, and how we interact with technology. But it is also creating an entirely new ecosystem that few organizations understand or control... and attackers know it!

AI agents, models, MCP servers, skills, prompts, tools, identities and AI supply chains have become new attack targets. Threat actors are not only using AI to accelerate their operations; they are actively targeting the AI infrastructure organizations are deploying every day. Their tradecraft has evolved, and defenders need to evolve with it. In this session, we will review how attackers abuse AI systems and explore the emerging AI threat landscape. We will discuss how to operationalize AI Threat Intelligence to detect, monitor, and respond to threats across your AI ecosystem.

Zenshin, an LLM auditor that only hands over reproduced WebKit bugs: call-graph reachability, cross-model debate, and an ASAN binary as the final judge. Eight WebKit CVEs so far, plus the funnel numbers and where it still falls flat.

Point an LLM at a few million lines of WebKit and it will happily hand you a wall of plausible-sounding bugs, almost all false. This talk is about the machine I built (Zenshin) that instead hands me *reproduced* ones — validated by an actual call graph, argued down by a cross-model debate, and only accepted once an AddressSanitizer binary agrees. It has found 8 Safari CVEs so far, with 2 more awaiting fixes. I'll walk through the full pipeline, the design decisions that turned "plausible" into "proven," real bugs from diff to exploitable primitive, the numbers (candidate → crash → primitive funnel, cost, false-positive rate), and — just as important — where it falls flat and why turning a crash into impact is still a human job. If you're trying to get *real* memory-safety bugs out of an LLM on a large C/C++ target, this is what worked and what didn't.

Once a security fix becomes public, the diff becomes a roadmap to the vulnerability. An attacker can reconstruct the missing invariant and start building a trigger before a CVE or advisory tells defenders that the affected package is at risk. Industry calls this interval between public fix and public disclosure the Negative Day.

We built an AI-driven pipeline that starts from a package and version, resolves it to an upstream repository and tag, and scans the commits that landed afterward. Each commit is given to a bounded analysis agent with its diff, message, and pull-request context. The agent must reconstruct the pre-patch flaw, identify an attacker-controlled path, and produce a concrete trigger. If it cannot do all three, the commit is rejected as ordinary hardening or bug fixing. Positive candidates are later linked to OSV, CVE, and GHSA records so we can measure whether the agent identified the issue before conventional feeds caught up.

The interesting AI problems appear after the first prompt. Which parts of a large diff belong in context? Does PR text help, or leak the answer? How do we keep a malicious commit from prompt-injecting the detector reviewing it? How do we separate a plausible generated PoC from one executed against both vulnerable and fixed revisions? How do we evaluate the system without giving it the advisory or gold patch?

The current evaluation corpus replays 39 real security-fix windows from projects including axios, React Router, Authlib, aiohttp, Django, React, and cryptography. We will show the operational architecture, representative agent decisions, false-positive controls, benchmark design, and the remaining gap between an exploit hypothesis and independently verified vulnerability evidence.

This talk presents an AI-driven system for discovering and exploiting vulnerabilities in ElectronJS applications. By combining source–sink analysis with real-time harness generation, the approach reduces false positives and enables reliable exploit construction. Integrated into CI/CD, it scans every merge request, generates Semgrep rules from validated findings to identify similar patterns across the entire repository, and feeds results into an ELK-backed feedback loop that drives automated rule generation and runtime protections via a hardened ElectronJS security SDK.

Applied AI, self-improving loops, and a security tool that gets better every time it fails.

I keep telling people to build the tooling instead of being the tooling — use AI to build systems that do the work deterministically, not to hand-crank the work through a model every time. I went and did exactly that on a deliberately unglamorous security problem: when you find a vulnerability, who do you actually tell?

The tool I built resolves any asset — a domain, an IP, a package, a container, a piece of firmware, whatever you can point at — to a real security-reporting channel, live from primary sources, never hardcoded. This talk isn't really about the tool. It's about how it improves itself. Every lookup that comes back wrong or empty is a coverage gap the system captures, clusters, and closes, behind a gate that lets a fix ship only if it adds zero false positives against a frozen corpus. The thing gets more accurate the more it fails. Antifragility as an actual engineering discipline, not a slide.

I'll show the build in brief — what AI genuinely accelerated, and where it confidently lied to me — then spend most of the fifteen minutes on the loop itself: how a tool that rewrites its own resolution logic stays trustworthy, and what breaks when it doesn't.

The icing: the reason a problem this old keeps getting worse is also AI. AI-generated vuln reports, AI-generated code, AI-widened attack surface, the slopdemic burying maintainers in plausible nonsense. Offense scales with compute; defence still scales with committees. Building AI that keeps defensive tooling ahead of an AI-driven problem is the whole game — this is one worked example of doing it honestly.

Two case studies in LLM agents ripping through obscurity: reverse-engineering the currency detectors in photocopiers and image editors to build an unphotocopiable cat, and auto-building a faithful QEMU emulator for a laser printer. His conclusion: obscurity now buys days, not years.

Seasoned hackers have always used "security through obscurity is not security" as a mantra to discourage building systems whose security depends on no one caring enough to look too closely at the details. But in practice these systems abound, and they often remain (publicly) unbroken because human expert time is scarce. In this talk we'll show how LLMs disrupt this equilibrium via two case studies: 1) Reverse engineering currency detection algorithms used by photocopiers and image editing tools, and then attacking them to produce an image of my cat that cannot be edited or photocopied; and 2) Automatically building a highly faithful QEMU emulator for an HP M551dn color laser printer firmware, to the point where you can put it on a network, print to it, and get back faded PNGs if it's running out of emulated toner. We conclude that the security afforded by obscure environments and algorithms can now only provide a few days of protection from anyone with curiosity and tokens to burn, and discuss the implications for anyone building robust systems.