How NOT to Train Your Hack Bot: Dos and Don'ts of Building Offensive GPTs
summary
Demonstrates concrete experiments: using GPT-4 and gpt-3.5-turbo with vector search and retrieved context, models parse bug-bounty scopes ~70% on 30 samples, and baseline LLM APIs find 2 of 6 novel vulnerabilities (≈33%). Builds an API-agent + goal-agent pipeline (FastAPI test app “Echo”) where GPT-4 issues tool calls, decodes/base64 keys and exfiltrates drafts, succeeding about 40% of runs; hallucination, lack of statefulness and dataset contamination remain the main failure modes.
AI-written summary · about
chapters (7)
- 0:00Offensive LLM research intro
- 1:08How LLMs fundamentally work
- 9:27LLM limitations for vulnerability hunting
- 14:16LLMs in bug bounty workflows
- 27:10Live demo: LLM API hacking
- 33:26Success rates and takeaways
- 35:12Future trends and closing
related talks
30mBattling the Machine: Cutting-Edge Attacks and Defenses in Generative AI
49mChatGPT: A New Generation of Dynamic Machine Based Attacks?
32mSecurity Implications of Artificial Intelligence Synthesizers
45mHow to use GPT in your projects: A Case Study
39mBuilding Your Own Bot with GPT: Harnessing the Power of AI...
01h 01mCustom GPTs for Fun, Profit, and Potential Liability
01h 24mOffensive Cybersecurity by AI Promises and Pitfalls
38mIntroducing the New Colleague - ChatGPT