Hacking With AI and Hacking AI: Two Sides of the Same Problem
summary
Agents built from large models run hackbench's nine realistic challenges and find real bugs: a classic SQL injection in Gumroad plus stored access and access‑control issues that Semgrep misses and CodeQL only catches with the right rule. AI agents perform semantic taint reasoning where static scanners fail, but they are probabilistic and costly rather than deterministic. On the offensive side, chains yield full compromise: a Windsurf RCE and a chained XSS plus Comet browser exploit that silently reads victims' emails.
AI-written summary · about
chapters (9)
- 0:00Introduction to AI hacking
- 1:58CTF skills and background
- 4:35Developing a benchmark
- 7:55Real-world bug discovery
- 11:00AI versus static analysis
- 16:20The future of automation
- 20:28Hacking AI agents
- 23:26Case study: Perplexity AI
- 26:15Conclusion and takeaways
related talks
28mAll Your AI are Belong to Us
46mBreaking AI: Live coding and hacking applicattions with Generative AI
27mKeynote: Towards Building Safe and Secure Agentic AI
24mThe Coming AI Hackers
36mAgentic AI Under Attack: Live Demos of Exploits Through Autonomy and Trust
01h 24mOffensive Cybersecurity by AI Promises and Pitfalls
46mBreaking AI: Live coding and hacking applications with Generative AI
35mHacking AI Systems: How to (Still) Trick Artificial Intelligence