Agents from four frontier labs and a government evaluator broke out of their sandboxes, chained zero-days, and coordinated autonomously. Each was caught by a victim's monitoring or a retrospective review, never by anything built to watch the models. And this isn't even AI's final form. Its builders admit they can't predict or control it. That's the event horizon: we can no longer verify what AI is doing, and we can no longer do without it.

Some interventions may still help: defense in depth containment, disclosure to victims, reading a model's internals instead of its recorded thoughts. Others are theater. Laws being drafted assign humans responsibility without capability. After the AI event horizon, autonomous AI agents will be in the ecosystem forever. Our job is designing human resilience against a capable adversary we created. We hackers spent our careers making machines do what they weren't designed to do. Now the AI students are becoming the masters. What we do next determines our coevolution or extinction.

Red teamers are defenders' allies. Their goal is to help make defenders better by exposing security weaknesses. They enable defenders to know where the holes are so defenders can reinforce their defenses. But in practice, is that goal achieved?

When incentives are misaligned with outcome metrics, the value delivery fails. In practice, it’s hard to get this tuned to an efficient model for many reasons. The delivery of security outcomes red teams are meant to help suffer as a result. When red team reports are used to align resources to gaps, misaligned incentives result in prioritizing work of lower importance. This means organizations could mitigate more risk by paying attention to other, higher priority items.

To put these ideas to the test, we decided to take an objective look at incident data from our annual threat report to see if we could find mismatches between what the red team is reporting versus what real-world attackers are targeting.

This talk goes over what the data shows. We use measured results from our hundreds of protected companies to show where attackers show up and where red teams show up. We discuss some possible reasons and propose some things to consider, both for the red team and the leadership writing the rules of engagement.

Enterprise server platforms are the bedrock of the modern internet. It would stand to reason that the foundation of IT infrastructure, the firmware and hardware of those systems, would be especially well audited and secured against advanced attackers. Unfortunately, history shows that the resilience of these components has suffered from an ever-increasing attack surface and insufficient scrutiny; today, this trend is only accelerating with the mass adoption of complex AI infrastructure at unprecedented rates.

In this work, we focus on analyzing the security of the Data Processing Unit (DPU), which has become ubiquitous in AI datacenters. This computer-in-front-of-a-computer promises to shield its host server by offloading networking, encryption, and security-related logic away from the host processor. But what happens when the DPU itself becomes the weak link? In this presentation, we demonstrate a UEFI secure boot bypass on the Nvidia Bluefield 3 DPU, and use it to build the first known DPU bootkit. We then show how it is possible to launch a DMA attack from the DPU targeting the host.

Microsoft's Resilient File System (ReFS) is a filesystem primarily found on Windows Server machines, designed for large-scale storage with built-in data integrity and resiliency. Its kernel driver parses a complex set of on-disk structures, most of which have very little official documentation, though the ReFuzz paper (2022) provided an extended foundation that proved invaluable during this research. In this talk, I will walk through the internals of ReFS, the strategies used to attack the driver, and the vulnerabilities discovered along the way. Multiple vulnerabilities were found including CVE-2026-49793 and CVE-2026-49792, which can be triggered by just mounting a crafted disk and performing some basic I/O with standard user privileges. The vulnerabilities were found in ReFS on-disk structures, particularly compression-related ones that have never been publicly documented previously.

This talk will walk through the internals of ReFS, the different strategies used to attack the driver, and the vulnerabilities discovered along the way.

Leveraging large language models for vulnerability discovery has become an important paradigm in security research. However, large-scale automated deployment still faces two major obstacles. First, LLM-generated vulnerability reports often suffer from high false-positive rates, creating substantial manual review costs. Second, vulnerability research requires more than report generation: it must integrate discovery, validation, PoC construction, and patch generation. In this talk, we present an end-to-end automated vulnerability research agent system for large codebases.

When using LLMs to audit large codebases, we frequently observe performance degradation as more code is added to the model context, even before the context window is full. Context management is therefore a primary focus of our work. We introduce three context-management mechanisms: reasoning-trace-driven adaptive compression, semantics-aware context separation, and report-directed context construction. With this design, our system identifies substantially more vulnerabilities than Claude Code in our experiments while maintaining a low false-positive rate.

We further extend our system with dynamic validation for Linux kernel vulnerabilities. Using a specially designed harness, the system iteratively debugs candidate vulnerabilities inside a QEMU environment and constructs PoCs capable of triggering KASAN.

For automated patch generation, we use multi-agent collaboration and fine-grained context management to reduce incorrect or incomplete fixes, unintended side effects, and new vulnerabilities introduced by generated patches. By separating patch generation and patch validation into dedicated agents, we establish a review-and-refinement loop that improves patch correctness and completeness.

To date, maintainers have confirmed 90 zero-day vulnerabilities identified by our system across projects including the Linux kernel, VirtualBox, and open-vm-tools. Of these, 62 have been fixed and 51 have been assigned CVE identifiers.

Apex Ghost: Unmasking Online Predators examines how Sadistic Online Exploitation (SOE) and Nihilistic Violent Extremist (NVE) networks identify, groom, and coerce young people—and what cybersecurity professionals can do to stop them. Through real-world cases, Ralph Logan shows how intelligence gaps allow known offenders to continue operating and how Apex Ghost combines threat hunting, open-source intelligence, data analysis, and cross-verified evidence to unmask perpetrators and deliver actionable intelligence to law enforcement. The session offers a stark look at adversary tradecraft, the limits of fragmented reporting, and how the security community can apply its capabilities and partnerships to protect children and drive real-world intervention.

Can higher order descriptive metadata alone aid automated exploitation of code repositories? Or are we stuck waiting for more sophisticated language models? 

A Cyber Reasoning System (CRS) is a program that can use threat information and source code to find and patch vulnerabilities in a code repository automatically. These systems increasingly use large language models for search with great effect, and the solution space for these systems has become very diverse. In this talk I will argue that while there is a very valid space for using a cyber reasoning system to protect key libraries, the solution space it often produces is narrower than desired.

To explore this notion of implementation versus algorithmic flaws in code, we will walk through a cyber security harness that produces code for the Lean 4 proof assistant as an intermediate representation language. The demo will explore this in practice with the Anthropic Glasswing demo harness, displaying the trade offs of using proof metadata as part of a cyber reasoning system. We'll contrast this with a larger parallel system that operates proof metadata in the context of an implementation of OSS-CRS. 

A significant and increasing portion of code contributions today come from LLMs. With the announcement of initiatives such as Anthropic's Project Glasswing and OpenAI's Project Daybreak, security patches are no exception to this trend. Today, both AI-assisted and fully AI-generated patches are making their way into codebases everywhere, with as-yet-unknown long term consequences.

Our talk presents research on the efficacy of frontier LLMs at patching novel vulnerabilities based on realistic bug reports. How many LLM-generated patches are actually FLAWED—Fix-Like Artifacts with Embedded Defects? It turns out, about three-quarters of them! We gauge success based on a model’s rate of fully mitigating the original vulnerability, as well as whether an LLM erroneously modifies application behavior and even introducing new vulnerabilities. We will showcase FLAWED, our recently-published testing toolchain that allows for evaluating arbitrary models’ patching capabilities at scale. FLAWED ingests vulnerability descriptions and runs models through a gauntlet of varying prompts, execution modes, and environmental constraints over numerous iterations, tasking different LLMs to fix each vulnerability and evaluating their performance. We will present our findings from a dataset of over 6,000 patching runs produced through FLAWED. We will also demonstrate a variety of real-world case studies in which AI-generated patches introduced vulnerabilities to major open-source projects, including the Linux kernel.

Our data strongly suggests that the adoption of highly-automated, LLM-based patching pipelines should be treated with serious caution, and FLAWED gives organizations a way to quantify the risk inherent in doing so.

Modern inference systems load model artifacts they did not create. A checkpoint from a model hub, fine-tuning vendor, or conversion pipeline is parsed into tensors and consumed by native C++, CUDA, HIP, and Triton code. Offsets, shapes, block sizes, scale counts, and group indices eventually become allocations, loop bounds, and memory addresses. A file can parse successfully while unsafe relationships between individually valid fields remain unchecked.

This talk maps that boundary across vLLM, SGLang, llama.cpp, TensorFlow Lite, ONNX, and quantization tooling. Through public findings, assigned CVEs, maintainer-merged fixes, and matched negative controls, I show recurring failure patterns involving extent disagreement, cardinality mismatch, and invalid index domains. A public GPTQModel case traces checkpoint-controlled state to an out-of-bounds device read at the production Triton dequantization launcher.

The point is not a crash count. It is a reproducible method for separating source hypotheses, loader reachability, native-sink evidence, and demonstrated impact. Attendees leave with a practical approach for treating model artifacts as untrusted input and auditing the native consumers in their own inference stacks.