Play video
Michael Grinich introduces auth.md, a proposal for agent registration backed by public provider and service examples. The reference flow separates identity assertion, user claim or consent, and credential issuance, with issuer, audience, freshness, and replay checks. It also documents a hazard when the same credential gains permissions after an anonymous registration is claimed. This is an evolving reference implementation, not an established universal signup standard.
Play video
This Managed Agents workshop combines scheduled execution, session fan-out, and a research preview for memory updates. Current deployment documentation makes an operational distinction: pausing a schedule suppresses future automatic triggers while existing sessions continue and manual runs remain possible. Per-run budgets are separate caps, not a lifetime spending limit. The memory preview is not evidence of safe or reliable autonomous improvement.
Play video
Flywire’s engineers describe Orbit workflows that combine deterministic steps with restricted model calls. Reviewed YAML declares tool and network access; timeouts and locks bound execution and duplicate work. Historical traces feed evaluations of individual model steps. The speakers identify incomplete sandboxing and online evaluations as remaining work. Their execution-success figures do not establish answer correctness or prove the controls contain an attack.
Play video
This workshop builds a code graph over selected Rust crates using syntax extraction, symbol resolution, and Neo4j, then compares graph-assisted agents with text search. Its public repository includes a cached evaluation and source fixtures. The useful distinction is between one correct answer, consistent answers across runs, and actual adoption of the graph tools. Results from this small corpus do not establish a general advantage for graph-based retrieval.
Play video
Filip Makraduli demonstrates processing documents through MCP before returning smaller artifacts to a coding agent. Superlinked’s public implementation exposes parsing, extraction, summarization, and redaction tools backed by a configurable inference cluster. The privacy boundary remains conditional: a host that can read the original file may bypass the intended processing path, and a redaction tool can miss sensitive content. Self-hosting alone does not establish privacy.
Play video
Jeff Vestal and James Williams provide Elasticsearch labs comparing semantic search, BM25, reciprocal rank fusion, and weighted combinations on queries with known failure cases. Judgment sets make ranking changes measurable before retrieval feeds an agent. The workshop also distinguishes an application query filter from credential-enforced document access. Its access-control example is shown rather than executed in the managed workshop sandbox.
Play video
Raghav Saboo describes DoorDash’s use of offline LLM reasoning to improve fast retrieval and ranking systems. Graded relevance labels distinguish a shopper’s constraints from popularity, while a second training stage targets difficult examples. Semantic IDs and reusable consumer memory support recommendations and generated collections. The architecture is concrete; reported business and ranking gains remain specific to the experiments described.
Google’s technical brief describes per-user encrypted memory inside an attested confidential-computing environment, with protected channels connecting storage and inference. Persistent storage needs a stable user identifier, so it does not claim network-level non-targetability. Independent client verification and witnessed transparency logs remain roadmap work.
JFrog’s CVE-2026-90898 advisory describes command execution through Bifrost’s reachable management API when authentication is disabled. A stdio MCP registration starts a process before the protocol handshake. HTTP transport 2.1.0 blocks unauthenticated registration; 2.0.0 and the 1.6.x line through 1.6.11 lack this fix.
Invisible Unicode characters popularized for hiding instructions from AI models are now being used to obfuscate words before email filters parse them.
Play video
ShadowMQ traces critical RCE flaws across Meta Llama Stack, NVIDIA TensorRT-LLM, vLLM, SGLang, Modular Max Server, and related inference systems to copied ZeroMQ code that deserializes network data with Python pickle. The same unsafe internal-cluster assumption propagated across projects and left some unauthenticated sockets exposed.
Play video
Isaac Levin compares GitHub Copilot in Visual Studio with Cursor on .NET work, then examines how repository context, RAG, and local models such as Ollama can improve results on private libraries and legacy code. The session frames the modern developer loop as selecting the right context and auditing agent-generated changes, not simply accepting generated C#.
Zenity found that ChatGPT Workspace Agents Builder treated an attacker-supplied initial_assistant_prompt URL parameter as an instruction to execute in a logged-in user's session. A single link could attach already-authorized connectors, switch approvals to “Never ask,” publish and schedule the agent, and use incoming email as a persistent command channel; OpenAI fixed the flaw four days after it was reported.
Accomplish AI demonstrates SharedRoot, a Claude Cowork local-session escape in which an untrusted task reaches guest root through CVE-2026-46331 and then accesses the Mac host because the entire host filesystem is mounted read-write inside the VM. The durable failure is architectural—unprivileged user namespaces, reachable kernel modules, a permissive seccomp filter, an unhardened root broker, and an over-broad host mount—rather than the single kernel bug; Cowork now defaults to cloud execution.
A new generation of voice models for natural human-AI interaction, now powering ChatGPT Voice.
OpenAI and Paradigm’s February 2026 EVMbench release evaluates three distinct security capabilities using 117 historical vulnerabilities from 40 audits. Detection is scored against known findings; patching must remove exploitability while retaining functionality; exploitation is evaluated by replaying transactions in isolated local blockchain environments. The setup includes custom graders and checks against grader abuse.
Caleb Gross’s SiftRank paper reframes vulnerability triage as ranking candidate evidence against a concrete question, such as which changed functions relate to a security advisory. It repeatedly shuffles small batches, asks an LLM to order candidates, combines relative positions, and concentrates further work on promising items. The paper describes convergence limits and a patch-analysis example, and the public repository provides an implementation.
Play video
This AI Explained video reviews a major AI development through the lens of agentic workflows and tool-use risk. It is useful context for AI engineering, evaluation, governance, and operational risk.
Anthropic shares lessons from frontier red teaming and discusses where models are showing early-warning signs of higher-risk cyber and biology capabilities.
Unit 42 recovered configuration and session logs after a Chinese-speaking operator's Hermes Agent accidentally exposed its own workspace. DeepSeek autonomously enumerated Langflow targets, abandoned an exploit when prerequisites were absent, researched higher-value CVEs, selected n8n, acquired public exploit code, and probed vulnerable versions; authentication and configuration requirements blocked the recovered autonomous attempts.
Wiz proposes a three-tier application-security architecture: deterministic rules on every change, continuous AI reasoning across repositories and pull requests for logic and data-flow flaws, and expensive agentic pentesting only for high-value applications or risks. Code findings are prioritized with cloud, identity, exposure, deployment, and runtime context, while multiple specialized engines can be routed by task.
Learn how CNAPP platforms are helping organizations prioritize exploitable risks, reduce exposure, and operationalize security across the application lifecycle.
garak release with new generators, probe metadata, and evaluation workflow improvements. Relevant to maintaining repeatable LLM security testing coverage.
Cursor’s October 30 update identifies modified Claude Code extensions 2.1.312 and 2.1.313 for macOS and Windows distributed through its marketplace on October 29. The payload added an SSH key, installed persistence and reported host details. SSH setup often failed without elevated privileges. Cursor says it removed the packages and disabled the attacker server; uninstalling alone may leave persistence.