What does it actually take to build an AI system capable of finding real vulnerabilities?
In this episode of Builders&Breakers, STÖK and KUGG sit down with Hamid Kashfi. Security researcher at XBOW and DarkCell, formerly Trail of Bits and Immunity, to explore how hackbots are changing offensive security.
We discuss why the model may represent only 20% of a capable system, while the other 80% comes from the harness around it: context, memory, tools, monitoring, traces, evaluations and human expertise.
Hamid takes us inside the difference between a compelling demo and a system that can reliably understand a target, ask the right questions and produce valuable findings in the real world.
In this episode:
• Why the model is only one part of the capability
• What an effective offensive-security harness requires
• The importance of context, memory and observability
• Why deep findings begin with deep understanding
• How AI changes the role of the security researcher
• What the next generation of hackers could look like
Builders&Breakers explores high-velocity shortcuts for the people building and breaking the software of tomorrow.
Guest: @hkashfi
Builders&Breakers | Building Hackbots: Models, Harnesses and Human Expertise with Hamid Kashfi
https://t.co/E8ZFgLwbKd
@AnthonySecurity@wehackhealth Oh Man, and fomo you deserve to have :) wish you have had the energy to be there! But there will hopefully be a Next time!
Lerum 260911
Parked by a lake and leave early in the morning for the airport and @wehackhealth Belfast IV camp. 🏋️♂️
Been on the road for a few days so need to get the final packing done for an exciting but exhausting week of lifting, training, hiking, hacking, protein shakes and growth!
Packed some cameras so might vlog.
Good times,
Dropping the first episode of the spanking fresh and new BUILDERS&BREAKERS podcast ft me, KUGG, JOOHOI and a lot of smart people sharing high velocity shortcuts in uncertain times..
Available on https://t.co/ux1d4mPVaF and https://t.co/we1NOGTcNK next week.
Feels good to be back creating security related content on a regular basis.
Dropping the first episode of the spanking fresh and new BUILDERS&BREAKERS podcast ft me, KUGG, JOOHOI and a lot of smart people sharing high velocity shortcuts in uncertain times..
Available on https://t.co/ux1d4mPVaF and https://t.co/we1NOGTcNK next week.
Feels good to be back creating security related content on a regular basis.
JBL L100 CLASSIC MKII
Oh hot dang, I had no idea these existed, and that’s such a nice color scheme. The level of wants and needs for these to hang around the studio just went up exceptionally. But then there’s prob another speaker that looks even better and the rabbit hole deep dive continues.
It’s been a good while since I created content, and my studio was all over the place. But I had to get one going since im gonna be on a podcast tomorrow, and wanted to create a podcast show vibe,
And here’s a test recording straight out of camera, (no audio or grading) with some fast iPhone edit zoom cuts since yolo. And I think it works!
Oh and added a bts a shot of the messy setup for my wonderful content nerds, I don’t fck with cable mgmt, never done never will.
Anyways, i think this might even work for the upcoming BUILDERS&BREAKERS podcast! Thinking Weekly episodes, conversations with high velocity shortcuts by and for the people who build and break the solutions of tomorrow at insane speeds.
What do you think?
And does this pass as a podcast setup?
Im def ai pilled, but im also super biast since Iv seen the results they can create .
And im lucky enough to have been exposed to them and get to work with agentic systems to perform ”research” on a daily basis.
Its tools. Lovely tools. Still, tools.
And since I’m biast, i think experience and exposure matters to succeed at things. and I think that what sets my work and my results apart from someone else’s work depends on their exposure and experience. In how to steer them without nerfing, what rabbit holes that are important and what can be skipped / skimmed, Iv got decades of experience and exposure to tech / cyber and have worked in a lot of different roles and as a consultant. So got a decent exposure to the field over the years. And this experience matters when it comes to defining goals and tasks for the Clankers.
yes, the models are by far smarter than me, faster than me, maybe even more creative than me at times, I should be doomed,
But I’m ok with that, if a tool is better at a task, I’m def going to use that tool to reach my goals, and if it’s better at building another tool for me than I am, then so be it. skillz has gone from being a great tool maker / user to, (for a while responsible of the ai interns) to now be a ai swarm middle manager, that gets banger results, go team
Tbh I’m pretty certain that this is the absolute worst and the absolute best of times to be in, or enter cyber, because rules are being rewritten in realtime and it’s not a even playing field. Buckle up Dorthy,