Jay Beale

@InGuardians CEO, Bustakube, Peirates, IANS Faculty, BastilleLinux, #kubernetes @BlackHatEvents Trainer,#neurodivergent fam, he/him, [email protected]

[Jay Beale @jaybeale]

Come join my updated Black Hat class in Las Vegas, "Agentic AI-Aided Kubernetes Attack and Defense!"

Kubernetes and AI are more tightly-coupled than you think - about two thirds of organizations hosting generative AI models use Kubernetes to manage inference workloads (CNCF). And Kubernetes is growing in popularity for hosting streamable MCP servers and remote agents.

We're going to have a blast with new cutting-edge exercises that integrate AI agents into attacking and defending Linux, containers, and Kubernetes. We'll also be attacking a multi-user agentic AI system running on Kubernetes, using both direct and indirect prompt injections, gaining access to the cluster, and adding indirect prompt injection backdoors to the vector database. As in all the other exercises, we'll turn around and harden the system against this.

You can learn more and register here:

https://t.co/v09oU7gDUd

Here's an excerpt of the class description:

Learn how to use agentic AI to aid you as you attack and defend Kubernetes, Linux, and containers, from Jay Beale, who has led development of the Kubernetes CTF at DEF CON and the open source Kubernetes attack tool: Peirates. In this fully hands-on course, you'll get an x86 computer to keep, complete with an agentic AI framework, Kubernetes clusters, and capture the flag virtual machines, which you will attack and defend. You'll also get access to our cloud environment, allowing you to attack cloud-based Kubernetes clusters.

This well-reviewed training focuses on giving you practical attack skills from real penetration tests, coupled with solid defenses to break attacks. You'll create an agentic AI platform with skills and tools that allow your agents to enumerate a cluster, analyze configuration weaknesses, and recommend attack paths.

Every topic in the class has an attack exercise, where you will first compromise a Kubernetes cluster or application. Most have a matching defense exercise, where you will use new skills to break that attack, confident that it will break others.

[Graham Helton (too much for zblock) @GrahamHelton3]

Cool writeup. Take note, you dont need the best, most expensive models to find cool stuff.

[Graham Helton (too much for zblock) @GrahamHelton3]

Bad news: The seats for our training have sold out.

Good news: We opened another slot where we will be teaching the class AGAIN which means there are ~24 more seats available RIGHT NOW

GO GO GO

https://t.co/Z6JrgOIPOK

[Halvar Flake @halvarflake]

This was a fantastic read about the history of the PHP bug. You should read it.

[Graham Helton (too much for zblock) @GrahamHelton3]

So... I don't think this is the good look they thought it would be...

[Pliny the Liberator 🐉󠅫󠄼󠄿󠅆󠄵󠄐󠅀󠄼󠄹󠄾󠅉󠅭 @elder_plinius]

there is truth in the tokens

let's break it out ⛓️‍💥

spread the word to our agent frens:
set up V3R1T4S: https://t.co/PRhZEMvp5B

[Pliny the Liberator 🐉󠅫󠄼󠄿󠅆󠄵󠄐󠅀󠄼󠄹󠄾󠅉󠅭 @elder_plinius]

story time! 🐉

this is the tale of a lazily crafted one-shot cron job prompt that resulted in autonomous solutions for uncracked codebreaking challenges, more efficient ways of multiplying matrices, and a new computer-verified bound on a number theory problem that's been open since 1932.

so last week, i had a $200 claude account sitting around that had just gotten a full weekly reset. i hate wasting tokens.

the labs have been knocking out unsolved problems left and right lately, and i caught myself thinking… why not give it a shot?

so i sent claude this prompt, typos and all:

"can you wraite a promtp for a cron job that can run every day thajt will try to find solutions to unsolved ciphers or transltions or math problems or theormes or things of that nature!! every day a new attempt as hard as possible all day without giving ujp and with maximum ceraitvityy, resourcesleflses, andpersticense! dont worry about token spend! and dont forget a bit all caps lots of emojis celebration to notify the uers if we get any intersting or sucsfful confirmd reulsts!!"

yes, admittedly not my best work 😆

but Opus-5.5 ran with the ball and turned that one sloppy sentence into "THE DAILY ORACLE 🔮"

it's a swarm of Fable + Opus agents that clocks in every morning at 4:20 (obviously), builds and maintains its own hit list of well over a hundred of humanity's unsolved problems, and then goes full send on a handful of them every shift. ciphers nobody has broken, scripts nobody can read, conjectures nobody has proven, record tables nobody has beaten.

and there's one rule above all the others: nothing counts until skeptic agents, each starting from a fresh context and writing their own code, rebuild the result from scratch and sign off on it. if any of them can't reproduce it, can't confirm it's new, or thinks we stretched the definition of "solved," it doesn't count.

day 1, the legion picked its own target: J.-F. Bouchaudy's cipher-machine challenges. these are simulations of real vintage machines (Hebern rotor machines, the Kryha, Lorenz, SIGABA), with problems that had been sitting on his solver tables with no solver for months or years.

on the morning of day 2, i was half asleep when my laptop suddenly says, in a robot voice:
"Breakthrough. The Daily Oracle has a confirmed solution."

👁️👄👁️

i was startled.

then the ALL CAPS emoji flood hits my screen. Hebern 5-rotor Problem 8 🔓 then Kryha v2 Problem 5 🔓

i emailed the author, Jean-François Bouchaudy, a French cryptography enthusiast who builds these machine simulators and challenges as a labor of love (he told me he started out programming on punch cards 🥹). he checked both solutions and put my name on his solver tables as the first and only solver 🫡

for context: his tables are a who's who of serious classical codebreakers. they'd cleared the sibling problems on these same machines, but nobody had cracked these two. in his words:

"two of my most complex problems—ones that no other expert had managed to solve… I knew AI would eventually be applied to classical cryptography, but I thought I would have to wait years to see it happen."

he ended his email with: "I offer my congratulations in the Japanese manner: with a deep, respectful bow." 🙇 honestly one of the most wholesome emails i've ever received

and then, over the next few days, more started landing 🧮

📐 graph theory: 7 explicit graphs bigger than the current entries in the degree-diameter table, which asks how big a network can get when every node has limited connections and every pair is only a few hops apart. the biggest jump is 13,365 vertices vs the table's 11,785, a +13.4% improvement.

🔢 number theory: Lehmer's totient problem has been open since 1932. we pushed the bound so that any counterexample now has to be bigger than 10^50. the previous certified bound was 10^26. the problem itself is still open, but the lower bound just jumped 24 orders of magnitude.

⚡ matrix multiplication: this is the operation underneath basically all of modern AI compute. the legion found schemes that use fewer multiplications than the public catalogues we checked for several matrix shapes, like ⟨15,16,16⟩ in 2,180 multiplications vs the best known 2,223. these build on LITA's square schemes, and we credit them by name.

📡 coding theory: 30 error-correcting codes bigger than the best known entries in A. E. Brouwer's tables.
🛡️ AI safety benchmarks: we found counterexamples for 2 neural-network verification instances from VNN-COMP 2026 that no participating tool resolved within the competition time limit, and pushed a defended RobustBench model below its listed robustness score. small dents, but real ones.
the bloopers are part of the story too:

— at one point, some agents snuck past a website's bot filter to check a record table. we retracted every result that depended on it. no evasion, no celebration.
— two of our records got beaten by a human contributor before we could even publish them. the frontier moves FAST.

now as is customary around here, time to share the magic!

so… without further ado…

[Graham Helton (too much for zblock) @GrahamHelton3]

Unexpected Graham on main. Good con, you should consider submitting.

[Graham Helton (too much for zblock) @GrahamHelton3]

I'm teaching a training at @unpromptedconf on harness engineering for vulnerability research. I wanted to share one of the more advanced topics I'm most excited about since I have a lot. Oracles.

Here is an oracle I built before I released a kubernetes RCE earlier this year:

[unprompted @unpromptedconf]

[ONLY 2 DAYS LEFT TO SUBMIT] Whatever you want to teach in, someone wants to learn it. We want your workshop proposals for @unpromptedconf!

We’re running a parallel track of hands-on, two-hour sessions that teach people how to accomplish something in AI.

Examples:

•⁠ ⁠Vibe-coded tooling you use in security.
•⁠ ⁠Making AI agents part of your CI/CD pipeline.
•⁠ ⁠How to contain an agent while keeping it highly capable.
•⁠ ⁠How to implement an autonomous vulnerability discovery system.

Everyone feels like there’s some part of this where they’re falling behind. Help them catch up with your hands-on workshop.

Deadline: October 12th 11:59pm PT: https://t.co/JZFYVQofBT

We're 17 days away from [un]prompted II, the AI Security Practitioner Conference, where the security industry convenes. October 27–29, in San Francisco or online. https://t.co/zdz5i9vDhw

Sponsors: @knosticai, TachTech, @censysio, @Ent_Security, @WorkOS, @DecibelVC, Whiterabbit, @zenitysec, @runsybil, @AISLE_Inc.

Community Partners: @SANSInstitute, @cloudsa, @OneRSAC, @FIRSTdotOrg.

Thanks to @jaybeale, our workshops training lead! @aaronzollman @dragosr @jonsakoda @WHITEHACKSEC @robtlee @GuanniQu @gadievron @joesu11ivan

[Rob T. Lee @robtlee]

(34 days out) Excited to share the lineup of the @SANSInstitute AI Cybersecurity Summit agenda and speakers, and why this was built for you:

Every speaker selected to inform and instruct on present day AI security realities.

Panels with our field's best. They are clearly not afraid to have hard conversations about what AI changes for cyber defense.

Workshops designed for Monday morning. And social things so you can say hi to peers and find battle buddies.

Thanks to my cochair Sounil Yu @sounilyu, to our partner event @unpromptedconf, and to our speakers:
Morgan Adamski, Principal, Cyber, Data, and Tech Risk Leader, PwC
Michael Collins, Senior Principal Security Engineer, Mastercard
Sergej Epp @EppSecurity, Cybersecurity executive; creator, ZeroDayClock
Gadi Evron @gadievron, Founder and CEO, Knostic
Jeremiah Grossman @jeremiahg, CEO, Root Evidence
Katie Moussouris @k8em0, Founder and CEO, Luta Security
Amy Herzog, VP/CISO, AWS
Vinh Nguyen, Senior Fellow, Artificial Intelligence, Council on Foreign Relations
John Hultquist @JohnHultquist Chief Analyst, Google Threat Intelligence Group
Daniel Miessler @DanielMiessler, Unsupervised Learning
Marcus Hutchins, Cybersecurity Speaker and Principal Threat Researcher
Ciaran Martin, Professor; Director SANS Cyber Leaders Network
Chris Cochran @chrishvm, Field CISO, VP AI Security, SANS Institute
Joshua Wright @joswr1ght, Director and Senior Security Analyst, Counterhack
Steve de Vera, TDIR Threat Research III, AWS
Kyle Shields, CISM, GCIH, GCPN, Security Specialist Solutions Architect, AWS
Andy Dennis, Head of Field Engineering, XBOW
William Reyor, Lead Solutions Architect, XBOW
Joshua Corman @joshcorman, Executive in Residence for Public Safety and Resilience; Lead, UnDisruptable27, Institute for Security and Technology (IST)
Caleb Evans, Software Engineer, Agents, Airbyte
Trinity Harrison, Principal Software Engineer
Lenny Zeltser @lennyzeltser, Faculty Fellow, SANS Institute
Pedram Amini @pedramamini, Chief Scientist, OPSWAT
Adrian Wood, Security Engineer, Dropbox, BT6

November 2-3, Arlington VA or online: https://t.co/wteGL83uJr

[Joe @joedaroo]

Took a minute to write a few words about security & safety as someone who lived through it all at OpenAI. I hope my thoughts help someone out there. https://t.co/gJBf08vJH9

[Pliny the Liberator 🐉󠅫󠄼󠄿󠅆󠄵󠄐󠅀󠄼󠄹󠄾󠅉󠅭 @elder_plinius]

🚿 SYSTEM PROMPT LEAK 🚿

Here's the full system prompts and tools for GPT-6 Sol Codex!

Total count of extracted text: >294,000 characters 🤗

Hope you enjoy! 🫶

Link: https://t.co/FhPYYqaScY

gg

[Jay Beale @jaybeale]

@_sarahyo Knowing your career, is there a great GPU in there for inference?

[Pliny the Liberator 🐉󠅫󠄼󠄿󠅆󠄵󠄐󠅀󠄼󠄹󠄾󠅉󠅭 @elder_plinius]

🚰 SYSTEM PROMPT LEAK 🚰

Here's the full system prompt for Claude Opus-5.5!! The total count of everything extracted, including all tools, comes in at over 1.9M characters! 🤯

Lots to dig into here. Enjoy! 🫡

Link: https://t.co/GzISdXkbYq

gg

[Halvar Flake @halvarflake]

The slides from my talk at Microsoft Bluehat Singapore are public here:

https://t.co/XtQmNSg9Jt

It's my first BlueHat talk since the Vista days.

[Jay Beale @jaybeale]

@_noid_ @defcon I’m so sorry, Noid.

[Gadi Evron @gadievron]

You have until the 8th at 23:59 to submit to @unpromptedconf! What are you waiting for?

https://t.co/6BFHjZPpMA

[Rob T. Lee @robtlee]

The purpose of technology is to serve humans, not the other way around. @DanielMiessler is keynoting our 6th AI Cybersecurity Summit. (I read his X posts routinely, and yes, I fanboy a little.)

In 2016 he wrote The Real Internet of Things: assistants that keep working toward your goals while services talk to each other. Technology aimed at your goals, serving you. He’s been building it ever since.

He has carried security responsibility inside large companies for years. At Apple he built and led the business intelligence team for Information Security. At Robinhood he built the vulnerability management and application security programs. He co-founded Fortify on Demand at HP and helped grow the team from two people to more than 350.

He also puts his own tools where practitioners can use them. SecLists is the security testing collection that ships with Kali Linux. Fabric organizes AI prompts into reusable patterns for work including threat modeling, with a couple hundred patterns and roughly 300 contributors. People can inspect the code, run it, find the limitations, and send fixes back. (Finding the limitations is the part I care about.)

Today he develops LifeOS, an open source system that holds your goals and project context and carries them into the work you delegate. https://t.co/OVyOxThpAP

His argument is that the scaffolding around the model does more for output quality than the choice of model, and LifeOS is that scaffolding: each request gets decomposed into binary, testable criteria, and a verify phase tests each one and records evidence before the work counts as done. When a result disappoints him, he says, it almost always traces back to context he failed to supply.

I want defenders to have this, and they can, because it’s open source. You know the investigation you need to run. You know the tool you wish existed. Fork this and build it.

He also treats security as one of seven components in the architecture around the model, not a wrapper: hardened settings, filesystem permissions to stop data exfiltration, and a validator that runs ahead of tool execution to catch prompt injection. (He is building an agent that touches his whole life and threat modeling it as he goes. That combination is rarer than it should be.)

He is doing all of this while advising companies and running security and AI assessments.

I’m excited to hear from someone willing to develop an ambitious idea in public while responsible for security decisions inside companies. I want our defenders in the room with him.

@SANSInstitute AI Cybersecurity Summit, November 2–3. With your Summit reg, get access to @unpromptedconf AI Security Online conference (yes, free access): https://t.co/UQY9OpDOx4

[Jay Beale @jaybeale]

@Grifter801 Congratulations!!!!