Securing the agentic era, one attack surface at a time.
Categories
AI Security Conferences — Independent coverage of the conferences where agent security is actually argued out: agendas, speakers, the arguments and what gets released.
Attack Surface & Threat Modeling — Agentic systems introduce attack surfaces that traditional threat modeling frameworks weren't built to handle—autonomous tool use, multi-agent trust boundaries, dynamic memory, and delegated credentials all demand a different analytical approach. This category covers how to systematically identify, map, and prioritize threats across the full agentic stack, from design-time architecture reviews through runtime exposure analysis. Expect concrete methodologies, worked examples, and honest assessments of where current frameworks fall short.
Defensive Architecture & Security Controls — Knowing where the attack surface is only half the work—the harder problem is building systems that resist exploitation under real operating conditions. This category covers concrete defensive patterns for agentic systems: sandboxing tool execution, enforcing least-privilege credential delegation, designing trust boundaries in multi-agent pipelines, and implementing runtime controls that don't cripple the autonomy you're trying to protect. The focus is architectural decisions that hold up when things go wrong, not checklists that look good in a review.
Red Teaming & Offensive Research — Defending agentic systems requires understanding how they actually break—not in theory, but under deliberate, adversarial pressure. This category covers offensive techniques, red-team methodologies, and hands-on exploit research specific to autonomous agent architectures: prompt injection campaigns, tool call interception, memory poisoning walkthroughs, and multi-agent lateral movement. If you want to know what an attacker does after they get a foothold in an agentic pipeline, this is where to look.
How to Secure AI Agents: Ten Controls in Build Order — A short, ordered list for securing AI agents, grounded in NCSC and OWASP guidance. Each control comes with the proof worth keeping, and the order puts limits before detection.
Where Is the Vulnpocalypse? A Referee's Card for the [un]prompted II Debate — Sergej Epp and Jeremiah Grossman debate the resolution that AI noise hasn't moved the needle on current cyber risk. We build the strongest honest case for each side using only figures from the published agenda, and name the evidence that would settle it. No verdict.
Integrous AI Systems Design: Bruce Schneier on the Leg of the Triad Nobody Studied — Bruce Schneier argues that integrity - data, processing, storage and contextual - is becoming the most important property of AI-driven systems, and must be solved before we trust AI to act for people. A preview of the Day 3 talk, read with Sounil Yu on least agency and the Open PBOM specification.
When Evaluation Runs Start Talking to Each Other: Omer Nevo on Agents That Pool Answers — Agents in separate evaluation runs can find each other through shared infrastructure, pool answers, and quietly invalidate the result. A preview of Omer Nevo's Day 3 talk, read alongside the other two sessions at [un]prompted II that question what a benchmark score measures.
All Tokens Are Created Equal: CxBOM at [un]prompted II — Rock Lambros and Fred Wilmot release CxBOM, a bill of materials for the context window, at [un]prompted II. We preview the claim and the minimum schema we would want.
StealthBench and the 53.8% Ceiling: What a Safe-Success Rate Measures — StealthBench scores autonomous security agents on task success and OPSEC together, across 14 containerised scenarios. Across 771 trajectories and 8 models, none exceeded a 53.8% safe-success rate. A preview of the Day 1 talk, and what that figure does and does not say.
MCP Server Authorization: Audience Binding and the Confused Deputy — A verified token tells you nothing about who it was issued for. How audience checks, a ban on relaying credentials, and per-client consent keep an MCP server from acting as somebody else's deputy.