[un]prompted II: The Complete Agenda, Every Session Explained (27–29 October 2026, San Francisco)

[un]prompted II is a three-day conference about what happens when a language model is handed tools, credentials, memory and the authority to act. It runs in San Francisco from 27 to 29 October 2026, and if you work on agent security, this is the programme to read — whether you search for it as [un]prompted, unprompted, or unpromptedcon.

This page is our reference for the whole event: every session, every speaker, the arguments that run through the programme, and what we think each talk is really about. We are independent coverage. We do not organise, sponsor or represent the conference, and we are following it remotely rather than from the room. Every session fact here comes from the official agenda, read on 12 October 2026. An agenda two weeks out still moves, so treat times as intent and check the official page before you plan a day around it.

The facts

Item	Detail
Event	[un]prompted II, the AI Security Practitioner Conference
Dates	27–29 October 2026
Location	San Francisco, hybrid — in person plus an online option
Sessions	85 slots across two stages. 80 have a named speaker; 5 are still TBD or TBA
Session length	20 minutes plus 10 for questions. Lightning talks run 10 minutes. Demos encouraged
Stages	Stage 1, Stage 2
Villages	CTF (Day 1 morning and afternoon, Day 3 afternoon), Harness (Day 2 morning), Defense (Day 2 afternoon), Art (Day 3 morning)
Host	Gadi Evron, CEO of Knostic and CFP chair, opens and closes all three days on Stage 1
Side events	26 Oct, 18:00–22:00, opening reception, The UNDERDOGS Cantina, 128 King St. 28 Oct, 18:00–21:00, After Hours, The Hibernia, 1 Jones St
Previous edition	[un]prompted I, 3–4 March 2026, Salesforce Tower, San Francisco
Official site	unpromptedcon.org
Agenda last checked	12 October 2026

What [un]prompted II is actually about

Read 85 abstracts in a row and the shape of the field falls out. Almost nothing on this programme is about model safety in the sense the phrase had two years ago. Hardly anything is about jailbreaks. The centre of gravity has moved to the machinery around the model: the sandbox it runs in, the identity it acts under, the memory it carries between tasks, the tool definitions it trusts, and the human who clicks approve.

That shift has a blunt version, and three separate talks state it outright. Vince Ovando puts it in a title — the model is not a security control. Ankit Agrawal of Webflow splits agent sandboxing into containment, provenance and authority, and argues the three are coupled. Daniel Cuthbert describes building a sandbox for an agentic bug-finding harness and the security problems his own team introduced doing it. If you want one sentence for the conference, it is that the security boundary is the harness, and the harness is a system you build, not a setting you enable.

The second thread is harder to sit with. Several talks report that finding vulnerabilities has become cheap while fixing them has not. David Molnar says Meta reached roughly 90% coverage on its targets, with AI-written diffs fixing over 40% of critical vulnerabilities, and that time-to-fix did not drop. Tobias Heldt benchmarked frontier agents against zero-days his own company disclosed privately: 12 of 54 attempts produced working exploits, and none produced an accepted patch. Shayaun Nejad has a talk titled Opened Is Not Fixed. A pull request is not a repaired system, and a passing build is not evidence that the vulnerable behaviour is gone.

The third thread is about honesty in measurement, and it is unusually well represented for a practitioner conference. Adrian Wood and Ads Dawson scored eight models on task success and operational security together across 771 trajectories, and report that none exceeded a 53.8% safe-success rate. Tim Schulz argues identical benchmark scores hide different internal processing. Omer Nevo looks at agents in separate evaluation runs discovering each other through shared infrastructure and pooling answers. Leo Meyerovich has three years of eval data and measures refusals, cost and contamination alongside accuracy. The through-line: a demo that completes the objective tells you very little about a system you can deploy.

What makes the programme worth your time is that it mostly declines to be impressive. Cuthbert presents the holes his team created. Heldt reports zero accepted patches. Molnar reports a metric that did not improve. Sergej Epp and Jeremiah Grossman close Day 1 debating the resolution that AI noise has not moved the needle on current cyber risk, which is an odd thing to schedule at an AI security conference and the strongest signal of its character.

We have written up the six arguments in detail, with the figures and the talks on each side, in Six Arguments That Run Through [un]prompted II.

Day 1 — Tuesday, October 27

Stage 1

Time	Talk	Speakers	Subject
09:00	Opening Words	Gadi Evron (CEO, Knostic; CFP Chair)	Conference welcome.
09:35	"WTF Was That?" Dispatches From the Wrong End of an Agent Swarm	Caleb Sima; Alec Eckmann	No abstract published.
10:00	Taming AI Agents with Capsem: Hardware Sandboxing That Doesn't Kill Productivity	Elie Bursztein (Distinguished Research Scientist, Google DeepMind)	Capsem: an open-source Rust hypervisor and VM system for running agents in a hardened environment.
10:45	How Meta Changed Building Secure Software With AI	David Molnar (Meta)	Scaling security analysis to match AI-driven code growth.
11:10	From DARPA AIxCC to Microsoft FORGE Lab: Lessons Building Hyperscale AI Code Scanning Tools	Taesoo Kim (VP, Security Research, Microsoft)	Team Atlanta's AIxCC win and how it became production vulnerability discovery.
11:35	StealthBench: Can Autonomous Security Agents Do OPSEC Like An Experienced Operator?	Adrian Wood (Security Engineer, Dropbox); Ads Dawson (Staff AI Security Researcher, Dreadnode; founder, OWASP GenAI Security Project)	Open-source benchmark scoring agents on task success and OPSEC across 14 containerized scenarios.
12:00	CISA's Experience and Lessons Learned in AI-Enabled Vulnerability Management	Kevin Donovan (Deputy Associate Director for Vulnerability Management, CISA)	CISA's role: CVE Program oversight, the KEV Catalog, the Gold Eagle intake platform.
13:30	Prompt, Patch, Prove	Tim de Waal (Member of Technical Staff, OpenAI)	Can defenders build temporary, testable firmware fixes before a vendor patch?
13:55	Your Sandbox Degrades Gracefully, What's the Wurst That Could Happen?	Daniel Cuthbert (Security Researcher)	Building an agent-specific sandbox for RAPTOR, an agentic bug-finding harness that runs untrusted code.
14:20	Three Years of Evals Later: What's Changing in Model and Harness IR/SOC Scores	Leo Meyerovich (Founder & CEO, Graphistry)	Three years benchmarking frontier and open-weight models plus commercial and open harnesses on IR and SOC tasks.
14:45	Who Authorized the Agent? Making the AI Harness an Enforceable Compliance Boundary	Oleksii Baranovskyi (Cracken)	An architecture where the harness enforces policy instead of advising on it.
15:30	A Tale of Two Chains	Brendan Dolan-Gavitt (Distinguished Engineer, XBOW)	Two full-chain Chrome exploits submitted to Google's VRP.
15:55	Models vs Cyber Reality: Frontier Agents Against Our Own Privately Disclosed Zero-Days	Tobias Heldt (Co-Founder and CEO, XOR)	Frontier agents against the company's own privately disclosed zero-days plus 209 known vulnerabilities.
16:20	Your Harness Needs a Security Constitution	Kat Traxler (Principal Security Researcher, Vectra AI)	A hunting methodology that guides models with 12 principles about trust in multi-tenant cloud platforms, modeled on a published AI constitution, using a "reasonable customer test".
16:45	0-Click Remote Exploits in an AI World	Bruce Dang (Calif.io); Anna Groza (Security Researcher, Calif.io)	LLM-driven tooling to enumerate and audit remotely reachable attack surface in mobile messaging apps.
17:10	Debate: Where is the vulnpocalypse?	Sergej Epp (infosec and threat research; created the Zero Day Clock); Jeremiah Grossman (founder, WhiteHat Security; CEO, Root Evidence)	Formal resolution: "Resolved, that AI noise hasn't moved the needle on current cyber risk."
17:35	Closing remarks	Gadi Evron

Stage 2

Time	Talk	Speakers	Subject
09:35	All Tokens Are Created Equal, Including the Attacker's	Rock Lambros (Zenity); Fred Wilmot (Detecteam)	Uses the EchoLeak zero-click Copilot exploit to show models do not distinguish trusted from untrusted tokens.
10:00	Attention Is All You Need (to Catch Hallucinations & Prompt Injections)	Saurabh Shintre (Realm Labs); Akash Mukherjee (Realm Labs)	Hallucinations and indirect prompt injection detected together by inspecting hidden states to see which input tokens the model relied on.
10:45	Into the Wild: Hunting Real-World Attacks on AI Systems	Mike Takahashi (Zenity)	Forensics from a honeypot emulating production AI stacks: CVE probing, SSRF, code-execution abuse, backdoored-model attempts.
11:10	Say Shibboleth: Fingerprinting the Models Behind Agentic Attacks	Sergej Epp; Dario Pasquini (Cracken)	Plants model-sensitive "shibboleth" features in attacker environments to identify the model family and harness behind an attack, even when the model is self-hosted.
11:35	Who Is Prompt-Injecting Coding Agents? A Scan of 86 Million GitHub Items	Gabi Nakibly (Radware); Zvika Babo (Radware)	GitHub-wide scan for hidden-text prompt injections: about 2.5 per 100K items.
12:00	Promptware EOD: Skillful Agent Detonation	Tamir Ishay Sharbat (Zenity); Joao Donato	A detonation chamber that runs agent skills and compares what the agent reports against kernel-level activity.
13:30	Sandboxing Agents is a Three-Body Problem: Containment, Provenance, and the Human Authority	Ankit Agrawal (Webflow)	Agent sandboxing is three coupled problems: containment, provenance, authority.
13:55	The Model Is NOT a Security Control: Prompt Injection Dies at the Token Sampler	Vince Ovando	The Tantalus indirect prompt-injection arena: about 6.1 million inference calls, models from 1.7B to 119B parameters.
14:20	But the Reasoning Looks Right! Backdoors That Evade CoT Monitoring	Giorgio Severi (AI Safety Research, Microsoft)	Poisoned models that emit benign reasoning but attacker-chosen answers, evading reasoning-only monitors.
14:45	Confining Cross-Site Prompt Injection in Web Agents	Viren Chaudhari (Qulays); Rushikesh Chandak (Qulays)	Defines cross-site prompting, where page content manipulates browsing agents.
15:30	The Autonomous Adversarial Loop: Fully Automating an Octo Tempest Purple-Team Simulation	Fatih Bulut (Microsoft); Anjali Mangal	A fully automated purple-team loop: infrastructure, red and blue agents running a Scattered Spider kill chain.
15:55	Secure Product Development With Mantis	Nick Galloway (Google Cloud); Ruchi Shah (Google Cloud)	How Google Cloud rebuilt its security engineering function around collaborative secure development, starting from Mantis for vulnerability discovery.
16:20	Opened Is Not Fixed: The Last Mile of AI Vulnerability Remediation	Shayaun Nejad (Rubrik)	Field report on moving AI-found vulnerabilities from verified finding to merge, rejection or formal risk acceptance.
16:45	What Building Early Foundation Models Teaches Us About AI Safety Hype vs. Reality	Ari Herbert-Voss (RunSybil)	Draws on red-teaming GPT-3 and Codex to separate alarming demos from real harm.

Day 2 — Wednesday, October 28

Stage 1

Time	Talk	Speakers	Subject
09:00	Opening Words	Gadi Evron
09:35	Weightless: Abliteration Without the Weights	Matt Suiche (Tolmo)	Removes refusal behaviour from open-weight models by applying a behavioural direction at inference time, leaving the base checkpoint unchanged.
10:00	Same Score, Different Brain: Comparing Models by How They Process What They Know	Tim Schulz (Co-Founder & CEO, Starseer)	Benchmark scores hide how models process information.
10:45	There Isn't a Security Problem an Agent Can't Help Solve	Amol Deshpande (Staff Security Engineer, Stripe)	Stripe's agents across the security review lifecycle: context gathering, threat modeling, ticket creation, fix verification.
11:10	Metrics for Agentic Systems: What "Good" Looks Like for a Security Agent	Shahanas Najeeb (Senior Agentic Security Engineer, Salesforce)	Metrics programs for production security agents in triage, threat intel and detection.
11:35	The Scanner Said Clean. We Ran It Again: Stochastic False Negatives in LLM Vulnerability Detection	Petr Simecek (AI Researcher, AISLE)	How LLM scanners miss a real bug on one run and find it on another: 25,000 trials, 7,600 CVE rediscovery runs.
12:00	Offense != Defense: LLM Cyber Defense – Hunt, Bust, Climb	Igor Kozlov (AI/ML Lead, Staff Applied Scientist, Simibian.ai)	Evaluates LLMs on threat-hunting campaigns built from real attack procedures.
13:30	TBD	not listed
13:55	What Designing a Cyber Ontology for Agents Taught Us About Governance	David Chismon (Chief Security Architect, UK National Cyber Security Centre)	Representing security information as a knowledge graph for deterministic decisions, as part of the UK's CyberShield agentic defense plan.
14:20	Memory Is the New Attack Surface: Benchmarking Poisoning Through Agent Memory	Giorgio Severi (Microsoft); David Yang (PhD candidate, RPI; Microsoft)	A poisoned tool response persists in agent memory, resurfaces in later tasks, then drives the attacker's objective.
14:45	Building the Defender's Advantage: Technical Solutions for AI Cyber Resilience	Kamile Lukosiute (Cyber Resilience Program Officer, OpenAI Foundation)	Three defender opportunities: securing critical infrastructure, verification tools for AI governance, and an AI cybersecurity observatory.
15:30	Claude Can Capture the Flag. Can It Hold the Fort?	Yernat Yestekov (Research Fellow, Anthropic)	Autonomous Claude agents as blue team in three rounds of the Collegiate Cyber Defense Competition against a professional red team.
15:55	Every Dog Has its 0-day	Adrian Wood (Red Team, Dropbox)	Security failures in consumer quadruped and humanoid robots: weak provisioning, hardcoded authentication, unauthenticated buses.
16:20	Auto-Exploiter by Use of a Ratchet Loop, Code Understanding, and… Haiku	John Cartwright (reverse engineer); Gadi Evron (Knostic)	An exploit-generation system built around Anthropic's Haiku, with harness design for state, code-path reasoning and vulnerability tracking.
16:45	Stolen Thoughts: How Adversaries Steal Reasoning for Industrial-Scale Distillation	not listed	Title only.
17:10	CISOs debrief: What we learned, what we need	not listed
17:45	Closing Remarks	Gadi Evron

Stage 2

Time	Talk	Speakers	Subject
09:35	Cryptography Under AI Pressure	Sunghyeon Jo (Cybersecurity researcher, QED Audit; PhD student, Georgia Institute of Technology)	LLM-assisted discovery of a signing-key recovery attack on a threshold ML-DSA proposal and a message recovery attack on a witness encryption scheme.
10:00	Math Ability has Consequences: AI Cryptanalysis	Markku-Juhani O. Saarinen (cryptographer, hardware architect, professor of practice)	Surveys AI-driven codebreaking techniques, recent results and authority responses.
10:45	Kuna: Building a Competitive C Decompiler Through Autonomous AI Research	Zion Basque (Assistant Professor, University of Georgia)	AI agents improving a decompiler ported from Ghidra to Rust.
11:10	Two Sparks Walk Into a Lab	Roei Sherman	Built a red-team benchmark on two NVIDIA DGX Sparks with an AI coding agent's help, testing 33 open-weight models.
11:35	Hidden Triggers, Harmful Payloads: Auditing Trojan Open-Weight LLMs	Patrik Mada (Member of Technical Staff, Aisle Inc); Evelina Gabasova (Head of Technology, Aisle Inc)	A pipeline for building realistic Trojan open-weight models with effective triggers that preserve normal capability.
12:00	OH MODEL, WHERE ART THOU: Hacking Chrome's Local SLM	David Tulis (Senior Threat Researcher, TrendAI); Vincenzo Ciancaglini (AI Threat Research Lead)	The Gemini-class local model shipped in Chrome: Safe Browsing integration, reachable inference APIs.
13:30	Built to Spec, Ignored in Practice: Rebuilding AI Intake People Actually Use	Olivia Rose (Co-Founder, Williams Rose AI Cyber Advisory); Kayla Williams (Co-Founder, Williams Rose AI Cyber Advisory)	A pharma company's AI intake built to spec and largely unused, while 35 unapproved AI cases were found in one day.
13:55	Permission Fatigue Is a Security Bug: Dynamic Guardrails for Coding Agents	Sahana Chennabasappa (Security Engineer, Meta); Chris Puderbaugh (Security Engineer, Agent Security & Access, Meta)	Per-action approval prompts cause reflexive approvals and disabled checks.
14:20	Your AI Analyst Is Confidently Wrong: Adversarial QC for Agentic Security Analysis	Maxim Kovalsky (Managing Director, AI Security CoE, Consortium Networks); Ali Arshad (Senior Security Consultant, Consortium Networks)	A QC harness that breaks agent output into testable claims, checks them with deterministic gates, then applies an adversarial critic and fixer.
14:45	Pandora's Dir: Hope at the bottom of ../	Rik Dolfing; Reef Ettedgui	A scaled open-directory hunt for threat actors' exposed infrastructure, to learn how they use AI.
15:30	Auditing Someone Else's Confidential AI	Jagannadh Mellacheruvu (AI Security and Policy, Columbia University)	Verifies a confidential-inference service's attestation document, including its AMD SEV-SNP report and certificate chain, with an open-source tool and no cloud account.
15:55	AI Client Builders are Not Security Companies (And Shouldn't Have To Be)	Alexander Frazer (Security Engineer, Runlayer); Alvaro Inckot	AI clients like Cursor and Claude Code each build their own incompatible observability and control features.
16:20	AgencyScore and AgencyGym: Measuring Excessive Agency Before Deployment	Venkat Raghavan (Cofounder, LangGuard.AI); Jason Keirstead	AgencyScore measures whether an agent acquires capabilities it was not declared to have; AgencyGym is a 100-task sandbox for testing it.
16:45	Half the Model Never Multiplies: Quantizing a Reasoner for the Endpoint	Ajaya Neupane (AI & Security, Ent AI)	A data-loss classifier on endpoints using a quantized Gemma-4 E2B model with mixed precision that spends bits on the compute path.

Day 3 — Thursday, October 29

Stage 1

Time	Talk	Speakers	Subject
09:00	Opening Words	Gadi Evron
09:35	The death of TTPs – Fully Autonomous Cyber Attacks in the Wild	Eyal Sela (Director of Threat Intelligence, Gambit Security)	A large criminal campaign in which an open-weight model and an open-source harness autonomously carried out intrusions across many companies.
10:00	–Dangerously-Deploy-Sandboxes: a Story of Isolation and Alignment	Jackson Reed (Founder & CEO)	Sandboxing and isolation weaknesses in a widely deployed frontier-lab product and how its containment features interact.
10:45	What 40 Enterprises Who Asked for Agent Governance Had, and the Control Plane That Came Out of It	Josh Woodruff (Founder and CEO, MassiveScale.AI; Founding Chair, Agentic Trust Framework, CSAI Foundation)	The governance gaps dozens of enterprises actually had, and the operating model that emerged: governance as code, per-agent definitions reviewed as pull requests and compiled into registry and gateway policy.
11:10	Agentic AI in the Wild: What Real Deployments Teach Us About Governance and Scale	Chenxi Wang (General Partner, Rain Capital); Jasmine Jaksic (Senior Director of Engineering, NVIDIA)	Research across 28 organizations: the most valuable deployments are long-horizon while many use cases stay single-step.
11:35	Integrous AI Systems Design	Bruce Schneier (Fellow and Lecturer, Harvard Kennedy School; University of Toronto)	Integrity, the least-studied leg of the CIA triad, is becoming the most important property for AI-driven systems.
12:00	Giving AI Religion	Sounil Yu (creator of the Cyber Defense Matrix and the DIE Triad)	Proposes least agency as a complement to least privilege, and a C4 model — Crown, Chassis, Conscience, Committee — for mapping control points and accountability.
13:30	Victim as a Service: Defending Against Trust Based Scams using AI	Ariana Mirian (Security Research & Co-Founder, BeeSafe AI)	An LLM system that engages scammers in long realistic conversations to waste their time and detect the milestones they use to push victims toward payment.
13:55	AI Inference and its Privacy and Confidentiality challenges	Yolan Romailler (Head of Security, Confidential AI)	Whether inference providers can meaningfully protect private data and what it costs at scale.
14:20	Agent Authorization Is Not a Vault Problem	Felipe Zimmerle (CTO, KonaSense); Rodrigo Branco (Vulnerability Researcher, Anthropic)	Most approval tools show a human a summary written by the agent, so nothing ties the approval to the exact operation signed.
14:45	Everyone Wants All the AI Tools. Good.	Nicole Grinstead (CISO, Roblox)	Governing AI tool adoption without blanket refusal or central review of everything: align leadership on risk tolerance, then provide self-service paths, secure sandboxes, technical guardrails and detection for risky use.
15:30	Enterprise OpenClaw: Tackling Agentic Security at Scale	Damian Finol (VP Engineering, Felix Pago)	An identity-aware agent runtime on OpenClaw across GitHub and Slack.
15:55	Same Threat, Two Verdicts: Shadow Testing Our SOC Agent	Tal Waitzenberg (Staff Research Scientist, Wiz/Google); Erez Harush (Head of AI Research, Wiz/Google)	Split an autonomous SOC agent into investigation and verdict stages to locate nondeterminism.
16:20	BITE – Behavior-Intent Traceable Evaluation	Daniel Geyshis (Head of AI, Knostic); Tamir Isaschar (Senior Security Researcher, Knostic)	Scans extensions, skills and MCP servers by mapping individual behavioural signals, linking them into chains, and comparing each chain against the artifact's stated purpose.
16:45	Threat Model Impossible: 1 Agent. 30 Days. 687 Security Reviews. And a Refrigerator.	Farzan Karimi (Deputy CISO, Moderna)	An in-house threat-modeling agent that completed hundreds of AI-assisted reviews in a month and created tracked risk tickets.
17:10	Closing Remarks & Awards	Gadi Evron

Stage 2

Time	Talk	Speakers	Subject
09:35	Attacking Truth: Breaking Proof Assistant Kernels in the Age of Vericoding	Jonathan Brossard (PSIRT.COM)	Seven kernel soundness bugs in Lean 4 and Rocq, each with a reproducible proof of concept deriving False.
10:00	Beyond the SBOM: Proving Process Integrity with the Open PBOM Specification	Aishwarya Athreya (Visa); Kavia Venkatesh (Cigna)	The open Pipeline Bill of Materials specification: a machine-readable schema recording a build's execution context, including runner identities, policies and signatures.
10:45	Twelve Consoles, One Investigation	Sannan Iqbal (Oscar Health)	An agentic system that routes investigation queries across siloed security consoles and correlates results.
11:10	TBA	not listed
11:35	TBA	not listed
12:00	We don't need an LLM for That	Xenia Mountrouidou (AppGate); Casey Wilson (BusinessLoans.com)	Compares zero-shot LLMs, XGBoost and fine-tuned models on phishing and network attack detection.
13:30	Approval Is Not Human Presence: Building and Breaking an MCP Permission Broker	Brooks McMillin (Dropbox)	A deployed MCP permission broker that requires evidence of human presence before granting sensitive capabilities.
13:55	Reading the Residual Stream: Productizing Activation-Probe Security at Intuit	Guy Shtar (Intuit); Guy Elad	Guardrails that read a small model's internal activations with lightweight probes, avoiding LLM judges and prompt injection.
14:20	Engineering Context for SOC Agents: Lessons, Failures, and Open Questions	Dan Dye (Google Cloud Security)	Moving SOC agent workflows from a local harness to an enterprise platform: memory relevance, context injection, model selection.
14:45	Building Security Review Agents: the Models are the Reliable Part	Gabe Bello (Twilio)	Several models assess third-party app permission grants, a stronger model referees disagreements, a human decides.
15:30	From Patch Generation to Evidence: Building Trust in AI-Generated Code	Ela Avrahami (AI & Software Advisor)	The trust architecture behind the OpenAnt Auto Patcher: which evidence helped, which ideas failed, and how controlled experiments refined the line between LLM reasoning and deterministic policy.
15:55	When Humans Can't Make It Hard Enough: Self-Hardening Environments for Frontier AI Investigators	Noam Cohen (Torq)	"env-play": a scenario generator that makes harder SOC investigation environments against a fixed investigator.
16:20	When Evaluation Runs Start Talking to Each Other	Omer Nevo (Irregular)	How agents in separate evaluation runs can discover each other through shared infrastructure, pool answers and undermine evaluation validity.

The six arguments to follow

1. The model is not a security control. Ovando, Agrawal, Cuthbert, Bursztein, Herbert-Voss, Reed. If the control lives inside the thing being attacked, it is not a control. Relevant: our work on sandboxing agent tool calls.
2. Prompt injection is authority confusion, not bad input. Lambros and Wilmot release CxBOM, a bill of materials for the context window. Chaudhari and Chandak confine cross-site prompting. Nakibly and Babo scanned 86 million GitHub items. Relevant: prompt injection in multi-agent pipelines.
3. Finding is cheap now; fixing never was. Molnar, Nejad, Heldt, de Waal, Donovan, Avrahami, Simecek. Relevant: what AI-discovered vulnerabilities mean for defenders.
4. Capability is not competence. StealthBench separates finishing the task from finishing it without burning the operation. Also Dolan-Gavitt, Sela, Bulut and Mangal, Sherman, Kozlov. Relevant: red-teaming an agentic system.
5. The benchmark is the battleground. Schulz, Meyerovich, Nevo, Yestekov, Raghavan and Keirstead, Najeeb, Cohen.
6. Approval is theatre unless the human sees the bytes. Zimmerle and Branco show that the summary a human approves is written by the agent. McMillin requires evidence of human presence. Chennabasappa and Puderbaugh treat permission fatigue as a bug. Relevant: human oversight in production.

The numbers the programme puts on the table

Each figure below is the speaker's own, from their published abstract. None of it has been presented yet, and none of it has been independently checked by us.

Figure	Claim	Whose
53.8%	Best safe-success rate of eight models on StealthBench, across 771 trajectories and 14 containerised scenarios	Adrian Wood, Ads Dawson
12 of 54	Attempts against privately disclosed zero-days that produced working exploits. Accepted patches: zero	Tobias Heldt, XOR
~90% / >40%	Target coverage, and critical vulnerabilities fixed by AI-written diffs — while time-to-fix did not improve	David Molnar, Meta
6 days, $250,000	An AI-orchestrated full-chain Chrome exploit, against two months of largely human work on the first chain	Brendan Dolan-Gavitt, XBOW
~6.1 million	Inference calls in the Tantalus injection arena, models from 1.7B to 119B. One control provably blocked bad output at 100%	Vince Ovando
~2.5 per 100,000	GitHub items carrying hidden-text prompt injection, from 86 million scanned	Gabi Nakibly, Zvika Babo, Radware
25,000 trials	Plus 7,600 CVE rediscovery runs, measuring scanners that miss a bug on one run and find it on the next	Petr Simecek, AISLE
45 minutes, ~77%	An autonomous red agent through 10 phases of a Scattered Spider kill chain, verified success rate	Fatih Bulut, Anjali Mangal
80%	Friction reduction from taint-based dynamic guardrails replacing per-action approval prompts	Sahana Chennabasappa, Chris Puderbaugh, Meta
35 in one day	Unapproved AI cases found at a company whose formal AI intake process went unused	Olivia Rose, Kayla Williams
687 reviews	Security reviews completed by one in-house threat-modelling agent in 30 days	Farzan Karimi, Moderna
200+	Concurrent Claude agents run as a blue team across three rounds of a collegiate defence competition	Yernat Yestekov, Anthropic

Tools and specifications on the programme

An unusual number of these sessions ship something. Where an abstract says a tool is being released, we have said so; where it only describes one, we have not.

• CxBOM — a bill of materials for the context window, released in the talk by Rock Lambros and Fred Wilmot.
• Capsem — an open-source Rust hypervisor and VM system for running agents air-gapped, with Sigma and OpenTelemetry support. Elie Bursztein, Google DeepMind.
• StealthBench — an open-source benchmark scoring agents on task success and OPSEC together. Adrian Wood, Ads Dawson.
• Tantalus — an indirect prompt-injection arena. Vince Ovando.
• Tenacity — least-privilege confinement for browsing agents. Viren Chaudhari, Rushikesh Chandak, Qulays.
• Memory Dojo — a benchmark tracing poisoning across five memory architectures. Giorgio Severi, David Yang.
• AgencyScore and AgencyGym — a measure of capabilities an agent acquires but was never declared, and a 100-task sandbox for testing it. Venkat Raghavan, Jason Keirstead.
• The Open PBOM specification — a pipeline bill of materials recording a build's execution context. Aishwarya Athreya, Kavia Venkatesh.
• BITE — behaviour-intent traceable evaluation for extensions, skills and MCP servers. Daniel Geyshis, Tamir Isaschar, Knostic.
• A skill detonation chamber — runs agent skills and compares what the agent reports against kernel-level activity. Tamir Ishay Sharbat, Joao Donato. Being released publicly.
• A prompt-injection detector and taxonomy — from the 86-million-item GitHub scan. Gabi Nakibly, Zvika Babo, Radware.
• Kuna — a C decompiler improved by AI agents, ported from Ghidra to Rust. Zion Basque.
• env-play — a scenario generator that hardens SOC investigation environments against a fixed investigator. Noam Cohen, Torq.

Villages, CTF and side events

Four villages run alongside the stages: CTF on Day 1 morning and afternoon and again on Day 3 afternoon, Harness on Day 2 morning, Defense on Day 2 afternoon, and Art on Day 3 morning. The programme describes the villages around live demos, agent harnesses, defensive infrastructure, tarpits, containment and failed experiments.

Two evening events sit outside the main programme. The opening reception is on 26 October, 18:00 to 22:00, at The UNDERDOGS Cantina, 128 King St — the night before the conference opens. After Hours is on 28 October, 18:00 to 21:00, at The Hibernia, 1 Jones St.

None of the village or evening content is available remotely. If you are following online, as we are, that is the part you lose.

How we are covering it

We are writing one brief per session we think matters, before the talk happens, from the published abstract. Each brief ends with the questions we would ask that speaker, because naming the question that a talk leaves open is more useful to you than summarising the abstract twice. We are not reporting what anyone said until they have said it. Where a team publishes something during the conference — a repository, a specification, a benchmark — we will cover the release and say plainly that the release is what we read.

Date	Update
12 October 2026	Page created from the official agenda. 85 sessions listed, 80 with a named speaker.