Your [un]prompted II Clash Guide: Stage 1 Against Stage 2, Hour by Hour

Two stages. 85 session slots. Twenty minutes each, plus ten minutes of questions. That arithmetic is the whole problem with [un]prompted II — most people search for it as unprompted — because nearly every hour on the published agenda forces a choice, and about five of those choices are genuinely hard. Our conference guide covers the event itself. This is the clash guide: Stage 1 against Stage 2, hour by hour, with a call on each one.

How to read this unprompted agenda guide

Built from the official agenda, read on 2026-10-12. Times move, speakers drop, and five of the 85 slots had no named speaker when we read it — they are marked TBA or TBD below, not filled in with guesses. We are independent coverage, not the organiser, not a sponsor, not a media partner, and we are following remotely rather than from the room. No talk has happened yet, so every "our call" is a bet on a published abstract, not a review.

One thing works in your favour. [un]prompted II is hybrid, in person plus online, which means some of these choices can be deferred to the stream instead of being made in a corridor at 11:30. We flag the clashes where that is the right move.

Day 1, hour by hour — Tuesday, October 27

Time	Stage 1	Stage 2	Our call
08:30	Gathering & Mingling	—	Arrive early. The CTF village runs morning and afternoon today.
09:00	Opening Words — Gadi Evron	—	Stage 1. He opens and closes all three days.
09:35	"WTF Was That?" — Sima, Eckmann	All Tokens Are Created Equal (CxBOM) — Lambros, Wilmot	Stage 2. No abstract published for Stage 1; CxBOM ships with a demo.
10:00	Capsem hardware sandboxing — Bursztein	Attention Is All You Need — Shintre, Mukherjee	Stage 1. Capsem is open source and you can run it Monday.
10:45	How Meta Changed Building Secure Software — Molnar	Into the Wild: honeypot forensics — Takahashi	Stage 1. The ~90% coverage and flat time-to-fix numbers frame the day.
11:10	DARPA AIxCC to Microsoft FORGE Lab — Kim	Say Shibboleth: fingerprinting attack models — Epp, Pasquini	Stage 2 if you do attribution. Otherwise Stage 1.
11:35	StealthBench — Wood, Dawson	86 million GitHub items scanned — Nakibly, Babo	Painful. Stage 1 by a hair: 53.8% is the number of the conference.
12:00	CISA on AI-enabled vulnerability management — Donovan	Promptware EOD: skill detonation — Sharbat, Donato	Stage 2. The detonation chamber is being released publicly.
13:30	Prompt, Patch, Prove — de Waal	Sandboxing Is a Three-Body Problem — Agrawal	Stage 2. Containment, provenance, authority is the frame you will reuse.
13:55	Your Sandbox Degrades Gracefully (RAPTOR) — Cuthbert	The Model Is NOT a Security Control — Ovando	Painful. Stage 2: 6.1M inference calls, one control at 100%.
14:20	Three Years of Evals Later — Meyerovich	Backdoors That Evade CoT Monitoring — Severi	Stage 1 if you buy agents. Stage 2 if you host open weights.
14:45	Who Authorized the Agent? — Baranovskyi	Confining Cross-Site Prompt Injection (Tenacity) — Chaudhari, Chandak	Stage 1. Inline proxy versus decision-only API is the architectural call.
15:30	A Tale of Two Chains — Dolan-Gavitt	The Autonomous Adversarial Loop — Bulut, Mangal	Painful. Stage 1: six days and $250,000 against two human months.
15:55	Models vs Cyber Reality — Heldt	Secure Product Development With Mantis — Galloway, Shah	Stage 1. 12 working exploits, zero accepted patches.
16:20	Your Harness Needs a Security Constitution — Traxler	Opened Is Not Fixed — Nejad	Stage 2 if you own remediation. Stage 1 if you own hunting.
16:45	0-Click Remote Exploits in an AI World — Dang, Groza	AI Safety Hype vs. Reality — Herbert-Voss	Stage 1 for the WeChat, WhatsApp and iOS case studies.
17:10	Debate: Where is the vulnpocalypse? — Epp vs Grossman	—	Stage 1. Everyone will be there. Go anyway.
17:35	Closing remarks — Gadi Evron	—	Short. Stay for it.

Day 2, hour by hour — Wednesday, October 28

Time	Stage 1	Stage 2	Our call
09:00	Opening Words — Gadi Evron	—	Stage 1. The Harness village runs this morning.
09:35	Weightless: Abliteration Without the Weights — Suiche	Cryptography Under AI Pressure — Jo	Stage 1. Inference-time refusal removal changes your open-weight threat model.
10:00	Same Score, Different Brain — Schulz	Math Ability has Consequences — Saarinen	Stage 1, unless you own crypto. Then Stage 2, twice over.
10:45	There Isn't a Security Problem an Agent Can't Help Solve — Deshpande	Kuna: autonomous C decompiler — Basque	Stage 1 for the workflow framework. Reverse engineers, Stage 2.
11:10	Metrics for Agentic Systems — Najeeb	Two Sparks Walk Into a Lab — Sherman	Stage 1. Metrics beyond accuracy is the gap most programmes have.
11:35	The Scanner Said Clean. We Ran It Again — Simecek	Hidden Triggers, Harmful Payloads — Mada, Gabasova	Painful. Stage 1: 25,000 trials on stochastic false negatives.
12:00	Offense != Defense: Hunt, Bust, Climb — Kozlov	OH MODEL, WHERE ART THOU — Tulis, Ciancaglini	Stage 1. Finding and hunting are different skills, and that matters more.
13:30	TBD (no speaker listed)	Built to Spec, Ignored in Practice — Rose, Williams	Stage 2. 35 unapproved AI cases in one day earns it. Defense village opens.
13:55	Designing a Cyber Ontology for Agents — Chismon	Permission Fatigue Is a Security Bug — Chennabasappa, Puderbaugh	Stage 2. 80% friction reduction, with taint tracking behind it.
14:20	Memory Is the New Attack Surface (Memory Dojo) — Severi, Yang	Your AI Analyst Is Confidently Wrong — Kovalsky, Arshad	Stage 1. Memory Dojo traces poisoning across five memory architectures.
14:45	Building the Defender's Advantage — Lukosiute	Pandora's Dir — Dolfing, Ettedgui	Stage 2. Real criminal AI infrastructure beats a collaboration invitation.
15:30	Claude Can Capture the Flag. Can It Hold the Fort? — Yestekov	Auditing Someone Else's Confidential AI — Mellacheruvu	Stage 1. 200+ concurrent agents as blue team, and their mistakes.
15:55	Every Dog Has its 0-day — Wood	AI Client Builders are Not Security Companies — Frazer, Inckot	Stage 2 if you run Cursor or Claude Code at scale. Else Stage 1.
16:20	Auto-Exploiter, Ratchet Loop and Haiku — Cartwright, Evron	AgencyScore and AgencyGym — Raghavan, Keirstead	Stage 2. Measuring excessive agency before deployment is the scarcer thing.
16:45	Stolen Thoughts — no speaker listed	Half the Model Never Multiplies — Neupane	Stage 2. Stage 1 has a title and nothing else yet.
17:10	CISOs debrief — no speakers listed	—	Stage 1. Unnamed panel, but the only CISO-to-CISO slot on the agenda.
17:45	Closing Remarks — Gadi Evron	—	Then After Hours, 18:00–21:00, The Hibernia.

Day 3, hour by hour — Thursday, October 29

Time	Stage 1	Stage 2	Our call
09:00	Opening Words — Gadi Evron	—	Stage 1. The Art village runs this morning.
09:35	The death of TTPs — Sela	Attacking Truth: proof assistant kernels — Brossard	Stage 1. An autonomous campaign in the wild resets detection assumptions.
10:00	–Dangerously-Deploy-Sandboxes — Reed	Beyond the SBOM: Open PBOM — Athreya, Venkatesh	Stage 1, with the caveat that details wait on coordinated disclosure.
10:45	What 40 Enterprises Had — Woodruff	Twelve Consoles, One Investigation — Iqbal	SOC leads Stage 2. Everyone else Stage 1 for governance as code.
11:10	Agentic AI in the Wild — Wang, Jaksic	TBA	Stage 1. Stage 2 is unfilled, and the deadlocked platform story is worth it.
11:35	Integrous AI Systems Design — Schneier	TBA	Stage 1, no contest. Stage 2 is still TBA.
12:00	Giving AI Religion (least agency, C4) — Yu	We don't need an LLM for That — Mountrouidou, Wilson	Stage 1 for least agency. Detection engineers, Stage 2.
13:30	Victim as a Service — Mirian	Approval Is Not Human Presence — McMillin	Stage 2. A deployed MCP permission broker with a live boundary test.
13:55	AI Inference Privacy and Confidentiality — Romailler	Reading the Residual Stream — Shtar, Elad	Stage 2. Activation probes in production, with no LLM judge to inject.
14:20	Agent Authorization Is Not a Vault Problem — Zimmerle, Branco	Engineering Context for SOC Agents — Dye	Stage 1. The agent writes the summary the human approves. Go.
14:45	Everyone Wants All the AI Tools. Good. — Grinstead	Building Security Review Agents — Bello	Stage 2. Models reliable, guardrails deterministic, human decides.
15:30	Enterprise OpenClaw — Finol	From Patch Generation to Evidence — Avrahami	Stage 1 if you run agent fleets. Stage 2 if you merge AI patches.
15:55	Same Threat, Two Verdicts — Waitzenberg, Harush	env-play self-hardening environments — Cohen	Painful. Stage 1: locating nondeterminism beats generating harder scenarios.
16:20	BITE — Geyshis, Isaschar	When Evaluation Runs Start Talking — Nevo	Stage 2. Evaluation collusion between agents is nearly unexamined.
16:45	Threat Model Impossible — Karimi	—	Stage 1. 687 reviews in 30 days, and a refrigerator.
17:10	Closing Remarks & Awards — Gadi Evron	—	Stay. The awards are here, and the CTF village ran this afternoon.

The five clashes that will hurt

Day 1, 11:35 — StealthBench against the 86-million-item GitHub scan. The worst one on the agenda. Wood and Dawson have the number everyone will cite for a year: across 771 trajectories and 8 models, no model exceeded a 53.8% safe-success rate, with some capable models finishing the task while acting recklessly. Nakibly and Babo have the only population-scale measurement of injection in the wild: about 2.5 per 100K of 86 million GitHub items, with a detector and taxonomy released. Skip StealthBench and you miss the benchmark that reframes "capable". Skip Radware and you have no base rate to argue budget with. Both abstracts promise released artefacts, so this is the clash to resolve on the stream.

Day 1, 13:55 — the RAPTOR sandbox against the token sampler. Cuthbert is candid about the security issues his own team introduced while building an agent sandbox for a harness that runs untrusted code; that is the talk you want if you are building one this quarter. Ovando has about 6.1 million inference calls in the Tantalus arena, models from 1.7B to 119B, and one control that provably blocked bad outputs at 100%. We take Ovando because the finding is portable and the sandbox lessons will survive in writing. You give up the honest failure stories, which are usually the more useful half.

Day 1, 15:30 — two Chrome chains against an automated kill chain. Dolan-Gavitt compares a largely human two-month full chain against six days with AI agents, earning $250,000. Bulut and Mangal report a red agent through 10 phases in about 45 minutes at roughly 77% verified success. Offensive researchers will want the first; purple teams will want the second. We take the chains, because a VRP submission is a hard external verdict and a purple-team loop grades itself.

Day 2, 11:35 — stochastic false negatives against Trojan open-weight models. Simecek's 25,000 trials and 7,600 CVE rediscovery runs break the assumption underneath every AI scanning programme: that a clean run means a clean file. Mada and Gabasova build realistic Trojan open-weight models with triggers that preserve normal capability, and test detection from linear probes to J-space. If you consume open weights, the Trojan talk is the one that changes your intake. We still take Stage 1, because scanner reliability affects everyone in the room and Trojan models affect a subset.

Day 3, 15:55 — shadow testing against self-hardening environments. Waitzenberg and Harush split an autonomous SOC agent into investigation and verdict stages to locate nondeterminism, and found most variation came from loosely structured playbooks. Cohen's "env-play" generates harder investigation environments against a fixed investigator, with a live demo on why the team reads investigator queries instead of trusting scores. Both are about not believing your own SOC agent. We take Stage 1: locating nondeterminism is the prerequisite, and generating harder scenarios against an agent you cannot explain just produces prettier confusion.

Honourable mention: Day 1 at 16:20, a constitution-guided cloud hunt reporting 90+ valid findings against the last mile of remediation. That one splits cleanly by job.

If you only have one day

• A builder shipping agents: Day 1. Capsem, the three-body problem, the Tantalus result, Tenacity, the RAPTOR sandbox and the detonation chamber are all on it. Day 1 is the architecture day.
• A red teamer: Day 2. Inference-time abliteration, 33 open-weight models on two DGX Sparks, Trojan model construction, consumer robot 0-days, the Haiku-based auto-exploiter and the open-directory hunt. Day 1 has the better exploitation chains if you can only pick by talk. Our methodology for red-teaming an agentic system is the background reading.
• A SOC lead: Day 3. SOC agent context engineering, shadow testing for nondeterminism, env-play, twelve consoles correlated by one agent, and BITE. It pairs with what we found reporting on the agentic SOC in production.
• A CISO or governance owner: Day 3, and it is not close. 40 enterprises on governance as code, 28 organizations on real deployments, Schneier on integrity, Yu on least agency, Roblox on tool adoption without blanket refusal, Moderna on 687 reviews in 30 days, and attestation graded against the EU AI Act, SOC 2 and ISO 42001. If two of you can come, send the second person to Day 2 for the CISOs debrief. Then run our pre-deployment checklist against what you heard.

What you cannot get from the stream

Be honest about this before choosing to watch remotely, as we are. The villages are in the room: the CTF village on Day 1 morning and afternoon and Day 3 afternoon, the Harness village on Day 2 morning, the Defense village on Day 2 afternoon, and the Art village on Day 3 morning. A hands-on village is not a talk and does not become one on a video feed.

Neither do the two side events: the Opening Reception on October 26, 18:00–22:00 at The UNDERDOGS Cantina, 128 King St, and After Hours on October 28, 18:00–21:00 at The Hibernia, 1 Jones St. Demos are encouraged throughout, and watching one over a shoulder is not watching one on a slide. The talks will keep. The rooms will not.