---
title: "Your [un]prompted II Clash Guide: Stage 1 Against Stage 2, Hour by Hour"
description: "Two stages, 85 session slots, 20 minutes each. We went through the published [un]prompted II agenda slot by slot and made a call on every clash, including the five that will genuinely hurt."
author: "Renn Calloway"
category: "AI Security Conferences"
date: 2026-10-16T13:30:02.666Z
canonical: "https://agenticcyber.co/blog/unprompted-ii-schedule-conflicts"
---

# Your [un]prompted II Clash Guide: Stage 1 Against Stage 2, Hour by Hour

![A printed conference timetable on a table with a pen resting across the columns.](https://hsppuvezyxmkpzkgfkho.supabase.co/storage/v1/object/public/media/conference/5bc07ae2-9ee0-46b9-9820-b0704936f742/unprompted-ii-schedule-conflicts.jpg)

> Two stages, 85 session slots, 20 minutes each. We went through the published [un]prompted II agenda slot by slot and made a call on every clash, including the five that will genuinely hurt.

Two stages. 85 session slots. Twenty minutes each, plus ten minutes of questions. That arithmetic is the whole problem with **[un]prompted II** — most people search for it as *unprompted* — because nearly every hour on the published agenda forces a choice, and about five of those choices are genuinely hard. Our [conference guide](/blog/unprompted-ii-conference-guide) covers the event itself. This is the clash guide: Stage 1 against Stage 2, hour by hour, with a call on each one.

## How to read this unprompted agenda guide

Built from the [official agenda](https://unpromptedcon.org/agenda-10-2026/), read on 2026-10-12. Times move, speakers drop, and five of the 85 slots had no named speaker when we read it — they are marked TBA or TBD below, not filled in with guesses. We are independent coverage, not the organiser, not a sponsor, not a media partner, and we are following remotely rather than from the room. No talk has happened yet, so every "our call" is a bet on a published abstract, not a review.

One thing works in your favour. [un]prompted II is hybrid, in person plus online, which means some of these choices can be deferred to the stream instead of being made in a corridor at 11:30. We flag the clashes where that is the right move.

## Day 1, hour by hour — Tuesday, October 27

TimeStage 1Stage 2Our call

08:30Gathering & Mingling—Arrive early. The CTF village runs morning and afternoon today.
09:00Opening Words — Gadi Evron—Stage 1. He opens and closes all three days.
09:35"WTF Was That?" — Sima, EckmannAll Tokens Are Created Equal (CxBOM) — Lambros, WilmotStage 2. No abstract published for Stage 1; CxBOM ships with a demo.
10:00Capsem hardware sandboxing — BurszteinAttention Is All You Need — Shintre, MukherjeeStage 1. Capsem is open source and you can run it Monday.
10:45How Meta Changed Building Secure Software — MolnarInto the Wild: honeypot forensics — TakahashiStage 1. The ~90% coverage and flat time-to-fix numbers frame the day.
11:10DARPA AIxCC to Microsoft FORGE Lab — KimSay Shibboleth: fingerprinting attack models — Epp, PasquiniStage 2 if you do attribution. Otherwise Stage 1.
11:35**StealthBench — Wood, Dawson****86 million GitHub items scanned — Nakibly, Babo****Painful.** Stage 1 by a hair: 53.8% is the number of the conference.
12:00CISA on AI-enabled vulnerability management — DonovanPromptware EOD: skill detonation — Sharbat, DonatoStage 2. The detonation chamber is being released publicly.
13:30Prompt, Patch, Prove — de WaalSandboxing Is a Three-Body Problem — AgrawalStage 2. Containment, provenance, authority is the frame you will reuse.
13:55**Your Sandbox Degrades Gracefully (RAPTOR) — Cuthbert****The Model Is NOT a Security Control — Ovando****Painful.** Stage 2: 6.1M inference calls, one control at 100%.
14:20Three Years of Evals Later — MeyerovichBackdoors That Evade CoT Monitoring — SeveriStage 1 if you buy agents. Stage 2 if you host open weights.
14:45Who Authorized the Agent? — BaranovskyiConfining Cross-Site Prompt Injection (Tenacity) — Chaudhari, ChandakStage 1. Inline proxy versus decision-only API is the architectural call.
15:30**A Tale of Two Chains — Dolan-Gavitt****The Autonomous Adversarial Loop — Bulut, Mangal****Painful.** Stage 1: six days and $250,000 against two human months.
15:55Models vs Cyber Reality — HeldtSecure Product Development With Mantis — Galloway, ShahStage 1. 12 working exploits, zero accepted patches.
16:20Your Harness Needs a Security Constitution — TraxlerOpened Is Not Fixed — NejadStage 2 if you own remediation. Stage 1 if you own hunting.
16:450-Click Remote Exploits in an AI World — Dang, GrozaAI Safety Hype vs. Reality — Herbert-VossStage 1 for the WeChat, WhatsApp and iOS case studies.
17:10Debate: Where is the vulnpocalypse? — Epp vs Grossman—Stage 1. Everyone will be there. Go anyway.
17:35Closing remarks — Gadi Evron—Short. Stay for it.

## Day 2, hour by hour — Wednesday, October 28

TimeStage 1Stage 2Our call

09:00Opening Words — Gadi Evron—Stage 1. The Harness village runs this morning.
09:35Weightless: Abliteration Without the Weights — SuicheCryptography Under AI Pressure — JoStage 1. Inference-time refusal removal changes your open-weight threat model.
10:00Same Score, Different Brain — SchulzMath Ability has Consequences — SaarinenStage 1, unless you own crypto. Then Stage 2, twice over.
10:45There Isn't a Security Problem an Agent Can't Help Solve — DeshpandeKuna: autonomous C decompiler — BasqueStage 1 for the workflow framework. Reverse engineers, Stage 2.
11:10Metrics for Agentic Systems — NajeebTwo Sparks Walk Into a Lab — ShermanStage 1. Metrics beyond accuracy is the gap most programmes have.
11:35**The Scanner Said Clean. We Ran It Again — Simecek****Hidden Triggers, Harmful Payloads — Mada, Gabasova****Painful.** Stage 1: 25,000 trials on stochastic false negatives.
12:00Offense != Defense: Hunt, Bust, Climb — KozlovOH MODEL, WHERE ART THOU — Tulis, CiancagliniStage 1. Finding and hunting are different skills, and that matters more.
13:30*TBD* (no speaker listed)Built to Spec, Ignored in Practice — Rose, WilliamsStage 2. 35 unapproved AI cases in one day earns it. Defense village opens.
13:55Designing a Cyber Ontology for Agents — ChismonPermission Fatigue Is a Security Bug — Chennabasappa, PuderbaughStage 2. 80% friction reduction, with taint tracking behind it.
14:20Memory Is the New Attack Surface (Memory Dojo) — Severi, YangYour AI Analyst Is Confidently Wrong — Kovalsky, ArshadStage 1. Memory Dojo traces poisoning across five memory architectures.
14:45Building the Defender's Advantage — LukosiutePandora's Dir — Dolfing, EttedguiStage 2. Real criminal AI infrastructure beats a collaboration invitation.
15:30Claude Can Capture the Flag. Can It Hold the Fort? — YestekovAuditing Someone Else's Confidential AI — MellacheruvuStage 1. 200+ concurrent agents as blue team, and their mistakes.
15:55Every Dog Has its 0-day — WoodAI Client Builders are Not Security Companies — Frazer, InckotStage 2 if you run Cursor or Claude Code at scale. Else Stage 1.
16:20Auto-Exploiter, Ratchet Loop and Haiku — Cartwright, EvronAgencyScore and AgencyGym — Raghavan, KeirsteadStage 2. Measuring excessive agency before deployment is the scarcer thing.
16:45Stolen Thoughts — *no speaker listed*Half the Model Never Multiplies — NeupaneStage 2. Stage 1 has a title and nothing else yet.
17:10CISOs debrief — *no speakers listed*—Stage 1. Unnamed panel, but the only CISO-to-CISO slot on the agenda.
17:45Closing Remarks — Gadi Evron—Then After Hours, 18:00–21:00, The Hibernia.

## Day 3, hour by hour — Thursday, October 29

TimeStage 1Stage 2Our call

09:00Opening Words — Gadi Evron—Stage 1. The Art village runs this morning.
09:35The death of TTPs — SelaAttacking Truth: proof assistant kernels — BrossardStage 1. An autonomous campaign in the wild resets detection assumptions.
10:00–Dangerously-Deploy-Sandboxes — ReedBeyond the SBOM: Open PBOM — Athreya, VenkateshStage 1, with the caveat that details wait on coordinated disclosure.
10:45What 40 Enterprises Had — WoodruffTwelve Consoles, One Investigation — IqbalSOC leads Stage 2. Everyone else Stage 1 for governance as code.
11:10Agentic AI in the Wild — Wang, Jaksic*TBA*Stage 1. Stage 2 is unfilled, and the deadlocked platform story is worth it.
11:35Integrous AI Systems Design — Schneier*TBA*Stage 1, no contest. Stage 2 is still TBA.
12:00Giving AI Religion (least agency, C4) — YuWe don't need an LLM for That — Mountrouidou, WilsonStage 1 for least agency. Detection engineers, Stage 2.
13:30Victim as a Service — MirianApproval Is Not Human Presence — McMillinStage 2. A deployed MCP permission broker with a live boundary test.
13:55AI Inference Privacy and Confidentiality — RomaillerReading the Residual Stream — Shtar, EladStage 2. Activation probes in production, with no LLM judge to inject.
14:20Agent Authorization Is Not a Vault Problem — Zimmerle, BrancoEngineering Context for SOC Agents — DyeStage 1. The agent writes the summary the human approves. Go.
14:45Everyone Wants All the AI Tools. Good. — GrinsteadBuilding Security Review Agents — BelloStage 2. Models reliable, guardrails deterministic, human decides.
15:30Enterprise OpenClaw — FinolFrom Patch Generation to Evidence — AvrahamiStage 1 if you run agent fleets. Stage 2 if you merge AI patches.
15:55**Same Threat, Two Verdicts — Waitzenberg, Harush****env-play self-hardening environments — Cohen****Painful.** Stage 1: locating nondeterminism beats generating harder scenarios.
16:20BITE — Geyshis, IsascharWhen Evaluation Runs Start Talking — NevoStage 2. Evaluation collusion between agents is nearly unexamined.
16:45Threat Model Impossible — Karimi—Stage 1. 687 reviews in 30 days, and a refrigerator.
17:10Closing Remarks & Awards — Gadi Evron—Stay. The awards are here, and the CTF village ran this afternoon.

## The five clashes that will hurt

**Day 1, 11:35 — StealthBench against the 86-million-item GitHub scan.** The worst one on the agenda. Wood and Dawson have the number everyone will cite for a year: across 771 trajectories and 8 models, no model exceeded a **53.8% safe-success rate**, with some capable models finishing the task while acting recklessly. Nakibly and Babo have the only population-scale measurement of injection in the wild: about **2.5 per 100K** of 86 million GitHub items, with a detector and taxonomy released. Skip StealthBench and you miss the benchmark that reframes "capable". Skip Radware and you have no base rate to argue budget with. Both abstracts promise released artefacts, so this is the clash to resolve on the stream.

**Day 1, 13:55 — the RAPTOR sandbox against the token sampler.** Cuthbert is candid about the security issues his own team introduced while building an agent sandbox for a harness that runs untrusted code; that is the talk you want if you are building one this quarter. Ovando has **about 6.1 million inference calls** in the Tantalus arena, models from 1.7B to 119B, and **one control that provably blocked bad outputs at 100%**. We take Ovando because the finding is portable and the sandbox lessons will survive in writing. You give up the honest failure stories, which are usually the more useful half.

**Day 1, 15:30 — two Chrome chains against an automated kill chain.** Dolan-Gavitt compares a largely human two-month full chain against **six days with AI agents, earning $250,000**. Bulut and Mangal report a red agent through **10 phases in about 45 minutes at roughly 77% verified success**. Offensive researchers will want the first; purple teams will want the second. We take the chains, because a VRP submission is a hard external verdict and a purple-team loop grades itself.

**Day 2, 11:35 — stochastic false negatives against Trojan open-weight models.** Simecek's **25,000 trials and 7,600 CVE rediscovery runs** break the assumption underneath every AI scanning programme: that a clean run means a clean file. Mada and Gabasova build realistic Trojan open-weight models with triggers that preserve normal capability, and test detection from linear probes to J-space. If you consume open weights, the Trojan talk is the one that changes your intake. We still take Stage 1, because scanner reliability affects everyone in the room and Trojan models affect a subset.

**Day 3, 15:55 — shadow testing against self-hardening environments.** Waitzenberg and Harush split an autonomous SOC agent into investigation and verdict stages to locate nondeterminism, and found most variation came from loosely structured playbooks. Cohen's "env-play" generates harder investigation environments against a fixed investigator, with a live demo on why the team reads investigator queries instead of trusting scores. Both are about not believing your own SOC agent. We take Stage 1: locating nondeterminism is the prerequisite, and generating harder scenarios against an agent you cannot explain just produces prettier confusion.

Honourable mention: Day 1 at 16:20, a constitution-guided cloud hunt reporting 90+ valid findings against the last mile of remediation. That one splits cleanly by job.

## If you only have one day

- **A builder shipping agents:** Day 1. Capsem, the three-body problem, the Tantalus result, Tenacity, the RAPTOR sandbox and the detonation chamber are all on it. Day 1 is the architecture day.

- **A red teamer:** Day 2. Inference-time abliteration, 33 open-weight models on two DGX Sparks, Trojan model construction, consumer robot 0-days, the Haiku-based auto-exploiter and the open-directory hunt. Day 1 has the better exploitation chains if you can only pick by talk. Our [methodology for red-teaming an agentic system](/blog/how-to-red-team-an-agentic-system-practitioners-methodology) is the background reading.

- **A SOC lead:** Day 3. SOC agent context engineering, shadow testing for nondeterminism, env-play, twelve consoles correlated by one agent, and BITE. It pairs with what we found reporting on [the agentic SOC in production](/blog/the-agentic-soc-is-here-how-salesforce-datadog-and-greynoise-are-putting-autonom-6vby).

- **A CISO or governance owner:** Day 3, and it is not close. 40 enterprises on governance as code, 28 organizations on real deployments, Schneier on integrity, Yu on least agency, Roblox on tool adoption without blanket refusal, Moderna on 687 reviews in 30 days, and attestation graded against the EU AI Act, SOC 2 and ISO 42001. If two of you can come, send the second person to Day 2 for the CISOs debrief. Then run our [pre-deployment checklist](/blog/agentic-ai-security-checklist-pre-deployment) against what you heard.

## What you cannot get from the stream

Be honest about this before choosing to watch remotely, as we are. The villages are in the room: the CTF village on Day 1 morning and afternoon and Day 3 afternoon, the Harness village on Day 2 morning, the Defense village on Day 2 afternoon, and the Art village on Day 3 morning. A hands-on village is not a talk and does not become one on a video feed.

Neither do the two side events: the Opening Reception on October 26, 18:00–22:00 at The UNDERDOGS Cantina, 128 King St, and After Hours on October 28, 18:00–21:00 at The Hibernia, 1 Jones St. Demos are encouraged throughout, and watching one over a shoulder is not watching one on a slide. The talks will keep. The rooms will not.

## FAQ

### Where is the official [un]prompted II schedule, and is this guide current?

The official agenda is at unpromptedcon.org/agenda-10-2026/. We read it on 2026-10-12 and built these tables from it. Times and speakers can change, and five of the 85 slots had no named speaker when we read it.

### Can I attend [un]prompted II online?

Yes. [un]prompted II is hybrid, in person plus online, October 27–29, 2026 in San Francisco. The talks are the part that streams. The villages, the CTF and the two evening events are not.

### How long is each session?

Sessions run 20 minutes with 10 minutes of questions. There are also 10-minute lightning talks, and demos are encouraged. That is tight enough that arriving late to a 20-minute talk means missing a third of it.

### Which day should I pick if I can only attend one?

Day 1 for builders, Day 2 for red teamers, Day 3 for SOC leads and for CISOs or governance owners.

### Where is the official schedule, and is this one current?

The official agenda is at unpromptedcon.org. We read it on 2026-10-12 and built these tables from it. Times and speakers can change, and five of the 85 slots had no named speaker when we read it.

### Can I attend online?

Yes. [un]prompted II is hybrid, in person plus online, October 27–29, 2026 in San Francisco. The talks are the part that streams. The villages, the CTF and the two evening events are not.


---
Source: https://agenticcyber.co/blog/unprompted-ii-schedule-conflicts