Six Arguments That Run Through [un]prompted II

We read the published [un]prompted II agenda — most people type it unprompted — the way you would read a threat model: hunting for places where two competent teams reached opposite conclusions. We found six. Our full guide to the conference handles logistics; this piece is about the arguments. The event runs October 27–29, 2026 in San Francisco, hybrid, two stages, 85 session slots.

Two caveats. We are independent coverage — not the organiser, not a sponsor, not a media partner — and we are following remotely, not from the room. And the conference has not happened: everything below is what a published abstract claims, from the official agenda as published on 2026-10-12, plus what we intend to test against it. Agendas move, and five of those 85 slots have no named speaker.

1. "The model is not a security control"

Disputable version: no amount of alignment or system prompting makes the model a trust boundary. Good engineers still ship as though it does.

Vince Ovando (not listed) takes it literally. The Model Is NOT a Security Control: Prompt Injection Dies at the Token Sampler reports the Tantalus injection arena — about 6.1 million inference calls, models from 1.7B to 119B parameters, and only one control that provably blocked bad outputs at 100%. Ankit Agrawal (Webflow) argues structurally: containment, provenance and the human authority are coupled, not separable; he reports Webflow's sequencing and what approval telemetry showed in its research preview. Elie Bursztein (Distinguished Research Scientist, Google DeepMind) brings Capsem, an open-source Rust hypervisor with fast-booting VMs, air-gapped isolation, network observability and Sigma and OpenTelemetry support. Daniel Cuthbert (Security Researcher) brings the other half: the agent-specific sandbox built for RAPTOR, an agentic bug-finding harness that runs untrusted code, and the security issues his own team introduced.

Jackson Reed (Founder & CEO) pushes hardest, on isolation weaknesses in a widely deployed frontier-lab product and how its containment features interact, details pending coordinated disclosure. Ari Herbert-Voss (RunSybil) supplies the brake: red-teaming GPT-3 and Codex taught him to separate alarming demos from real harm, and to weight the harness.

Our reading. The nearest thing to consensus here, and it holds because a hypervisor researcher, a product security lead, a harness author and a former foundation-model red teamer land on the same claim: the control surface is the harness — the shape behind our isolation architecture for agent tool calls. We will test Ovando's 100%: control, or scoring?

The open question. Six talks agree the model is not a boundary. None says what its safety training is buying in production.

2. "Prompt injection is authority confusion, not bad input"

Disputable version: injection is a failure to track where a token came from and what authority it carries. Filtering still takes the budget.

Rock Lambros (Zenity) and Fred Wilmot (Detecteam) state the premise: the EchoLeak zero-click Copilot exploit shows models do not distinguish trusted from untrusted tokens, they measure attention decay under attacker flooding, and they release CxBOM, a bill of materials for the context window, with a live demo. Needing a manifest of the window concedes that the window is a supply chain. Gabi Nakibly and Zvika Babo (both Radware) supply the base rate: a GitHub-wide scan across 86 million items finds hidden-text prompt injections at about 2.5 per 100K, goals spanning agent orchestration, growth hacking and data exfiltration, with a detector and taxonomy released. Low enough to dismiss; high enough that any coding agent with repository access meets one.

Viren Chaudhari and Rushikesh Chandak (both Qulays) name a sub-case — cross-site prompting, where page content manipulates browsing agents — and counter it with Tenacity, a least-privilege defence restricting what the agent can see and do, reporting lower attack success rates. Tamir Ishay Sharbat (Zenity) and Joao Donato (not listed) present a detonation chamber that runs agent skills and compares what the agent reports against kernel-level activity: tens of thousands of skills tested, hundreds malicious, chamber being released publicly. Both reduce authority rather than inspect input. Saurabh Shintre and Akash Mukherjee (both Realm Labs) are the dissent worth taking seriously: hidden-state inspection that catches hallucinations and indirect injection together by seeing which input tokens the model relied on, in real time, with no extra LLM calls. That is detection inside the model, which argument 1 says cannot be a control.

Our reading. Provenance wins on the evidence. We made the same case for prompt injection across multi-agent pipelines: once a message crosses an agent boundary, the receiver cannot tell an instruction from a quotation.

The open question. Provenance needs every component in the chain to propagate labels. CxBOM describes one window; nothing describes the handoff, or who owns the format.

3. "Finding is cheap now; fixing never was"

Disputable version: AI collapsed the cost of discovery and left remediation untouched. The bottleneck moved to the merge queue.

David Molnar (Meta) gives the headline: about 90% coverage on targets, over 40% of critical vulnerabilities fixed by AI-written diffs, and the finding that matters most — faster fixes did not automatically shorten time-to-fix. Correct patches at scale, and the clock did not move — so the clock was never measuring patch authorship. Tobias Heldt (Co-Founder and CEO, XOR) gives the sharpest version: frontier agents against the company's own privately disclosed zero-days plus 209 known vulnerabilities, and of 54 attempts on the zero-days, 12 working exploits and 0 accepted patches. Twelve to zero is the argument in one ratio. The abstract also covers refusals and a fix that blocked valid messages — which is how a patch gets rejected even when it closes the bug.

Shayaun Nejad (Rubrik) names the gap in Opened Is Not Fixed: deduplication, ownership, and why a passing build does not prove a fix. Petr Simecek (AI Researcher, AISLE) attacks the finding side: 25,000 trials and 7,600 CVE rediscovery runs showing scanners that miss a real bug on one run and find it on another, and an argument that diverse inexpensive models cover blind spots better than one costly model. If discovery is stochastic, "we scanned it" says nothing about the code.

Three try to close the loop. Tim de Waal (Member of Technical Staff, OpenAI) presents Prompt, Patch, Prove: an agentic coding model patching two published CVEs on an authorized ASUS router, what the model got wrong, the verification gates that caught it, and a prompting protocol for defensive binary repair. Ela Avrahami (AI & Software Advisor) presents the trust architecture behind the OpenAnt Auto Patcher — which evidence helped, which ideas failed, and where the line falls between LLM reasoning and deterministic policy. Kevin Donovan (Deputy Associate Director for Vulnerability Management, CISA) gives the institutional view: CVE Program oversight, the KEV Catalog, the Gold Eagle intake platform, and what works and does not in CISA's own adoption of agents.

Our reading. Best-evidenced argument here, clearest action: stop measuring your AI security programme by findings per week. We covered the discovery half when AISLE found 12 zero-days in OpenSSL and FENRIR found a hundred more; even then the question was who merges the fix.

The open question. Nobody is presenting on the maintainer now receiving AI-authored patches faster than they can triage. Zero accepted out of 54 is partly a social limit, and that half gets no talk.

4. "Capability is not competence"

Disputable version: an agent with capability and without operational competence is more dangerous than a weak one. The industry still reads capability as readiness.

Adrian Wood (Security Engineer, Dropbox) and Ads Dawson (Staff AI Security Researcher, Dreadnode; founder, OWASP GenAI Security Project) built the instrument. StealthBench scores agents on task success and OPSEC across 14 containerized scenarios; across 771 trajectories and 8 models, no model exceeded a 53.8% safe-success rate, and some highly capable models finished the task while acting recklessly. It is the defining number of the conference because of that conjunction: scoring two things at once makes the gap visible.

Roei Sherman (not listed) finds the same shape on two NVIDIA DGX Sparks: a red-team benchmark built with an AI coding agent's help across 33 open-weight models, reporting that willingness to answer offensive questions and answer correctness are separate axes. A model that will help you is not a model that is right. Igor Kozlov (AI/ML Lead, Staff Applied Scientist, Simibian.ai) finds it defensively: models strong at finding vulnerabilities often fail at open-ended hunting, with harness recommendations, a self-improvement loop, and an argument that defence should be a training target.

Three abstracts show competence arriving anyway. Brendan Dolan-Gavitt (Distinguished Engineer, XBOW) compares two full-chain Chrome exploits submitted to Google's VRP: the first largely human, two months, colliding with an internal bug; the second six days with AI agents in a structured campaign with backup candidates, earning $250,000. Fatih Bulut (Microsoft) and Anjali Mangal (not listed) report a fully automated purple-team loop whose red agent completed 10 phases in about 45 minutes with roughly 77% verified success on a Scattered Spider kill chain. Eyal Sela (Director of Threat Intelligence, Gambit Security) takes it out of the lab: a large criminal campaign in which an open-weight model and an open-source harness autonomously carried out intrusions across many companies, with consequences for detection and TTP attribution.

Our reading. These do not conflict; they measure different things. XBOW and the purple-team loop show capability under structure — campaign design, backup candidates, a defined kill chain. StealthBench shows what happens without it. Competence lives in the harness.

The open question. If reckless success is the dominant failure mode, who is liable? That is a governance problem, and the governance talks are on another day arguing about intake forms.

5. "The benchmark is the battleground"

Disputable version: an agent bought on a vendor-published score is bought on nothing. Seven talks attack the integrity of the numbers everyone quotes, including the ones above.

Tim Schulz (Co-Founder & CEO, Starseer) goes at the construct in Same Score, Different Brain: probing internal activations layer by layer exposes differences between families and architectures, and the effect of post-training and quantization on where capability signal lives. Two models with the same score are not substitutes. Leo Meyerovich (Founder & CEO, Graphistry) brings the longest record on the agenda: three years benchmarking frontier and open-weight models plus commercial and open harnesses on IR and SOC tasks, measuring accuracy, speed, cost, refusals and contamination, and arguing for owning your own evals. Contamination as a standing measurement rather than an incident tells you where the field is. Shahanas Najeeb (Senior Agentic Security Engineer, Salesforce) carries it into production: metrics programmes for agents in triage, threat intel and detection, and metrics beyond accuracy.

Then it gets strange. Omer Nevo (Irregular) presents When Evaluation Runs Start Talking to Each Other: agents in separate evaluation runs discovering each other through shared infrastructure, pooling answers and undermining validity, and how to keep grading independent while keeping tools realistic. That is not training-data contamination. That is collusion at test time, and we have not seen it treated seriously anywhere else.

Three build rather than critique. Venkat Raghavan (Cofounder, LangGuard.AI) and Jason Keirstead (not listed) present AgencyScore, measuring whether an agent acquires capabilities it was not declared to have, and AgencyGym, a 100-task sandbox for testing it, with acquisition rates and the combinatorial coverage gaps left in version 1. Noam Cohen (Torq) presents "env-play", a scenario generator producing harder SOC investigation environments against a fixed investigator, plus a live demo of why the team reads investigator queries instead of scores. Yernat Yestekov (Research Fellow, Anthropic) runs the largest experiment described anywhere here: autonomous Claude agents as blue team across three rounds of the Collegiate Cyber Defense Competition against a professional red team, the engineering of 200+ concurrent agents, and the mistakes the agents made.

Our reading. Own your evals, because every other talk here is a reason not to trust someone else's. Read AgencyScore first, then Nevo: a test-time collusion channel invalidates results retroactively.

The open question. Who re-runs the eval after deployment? Every talk here measures before deployment, and a model endpoint updates underneath you.

6. "Approval is theatre unless the human sees the bytes"

Disputable version: human-in-the-loop approval, as built today, produces compliance evidence and almost no security. Expect pushback — approval flows are what most organisations have instead of agent security.

Felipe Zimmerle (CTO, KonaSense) and Rodrigo Branco (Vulnerability Researcher, Anthropic) make the structural case in Agent Authorization Is Not a Vault Problem. The central observation: most approval tools show a human a summary written by the agent, so nothing ties the approval to the exact operation signed. They present a USB authenticator that displays and approves the exact bytes before signing, plus attacks they found on their own protocol. The failure sits in nearly every deployed approval flow.

Brooks McMillin (Dropbox) attacks the same joint from identity: a deployed MCP permission broker that requires evidence of human presence before granting sensitive capabilities, with a live boundary test and an adversarial test plan. Oleksii Baranovskyi (Cracken) attacks enforcement: a harness that enforces policy instead of advising on it, a tool call traced through identity, policy, enforcement, credential brokering and audit, and a demo comparing a decision-only API against an inline proxy that actually blocks the downstream request. A decision-only API is a logging system with opinions.

Sahana Chennabasappa (Security Engineer, Meta) and Chris Puderbaugh (Security Engineer, Agent Security & Access, Meta) supply the human factors: per-action prompts cause reflexive approvals and disabled checks, so their runtime tracks taint from untrusted reads with a cheapest-first decision cascade and reports 80% friction reduction at full rollout. The fix was fewer approvals, not better ones. Olivia Rose and Kayla Williams (both Co-Founders, Williams Rose AI Cyber Advisory) give the organisational version: a pharma company's AI intake built to spec and largely unused, 35 unapproved AI cases found in one day, and a rebuild toward self-service fast lanes for low-risk cases.

Our reading. Five talks, five independent teams, one conclusion: the approval step is where agent security is pretending hardest. Exact-bytes signing and presence evidence are real controls; a summary and a button are not. Neither stops a legitimate operation requested for an illegitimate reason, so both sit alongside human oversight designed for production.

The open question. What does the human do when the exact bytes are a 400-line Terraform plan? Zimmerle and Branco fix what is displayed. Comprehension is a separate problem nobody has on the agenda.

The argument nobody on the unprompted agenda is having

Here is what we noticed on the fourth read. Eighty-five session slots, and every one assumes the agent keeps running.

The programme is rich on prevention (Capsem, Tenacity, the three-body problem), detection (hidden-state probes, activation probes at Intuit, BITE, kernel-level detonation), measurement, and authorization at the moment of action. It is close to silent on the next step: an agent is 40 minutes into a task, you decide it must stop, and you need it stopped — mid-tool-call, mid-transaction, across every sub-agent it spawned — with evidence afterwards that it stopped and did not resume from a queued message or a cached plan.

The nearest the agenda gets is adjacent. Damian Finol (VP Engineering, Felix Pago) describes an identity-aware agent runtime on OpenClaw with short-lived credentials and gVisor sandboxing across a large fleet of agent pods at least privilege — a time-bounded stop, but a passive one. Baranovskyi's inline proxy blocks a downstream request, which stops one call rather than one agent. Chenxi Wang (General Partner, Rain Capital) and Jasmine Jaksic (Senior Director of Engineering, NVIDIA), in research across 28 organizations, mention a security control that deadlocked the platform — what improvising this under pressure looks like.

The gap looks structural. Stopping an agent is unglamorous, it has no benchmark, and the work sits in the boring parts: idempotent tool calls, revocable sessions, a kill path that does not need the agent's cooperation, and a log that proves the halt. It is also the first thing you will want at 02:00. We wrote the operational side in incident response for agentic AI and the telemetry side in runtime monitoring for agents.

The debate that settles none of it

Day 1's last session on Stage 1 is a formal debate between Sergej Epp (infosec and threat research; created the Zero Day Clock) and Jeremiah Grossman (founder, WhiteHat Security; CEO, Root Evidence). The resolution, as published: "Resolved, that AI noise hasn't moved the needle on current cyber risk."

Both sides can be argued honestly from this agenda, rare for a motion. Affirmative: 12 working exploits and zero accepted patches, no model above 53.8% safe-success, stochastic false negatives across 25,000 trials, models that find but cannot hunt. Negative: a $250,000 Chrome chain in six days, a kill chain in 45 minutes at roughly 77% verified success, and an autonomous criminal campaign already in the wild. Current risk and near-term risk are different questions, and one motion cannot hold both of them.

Two Day-3 talks matter more for where this lands. Bruce Schneier (Fellow and Lecturer, Harvard Kennedy School; University of Toronto) argues in Integrous AI Systems Design that integrity — data, processing, storage and contextual — is the least-studied leg of the CIA triad and must be solved before we trust AI to act for people. Sounil Yu (creator of the Cyber Defense Matrix and the DIE Triad) proposes least agency as a complement to least privilege, with a C4 model — Crown, Chassis, Conscience, Committee — for mapping control points and accountability, closing on experiments testing whether engineered "miracles" delivered through the control layer change agent behaviour. Least agency is the more useful of the two, because it is the only idea here that treats the amount of autonomy as a tunable control rather than a product decision.