Who Is Speaking at [un]prompted II: Every Session by Speaker, Company and Subject

[un]prompted II, the AI Security Practitioner Conference that many people search for as "unprompted", runs October 27-29, 2026 in San Francisco. The agenda lists 85 sessions on two stages over three days, and the line-up is the argument: who the programme invites says what the field now thinks is worth a stage. Our [un]prompted II conference guide covers the whole event. This page answers one question: who is speaking.

The names below come from the official agenda, which we read on 2026-10-12. An agenda can change, and this one still has open slots. We are independent coverage. We are not the organiser, a sponsor or a media partner, and we are following the event remotely. The conference has not happened, so this page never states what a speaker said. It reports what each published abstract claims, and what we plan to test.

The unprompted speakers, A to Z

This table lists every named speaker on the agenda as published on 2026-10-12, sorted by surname. A speaker with two talks has two rows. A blank company cell means the agenda lists none. We did not fill gaps by guessing. Gadi Evron, who is the host, opens and closes all three days on Stage 1.

Speaker	Company	Talk	Day and stage
Ankit Agrawal	Webflow	Sandboxing Agents is a Three-Body Problem: Containment, Provenance, and the Human Authority	Day 1, Stage 2
Ali Arshad	Consortium Networks	Your AI Analyst Is Confidently Wrong: Adversarial QC for Agentic Security Analysis	Day 2, Stage 2
Aishwarya Athreya	Visa	Beyond the SBOM: Proving Process Integrity with the Open PBOM Specification	Day 3, Stage 2
Ela Avrahami		From Patch Generation to Evidence: Building Trust in AI-Generated Code	Day 3, Stage 2
Zvika Babo	Radware	Who Is Prompt-Injecting Coding Agents? A Scan of 86 Million GitHub Items	Day 1, Stage 2
Oleksii Baranovskyi	Cracken	Who Authorized the Agent? Making the AI Harness an Enforceable Compliance Boundary	Day 1, Stage 1
Zion Basque	University of Georgia	Kuna: Building a Competitive C Decompiler Through Autonomous AI Research	Day 2, Stage 2
Gabe Bello	Twilio	Building Security Review Agents: the Models are the Reliable Part	Day 3, Stage 2
Rodrigo Branco	Anthropic	Agent Authorization Is Not a Vault Problem	Day 3, Stage 1
Jonathan Brossard	PSIRT.COM	Attacking Truth: Breaking Proof Assistant Kernels in the Age of Vericoding	Day 3, Stage 2
Fatih Bulut	Microsoft	The Autonomous Adversarial Loop: Fully Automating an Octo Tempest Purple-Team Simulation	Day 1, Stage 2
Elie Bursztein	Google DeepMind	Taming AI Agents with Capsem: Hardware Sandboxing That Doesn't Kill Productivity	Day 1, Stage 1
John Cartwright		Auto-Exploiter by Use of a Ratchet Loop, Code Understanding, and… Haiku	Day 2, Stage 1
Rushikesh Chandak	Qulays	Confining Cross-Site Prompt Injection in Web Agents	Day 1, Stage 2
Viren Chaudhari	Qulays	Confining Cross-Site Prompt Injection in Web Agents	Day 1, Stage 2
Sahana Chennabasappa	Meta	Permission Fatigue Is a Security Bug: Dynamic Guardrails for Coding Agents	Day 2, Stage 2
David Chismon	UK National Cyber Security Centre	What Designing a Cyber Ontology for Agents Taught Us About Governance	Day 2, Stage 1
Vincenzo Ciancaglini		OH MODEL, WHERE ART THOU: Hacking Chrome's Local SLM	Day 2, Stage 2
Noam Cohen	Torq	When Humans Can't Make It Hard Enough: Self-Hardening Environments for Frontier AI Investigators	Day 3, Stage 2
Daniel Cuthbert		Your Sandbox Degrades Gracefully, What's the Wurst That Could Happen?	Day 1, Stage 1
Bruce Dang	Calif.io	0-Click Remote Exploits in an AI World	Day 1, Stage 1
Ads Dawson	Dreadnode	StealthBench: Can Autonomous Security Agents Do OPSEC Like An Experienced Operator?	Day 1, Stage 1
Tim de Waal	OpenAI	Prompt, Patch, Prove	Day 1, Stage 1
Amol Deshpande	Stripe	There Isn't a Security Problem an Agent Can't Help Solve	Day 2, Stage 1
Brendan Dolan-Gavitt	XBOW	A Tale of Two Chains	Day 1, Stage 1
Rik Dolfing		Pandora's Dir: Hope at the bottom of ../	Day 2, Stage 2
Joao Donato		Promptware EOD: Skillful Agent Detonation	Day 1, Stage 2
Kevin Donovan	CISA	CISA's Experience and Lessons Learned in AI-Enabled Vulnerability Management	Day 1, Stage 1
Dan Dye	Google Cloud Security	Engineering Context for SOC Agents: Lessons, Failures, and Open Questions	Day 3, Stage 2
Alec Eckmann		"WTF Was That?" Dispatches From the Wrong End of an Agent Swarm	Day 1, Stage 1
Guy Elad		Reading the Residual Stream: Productizing Activation-Probe Security at Intuit	Day 3, Stage 2
Sergej Epp		Debate: Where is the vulnpocalypse?	Day 1, Stage 1
Sergej Epp		Say Shibboleth: Fingerprinting the Models Behind Agentic Attacks	Day 1, Stage 2
Reef Ettedgui		Pandora's Dir: Hope at the bottom of ../	Day 2, Stage 2
Gadi Evron	Knostic	Auto-Exploiter by Use of a Ratchet Loop, Code Understanding, and… Haiku	Day 2, Stage 1
Gadi Evron	Knostic	Opening Words and Closing Remarks (hosts all three days)	Days 1-3, Stage 1
Damian Finol	Felix Pago	Enterprise OpenClaw: Tackling Agentic Security at Scale	Day 3, Stage 1
Alexander Frazer	Runlayer	AI Client Builders are Not Security Companies (And Shouldn't Have To Be)	Day 2, Stage 2
Evelina Gabasova	Aisle Inc	Hidden Triggers, Harmful Payloads: Auditing Trojan Open-Weight LLMs	Day 2, Stage 2
Nick Galloway	Google Cloud	Secure Product Development With Mantis	Day 1, Stage 2
Daniel Geyshis	Knostic	BITE – Behavior-Intent Traceable Evaluation	Day 3, Stage 1
Nicole Grinstead	Roblox	Everyone Wants All the AI Tools. Good.	Day 3, Stage 1
Jeremiah Grossman	Root Evidence	Debate: Where is the vulnpocalypse?	Day 1, Stage 1
Anna Groza	Calif.io	0-Click Remote Exploits in an AI World	Day 1, Stage 1
Erez Harush	Wiz/Google	Same Threat, Two Verdicts: Shadow Testing Our SOC Agent	Day 3, Stage 1
Tobias Heldt	XOR	Models vs Cyber Reality: Frontier Agents Against Our Own Privately Disclosed Zero-Days	Day 1, Stage 1
Ari Herbert-Voss	RunSybil	What Building Early Foundation Models Teaches Us About AI Safety Hype vs. Reality	Day 1, Stage 2
Alvaro Inckot		AI Client Builders are Not Security Companies (And Shouldn't Have To Be)	Day 2, Stage 2
Sannan Iqbal	Oscar Health	Twelve Consoles, One Investigation	Day 3, Stage 2
Tamir Isaschar	Knostic	BITE – Behavior-Intent Traceable Evaluation	Day 3, Stage 1
Jasmine Jaksic	NVIDIA	Agentic AI in the Wild: What Real Deployments Teach Us About Governance and Scale	Day 3, Stage 1
Sunghyeon Jo	QED Audit; Georgia Institute of Technology	Cryptography Under AI Pressure	Day 2, Stage 2
Farzan Karimi	Moderna	Threat Model Impossible: 1 Agent. 30 Days. 687 Security Reviews. And a Refrigerator.	Day 3, Stage 1
Jason Keirstead		AgencyScore and AgencyGym: Measuring Excessive Agency Before Deployment	Day 2, Stage 2
Taesoo Kim	Microsoft	From DARPA AIxCC to Microsoft FORGE Lab: Lessons Building Hyperscale AI Code Scanning Tools	Day 1, Stage 1
Maxim Kovalsky	Consortium Networks	Your AI Analyst Is Confidently Wrong: Adversarial QC for Agentic Security Analysis	Day 2, Stage 2
Igor Kozlov	Simibian.ai	Offense != Defense: LLM Cyber Defense – Hunt, Bust, Climb	Day 2, Stage 1
Rock Lambros	Zenity	All Tokens Are Created Equal, Including the Attacker's	Day 1, Stage 2
Kamile Lukosiute	OpenAI Foundation	Building the Defender's Advantage: Technical Solutions for AI Cyber Resilience	Day 2, Stage 1
Patrik Mada	Aisle Inc	Hidden Triggers, Harmful Payloads: Auditing Trojan Open-Weight LLMs	Day 2, Stage 2
Anjali Mangal		The Autonomous Adversarial Loop: Fully Automating an Octo Tempest Purple-Team Simulation	Day 1, Stage 2
Brooks McMillin	Dropbox	Approval Is Not Human Presence: Building and Breaking an MCP Permission Broker	Day 3, Stage 2
Jagannadh Mellacheruvu	Columbia University	Auditing Someone Else's Confidential AI	Day 2, Stage 2
Leo Meyerovich	Graphistry	Three Years of Evals Later: What's Changing in Model and Harness IR/SOC Scores	Day 1, Stage 1
Ariana Mirian	BeeSafe AI	Victim as a Service: Defending Against Trust Based Scams using AI	Day 3, Stage 1
David Molnar	Meta	How Meta Changed Building Secure Software With AI	Day 1, Stage 1
Xenia Mountrouidou	AppGate	We don't need an LLM for That	Day 3, Stage 2
Akash Mukherjee	Realm Labs	Attention Is All You Need (to Catch Hallucinations & Prompt Injections)	Day 1, Stage 2
Shahanas Najeeb	Salesforce	Metrics for Agentic Systems: What "Good" Looks Like for a Security Agent	Day 2, Stage 1
Gabi Nakibly	Radware	Who Is Prompt-Injecting Coding Agents? A Scan of 86 Million GitHub Items	Day 1, Stage 2
Shayaun Nejad	Rubrik	Opened Is Not Fixed: The Last Mile of AI Vulnerability Remediation	Day 1, Stage 2
Ajaya Neupane	Ent AI	Half the Model Never Multiplies: Quantizing a Reasoner for the Endpoint	Day 2, Stage 2
Omer Nevo	Irregular	When Evaluation Runs Start Talking to Each Other	Day 3, Stage 2
Vince Ovando		The Model Is NOT a Security Control: Prompt Injection Dies at the Token Sampler	Day 1, Stage 2
Dario Pasquini	Cracken	Say Shibboleth: Fingerprinting the Models Behind Agentic Attacks	Day 1, Stage 2
Chris Puderbaugh	Meta	Permission Fatigue Is a Security Bug: Dynamic Guardrails for Coding Agents	Day 2, Stage 2
Venkat Raghavan	LangGuard.AI	AgencyScore and AgencyGym: Measuring Excessive Agency Before Deployment	Day 2, Stage 2
Jackson Reed		–Dangerously-Deploy-Sandboxes: a Story of Isolation and Alignment	Day 3, Stage 1
Yolan Romailler	Confidential AI	AI Inference and its Privacy and Confidentiality challenges	Day 3, Stage 1
Olivia Rose	Williams Rose AI Cyber Advisory	Built to Spec, Ignored in Practice: Rebuilding AI Intake People Actually Use	Day 2, Stage 2
Markku-Juhani O. Saarinen		Math Ability has Consequences: AI Cryptanalysis	Day 2, Stage 2
Bruce Schneier	Harvard Kennedy School; University of Toronto	Integrous AI Systems Design	Day 3, Stage 1
Tim Schulz	Starseer	Same Score, Different Brain: Comparing Models by How They Process What They Know	Day 2, Stage 1
Eyal Sela	Gambit Security	The death of TTPs – Fully Autonomous Cyber Attacks in the Wild	Day 3, Stage 1
Giorgio Severi	Microsoft	But the Reasoning Looks Right! Backdoors That Evade CoT Monitoring	Day 1, Stage 2
Giorgio Severi	Microsoft	Memory Is the New Attack Surface: Benchmarking Poisoning Through Agent Memory	Day 2, Stage 1
Ruchi Shah	Google Cloud	Secure Product Development With Mantis	Day 1, Stage 2
Tamir Ishay Sharbat	Zenity	Promptware EOD: Skillful Agent Detonation	Day 1, Stage 2
Roei Sherman		Two Sparks Walk Into a Lab	Day 2, Stage 2
Saurabh Shintre	Realm Labs	Attention Is All You Need (to Catch Hallucinations & Prompt Injections)	Day 1, Stage 2
Guy Shtar	Intuit	Reading the Residual Stream: Productizing Activation-Probe Security at Intuit	Day 3, Stage 2
Caleb Sima		"WTF Was That?" Dispatches From the Wrong End of an Agent Swarm	Day 1, Stage 1
Petr Simecek	AISLE	The Scanner Said Clean. We Ran It Again: Stochastic False Negatives in LLM Vulnerability Detection	Day 2, Stage 1
Matt Suiche	Tolmo	Weightless: Abliteration Without the Weights	Day 2, Stage 1
Mike Takahashi	Zenity	Into the Wild: Hunting Real-World Attacks on AI Systems	Day 1, Stage 2
Kat Traxler	Vectra AI	Your Harness Needs a Security Constitution	Day 1, Stage 1
David Tulis	TrendAI	OH MODEL, WHERE ART THOU: Hacking Chrome's Local SLM	Day 2, Stage 2
Kavia Venkatesh	Cigna	Beyond the SBOM: Proving Process Integrity with the Open PBOM Specification	Day 3, Stage 2
Tal Waitzenberg	Wiz/Google	Same Threat, Two Verdicts: Shadow Testing Our SOC Agent	Day 3, Stage 1
Chenxi Wang	Rain Capital	Agentic AI in the Wild: What Real Deployments Teach Us About Governance and Scale	Day 3, Stage 1
Kayla Williams	Williams Rose AI Cyber Advisory	Built to Spec, Ignored in Practice: Rebuilding AI Intake People Actually Use	Day 2, Stage 2
Fred Wilmot	Detecteam	All Tokens Are Created Equal, Including the Attacker's	Day 1, Stage 2
Casey Wilson	BusinessLoans.com	We don't need an LLM for That	Day 3, Stage 2
Adrian Wood	Dropbox	StealthBench: Can Autonomous Security Agents Do OPSEC Like An Experienced Operator?	Day 1, Stage 1
Adrian Wood	Dropbox	Every Dog Has its 0-day	Day 2, Stage 1
Josh Woodruff	MassiveScale.AI	What 40 Enterprises Who Asked for Agent Governance Had, and the Control Plane That Came Out of It	Day 3, Stage 1
David Yang	RPI; Microsoft	Memory Is the New Attack Surface: Benchmarking Poisoning Through Agent Memory	Day 2, Stage 1
Yernat Yestekov	Anthropic	Claude Can Capture the Flag. Can It Hold the Fort?	Day 2, Stage 1
Sounil Yu		Giving AI Religion	Day 3, Stage 1
Felipe Zimmerle	KonaSense	Agent Authorization Is Not a Vault Problem	Day 3, Stage 1

The table holds 106 distinct names across 110 rows. Three slots have no speaker and no real title: Day 2 Stage 1 at 13:30 ("TBD"), and Day 3 Stage 2 at 11:10 and 11:35 ("TBA"). Two more have a title and no speaker: "Stolen Thoughts: How Adversaries Steal Reasoning for Industrial-Scale Distillation" and "CISOs debrief: What we learned, what we need", both Day 2 Stage 1. Those five do not appear in the table because they have no names to sort.

Who to follow if you care about...

The A-to-Z order hides the themes. These six groups follow the concerns of this blog. We group by the abstract, not by the speaker's reputation, and each clause says what the abstract says it covers.

Prompt injection and context integrity

• Rock Lambros (Zenity) and Fred Wilmot (Detecteam): the abstract uses the EchoLeak exploit to argue models do not separate trusted tokens from untrusted ones, and releases CxBOM.
• Gabi Nakibly and Zvika Babo (Radware): a scan of 86 million GitHub items for hidden-text injection aimed at coding agents.
• Viren Chaudhari and Rushikesh Chandak (Qulays): cross-site prompting against browsing agents, and a least-privilege defense called Tenacity.
• Vince Ovando: a 6.1 million call injection arena, and a title that says the model is not a security control.
• Saurabh Shintre and Akash Mukherjee (Realm Labs): detection from hidden states, with no extra LLM calls.
• Bruce Schneier: integrity as the property AI-driven systems most need.

Background: prompt injection in multi-agent pipelines.

Agent sandboxing and containment

• Elie Bursztein (Google DeepMind): Capsem, an open-source Rust hypervisor for hardened agent environments.
• Daniel Cuthbert: the sandbox built for RAPTOR, and the security issues the team introduced themselves.
• Ankit Agrawal (Webflow): sandboxing framed as containment, provenance and authority together.
• Tamir Ishay Sharbat (Zenity) and Joao Donato: a detonation chamber for agent skills.
• Jackson Reed: isolation weaknesses in a deployed frontier-lab product, with details pending coordinated disclosure.
• Damian Finol (Felix Pago): gVisor sandboxing inside an identity-aware agent runtime.

Background: sandboxing AI agent tool calls.

Identity, authorization and approval

• Oleksii Baranovskyi (Cracken): a harness that enforces policy, with a demo of a decision-only API against an inline proxy.
• Felipe Zimmerle (KonaSense) and Rodrigo Branco (Anthropic): approvals that bind to the exact bytes signed, not to an agent-written summary.
• Brooks McMillin (Dropbox): an MCP permission broker that asks for evidence of human presence.
• Sahana Chennabasappa and Chris Puderbaugh (Meta): permission fatigue, and taint-tracking guardrails.
• Sounil Yu: least agency as a complement to least privilege.

Background: why least privilege is harder with agents.

Autonomous offense and vulnerability discovery

• Brendan Dolan-Gavitt (XBOW): two Chrome full-chain exploits, one mostly human, one built with AI agents.
• Tobias Heldt (XOR): frontier agents against the company's own zero-days, with counts of exploits and accepted patches.
• Taesoo Kim (Microsoft): from the AIxCC win to production vulnerability discovery.
• Eyal Sela (Gambit Security): an autonomous criminal campaign using an open-weight model.
• Fatih Bulut (Microsoft) and Anjali Mangal: a fully automated purple-team loop.
• Bruce Dang and Anna Groza (Calif.io): LLM-driven audit of messaging-app attack surface.

Background: AI-discovered vulnerabilities.

Evaluation and benchmarks

• Adrian Wood (Dropbox) and Ads Dawson (Dreadnode): StealthBench scores OPSEC as well as task success.
• Leo Meyerovich (Graphistry): three years of IR and SOC evals, and an argument to own your evals.
• Omer Nevo (Irregular): evaluation runs that find each other through shared infrastructure.
• Tim Schulz (Starseer): same benchmark score, different internal processing.
• Petr Simecek (AISLE): 25,000 trials on stochastic false negatives in LLM scanners.
• Shahanas Najeeb (Salesforce): metrics for production security agents beyond accuracy.

Governance and policy

• Josh Woodruff (MassiveScale.AI): governance as code, drawn from 40 enterprises.
• Chenxi Wang (Rain Capital) and Jasmine Jaksic (NVIDIA): research across 28 organisations.
• David Chismon (UK National Cyber Security Centre): a cyber ontology and what it shows about governance.
• Kamile Lukosiute (OpenAI Foundation): defender opportunities, including an AI cybersecurity observatory.
• Nicole Grinstead (Roblox): governing AI tool adoption without blanket refusal.
• Kevin Donovan (CISA): AI in vulnerability management at CVE and KEV scale.

Background: human oversight in production.

The organisations on the unprompted stages

This table groups speakers by the employer the agenda lists. The last column is our reading, not a claim from the organisations. Spelling follows the agenda, which writes "AISLE" for one talk and "Aisle Inc" for another.

Organisation	Speakers	What the presence signals
Microsoft	Taesoo Kim, Giorgio Severi, Fatih Bulut, David Yang (also RPI)	Offense automation, model backdoors and memory poisoning from one employer.
Google, Google Cloud, Google DeepMind, Wiz/Google	Elie Bursztein, Nick Galloway, Ruchi Shah, Dan Dye, Tal Waitzenberg, Erez Harush	Sandboxing, secure development and SOC agents. The agenda lists Wiz/Google, so we group them together.
Meta	David Molnar, Sahana Chennabasappa, Chris Puderbaugh	Two measured deployments: AI-fixed vulnerabilities and agent guardrails.
Dropbox	Adrian Wood, Brooks McMillin	Red team and permission control from one company.
Zenity	Rock Lambros, Mike Takahashi, Tamir Ishay Sharbat	Three talks on context attacks, honeypot data and malicious skills.
Knostic	Gadi Evron, Daniel Geyshis, Tamir Isaschar	The host's company also presents agent-artifact scanning.
Anthropic	Yernat Yestekov, Rodrigo Branco	A model lab speaking on defense and on approval design.
OpenAI and OpenAI Foundation	Tim de Waal, Kamile Lukosiute	One firmware-repair talk, one policy and resilience talk.
Wiz	Tal Waitzenberg, Erez Harush	Listed as Wiz/Google. One talk on testing a SOC agent for nondeterminism.
CISA	Kevin Donovan	A government vulnerability programme describing its own AI adoption.
UK National Cyber Security Centre	David Chismon	Governance work tied to the UK's CyberShield plan, per the abstract.
Radware	Gabi Nakibly, Zvika Babo	Large-scale measurement of injection in the wild.
Realm Labs	Saurabh Shintre, Akash Mukherjee	Detection based on model internals.
Qulays	Viren Chaudhari, Rushikesh Chandak	Web-agent confinement.
Cracken	Oleksii Baranovskyi, Dario Pasquini	Policy enforcement and model fingerprinting.
Stripe, Salesforce, NVIDIA, Roblox, Moderna	Amol Deshpande, Shahanas Najeeb, Jasmine Jaksic, Nicole Grinstead, Farzan Karimi	Enterprise operators describing agents in production use.
Visa, Cigna, Twilio, Intuit, Oscar Health, Rubrik	Aishwarya Athreya, Kavia Venkatesh, Gabe Bello, Guy Shtar, Sannan Iqbal, Shayaun Nejad	Regulated and large-scale firms on supply chain, review agents and remediation.
AISLE and Aisle Inc	Petr Simecek, Patrik Mada, Evelina Gabasova	Scanner reliability and Trojan model auditing. We assume one company; the agenda spells it two ways.
XBOW, XOR, RunSybil, Calif.io	Brendan Dolan-Gavitt, Tobias Heldt, Ari Herbert-Voss, Bruce Dang, Anna Groza	Offensive-security companies reporting on AI-driven exploitation.
Vectra AI, Starseer, Tolmo, Torq, Irregular	Kat Traxler, Tim Schulz, Matt Suiche, Noam Cohen, Omer Nevo	Vendors and labs working on model behaviour, internals and evaluation.
Others	Webflow, Graphistry, Dreadnode, Detecteam, Root Evidence, Simibian.ai, Felix Pago, Gambit Security, and more	Small and mid-size firms carry much of the programme.
Universities	Columbia University, University of Georgia, Harvard Kennedy School, University of Toronto, RPI, Georgia Institute of Technology	Cryptanalysis, decompilation, privacy and AI policy.
No affiliation listed	Caleb Sima, Alec Eckmann, Daniel Cuthbert, Sergej Epp, Joao Donato, Vince Ovando, Anjali Mangal, John Cartwright, Roei Sherman, Vincenzo Ciancaglini, Rik Dolfing, Reef Ettedgui, Alvaro Inckot, Jason Keirstead, Markku-Juhani O. Saarinen, Jackson Reed, Sounil Yu, Guy Elad, Ela Avrahami	Independent researchers, or a gap in the agenda. We cannot tell which, so we write the name alone.

The signals column is our interpretation of a published list. It says nothing about what any organisation will present beyond its abstract.

Who is missing

We have no ticketing or attendance data, so we cannot say who is attending, only who is speaking. Three slots are open ("TBD" on Day 2 Stage 1, "TBA" twice on Day 3 Stage 2), and two titled sessions list no speaker. The agenda may add names before October 27, and it may drop some. If you notice a gap that matters to you, check the official agenda again before you plan your days. We will update this page when the list changes.