Where Is the Vulnpocalypse? A Referee's Card for the [un]prompted II Debate

“Resolved, that AI noise hasn't moved the needle on current cyber risk.” That is the formal resolution of the closing debate on day one of [un]prompted II — most people type it unprompted — and it is the only session on the agenda designed to produce disagreement rather than a finding. This page is a referee's card, not a verdict: the strongest honest case for each side, built only from figures published on the same agenda. Our guide to the conference covers the rest of the programme.

The session is Debate: Where is the vulnpocalypse?, with Sergej Epp (infosec and threat research; created the Zero Day Clock) and Jeremiah Grossman (founder, WhiteHat Security; CEO, Root Evidence), Day 1, Stage 1, 17:10, per the official agenda as published on 2026-10-12. The agenda does not say who argues which side, so we do not guess. We wrote this from the published agenda and the published abstracts of the sessions it draws on, before the debate. We are independent coverage — not the organiser, not a sponsor, not a media partner — and we are following the conference remotely. Nothing here is a quote.

The case that the needle has moved, from the unprompted agenda itself

Brendan Dolan-Gavitt (Distinguished Engineer, XBOW) presents two full-chain Chrome exploits submitted to Google's VRP. The first was largely human, took two months, and collided with an internal bug. The second took six days with AI agents in a structured campaign with backup candidates, and earned $250,000. Same team, same target class, an order-of-magnitude change in calendar time.

Eyal Sela (Director of Threat Intelligence, Gambit Security) describes a large criminal campaign in which an open-weight model and an open-source harness autonomously carried out intrusions across many companies. This is the only item in the set that is an outcome in the wild rather than a measured capability, which makes it the heaviest exhibit on the card.

Fatih Bulut (Microsoft) and Anjali Mangal report a fully automated purple-team loop in which the red agent completed 10 phases in about 45 minutes with roughly 77% verified success against a Scattered Spider kill chain. Not a single clever exploit — a whole chain, repeatable, at a cost that changes who can run one.

The case that it has not

Four sessions supply the negative evidence. The pattern across them: capability moved, defender-side outcomes did not.

Tobias Heldt (Co-Founder and CEO, XOR) ran frontier agents against his own privately disclosed zero-days plus 209 known vulnerabilities. Of 54 attempts on the zero-days: 12 working exploits, 0 accepted patches. The second number is the one that belongs in this debate.

David Molnar (Meta) reports about 90% coverage on targets and over 40% of critical vulnerabilities fixed by AI-written diffs — and that faster fixes did not automatically shorten time-to-fix. The constraint was never the writing.

Adrian Wood (Security Engineer, Dropbox) and Ads Dawson (Staff AI Security Researcher, Dreadnode; founder, OWASP GenAI Security Project) report that across 771 trajectories and 8 models, no model exceeded a 53.8% safe-success rate on StealthBench. An attacker who finishes half the time and gets noticed is not the apocalypse.

Ari Herbert-Voss (RunSybil) draws on red-teaming GPT-3 and Codex to separate alarming demos from real harm, and puts the weight on the harness — the structural version of the negative case: capability is cheap, delivery is not.

The card

Exhibit	Figure	Which side it serves
Dolan-Gavitt, Chrome full chain	6 days, $250,000, versus two human months	Moved
Sela, autonomous campaign in the wild	Open-weight model and open-source harness, many companies	Moved
Bulut and Mangal, purple-team loop	10 phases, ~45 minutes, ~77% verified success	Moved
Heldt, privately disclosed zero-days	12 of 54 working exploits, 0 accepted patches	Not moved
Molnar, Meta	>40% of criticals fixed by AI diffs, time-to-fix unchanged	Not moved
Wood and Dawson, StealthBench	53.8% safe-success ceiling, 8 models	Not moved

Why the resolution is hard to settle

Our analysis, not the speakers'. The two sides are not measuring the same object. “Moved” arguments measure attacker capability, which is observable in a lab and improving fast. “Not moved” arguments measure realised risk, which depends on remediation, exploitation in the wild and breach cost — all slower and all human-bounded. Both can be completely right at once, which is why this debate repeats every year with new numbers.

We have been on both sides in our own coverage: when AISLE found 12 zero-days in OpenSSL and FENRIR found 100 more, the finding rate was new; who merges the fix was not. The discovery argument Carlini makes about LLMs finding zero-days humans missed is compatible with a flat risk curve.

What evidence would settle it

• A defender-side time series, not a capability measurement. Median time from public disclosure to exploitation in the wild. Capability figures cannot settle a risk claim.
• Patch acceptance, not patch generation. Heldt's 0 accepted patches and Molnar's unchanged time-to-fix are the same metric from two directions. If that number moves, the negative case loses its strongest leg.
• Autonomous campaigns as a share of incidents. Sela describes one large campaign. The needle argument needs a trend, and incident-response data is where it would show.
• A safe-success rate that clears the StealthBench ceiling. An attacker that succeeds and stays quiet is a different risk profile from one that succeeds loudly.

Two questions we would ask both speakers

1. What specific observation between now and the end of 2026 would move you off your side of this resolution? A side nothing can shift is a position, not an argument.
2. Which single metric would you accept as the scoreboard — time from disclosure to exploitation, patch acceptance rate, autonomous campaigns per quarter, or something else? Agreeing on the measurement before the result is the only way this debate ever ends.

Those are the questions this format leaves open, and we are not picking a winner: both cases above come from the same agenda and both are honestly held. For every speaker and affiliation, see our [un]prompted II speaker list.