---
title: "Where Is the Vulnpocalypse? A Referee's Card for the [un]prompted II Debate"
description: "Sergej Epp and Jeremiah Grossman debate the resolution that AI noise hasn't moved the needle on current cyber risk. We build the strongest honest case for each side using only figures from the published agenda, and name the evidence that would settle it. No verdict."
author: "Mara Voss"
category: "AI Security Conferences"
date: 2026-10-23T14:50:06.145Z
canonical: "https://agenticcyber.co/blog/unprompted-ii-vulnpocalypse-debate"
---

# Where Is the Vulnpocalypse? A Referee's Card for the [un]prompted II Debate

![Photograph illustrating empty debate podium.](https://hsppuvezyxmkpzkgfkho.supabase.co/storage/v1/object/public/media/conference/5bc07ae2-9ee0-46b9-9820-b0704936f742/unprompted-ii-vulnpocalypse-debate.jpg)

> Sergej Epp and Jeremiah Grossman debate the resolution that AI noise hasn't moved the needle on current cyber risk. We build the strongest honest case for each side using only figures from the published agenda, and name the evidence that would settle it. No verdict.

“Resolved, that AI noise hasn't moved the needle on current cyber risk.” That is the formal resolution of the closing debate on day one of **[un]prompted II** — most people type it *unprompted* — and it is the only session on the agenda designed to produce disagreement rather than a finding. This page is a referee's card, not a verdict: the strongest honest case for each side, built only from figures published on the same agenda. Our [guide to the conference](/blog/unprompted-ii-conference-guide) covers the rest of the programme.

The session is *Debate: Where is the vulnpocalypse?*, with **Sergej Epp** (infosec and threat research; created the Zero Day Clock) and **Jeremiah Grossman** (founder, WhiteHat Security; CEO, Root Evidence), Day 1, Stage 1, 17:10, per the [official agenda as published on 2026-10-12](https://unpromptedcon.org/agenda-10-2026/). The agenda does not say who argues which side, so we do not guess. We wrote this from the published agenda and the published abstracts of the sessions it draws on, before the debate. We are independent coverage — not the organiser, not a sponsor, not a media partner — and we are following the conference remotely. Nothing here is a quote.

## The case that the needle has moved, from the unprompted agenda itself

**Brendan Dolan-Gavitt** (Distinguished Engineer, XBOW) presents two full-chain Chrome exploits submitted to Google's VRP. The first was largely human, took two months, and collided with an internal bug. The second took **six days** with AI agents in a structured campaign with backup candidates, and earned **$250,000**. Same team, same target class, an order-of-magnitude change in calendar time.

**Eyal Sela** (Director of Threat Intelligence, Gambit Security) describes a large criminal campaign in which an open-weight model and an open-source harness autonomously carried out intrusions across many companies. This is the only item in the set that is an outcome in the wild rather than a measured capability, which makes it the heaviest exhibit on the card.

**Fatih Bulut** (Microsoft) and **Anjali Mangal** report a fully automated purple-team loop in which the red agent completed **10 phases in about 45 minutes with roughly 77% verified success** against a Scattered Spider kill chain. Not a single clever exploit — a whole chain, repeatable, at a cost that changes who can run one.

## The case that it has not

Four sessions supply the negative evidence. The pattern across them: capability moved, defender-side outcomes did not.

**Tobias Heldt** (Co-Founder and CEO, XOR) ran frontier agents against his own privately disclosed zero-days plus 209 known vulnerabilities. Of 54 attempts on the zero-days: **12 working exploits, 0 accepted patches**. The second number is the one that belongs in this debate.

**David Molnar** (Meta) reports about 90% coverage on targets and over 40% of critical vulnerabilities fixed by AI-written diffs — and that faster fixes **did not automatically shorten time-to-fix**. The constraint was never the writing.

**Adrian Wood** (Security Engineer, Dropbox) and **Ads Dawson** (Staff AI Security Researcher, Dreadnode; founder, OWASP GenAI Security Project) report that across 771 trajectories and 8 models, no model exceeded a **53.8% safe-success rate** on StealthBench. An attacker who finishes half the time and gets noticed is not the apocalypse.

**Ari Herbert-Voss** (RunSybil) draws on red-teaming GPT-3 and Codex to separate alarming demos from real harm, and puts the weight on the harness — the structural version of the negative case: capability is cheap, delivery is not.

## The card

ExhibitFigureWhich side it serves

Dolan-Gavitt, Chrome full chain6 days, $250,000, versus two human monthsMoved
Sela, autonomous campaign in the wildOpen-weight model and open-source harness, many companiesMoved
Bulut and Mangal, purple-team loop10 phases, ~45 minutes, ~77% verified successMoved
Heldt, privately disclosed zero-days12 of 54 working exploits, 0 accepted patchesNot moved
Molnar, Meta>40% of criticals fixed by AI diffs, time-to-fix unchangedNot moved
Wood and Dawson, StealthBench53.8% safe-success ceiling, 8 modelsNot moved

## Why the resolution is hard to settle

Our analysis, not the speakers'. The two sides are not measuring the same object. “Moved” arguments measure attacker capability, which is observable in a lab and improving fast. “Not moved” arguments measure realised risk, which depends on remediation, exploitation in the wild and breach cost — all slower and all human-bounded. Both can be completely right at once, which is why this debate repeats every year with new numbers.

We have been on both sides in our own coverage: when [AISLE found 12 zero-days in OpenSSL and FENRIR found 100 more](/blog/aisle-found-12-zero-days-in-openssl-fenrir-found-100-more-what-ai-discovered-vul-6v12), the finding rate was new; who merges the fix was not. The discovery argument [Carlini makes about LLMs finding zero-days humans missed](/blog/anthropics-nicholas-carlini-on-how-llms-are-already-finding-zero-days-humans-mis-6myz) is compatible with a flat risk curve.

## What evidence would settle it

- **A defender-side time series, not a capability measurement.** Median time from public disclosure to exploitation in the wild. Capability figures cannot settle a risk claim.

- **Patch acceptance, not patch generation.** Heldt's 0 accepted patches and Molnar's unchanged time-to-fix are the same metric from two directions. If that number moves, the negative case loses its strongest leg.

- **Autonomous campaigns as a share of incidents.** Sela describes one large campaign. The needle argument needs a trend, and incident-response data is where it would show.

- **A safe-success rate that clears the StealthBench ceiling.** An attacker that succeeds and stays quiet is a different risk profile from one that succeeds loudly.

## Two questions we would ask both speakers

- What specific observation between now and the end of 2026 would move you off your side of this resolution? A side nothing can shift is a position, not an argument.

- Which single metric would you accept as the scoreboard — time from disclosure to exploitation, patch acceptance rate, autonomous campaigns per quarter, or something else? Agreeing on the measurement before the result is the only way this debate ever ends.

Those are the questions this format leaves open, and we are not picking a winner: both cases above come from the same agenda and both are honestly held. For every speaker and affiliation, see our [[un]prompted II speaker list](/blog/unprompted-ii-speakers-list).

## FAQ

### What is the formal resolution of the debate?

"Resolved, that AI noise hasn't moved the needle on current cyber risk." It is listed as a debate between Sergej Epp and Jeremiah Grossman on Day 1, Stage 1 at 17:10. The agenda does not state who takes which side.

### Which side does the evidence favour?

We do not score it. The strongest figures on each side measure different things - attacker capability versus realised defender-side risk - so both cases can be sound at the same time. The useful output of the session is an agreed scoreboard, not a winner.

### Is this coverage from inside the conference?

No. We are independent coverage, following remotely. Every figure here comes from the official agenda as published on 2026-10-12, and no session has happened yet. Affiliations are exactly as the agenda lists them, including the speakers it lists without a company.

### What is the formal resolution?

“Resolved, that AI noise hasn't moved the needle on current cyber risk.” It is listed as a debate between Sergej Epp and Jeremiah Grossman on Day 1, Stage 1 at 17:10. The agenda does not state who takes which side.


---
Source: https://agenticcyber.co/blog/unprompted-ii-vulnpocalypse-debate