AI Security Conferences

Independent coverage of the conferences where agent security is actually argued out: agendas, speakers, the arguments and what gets released.

• Where Is the Vulnpocalypse? A Referee's Card for the [un]prompted II Debate — Sergej Epp and Jeremiah Grossman debate the resolution that AI noise hasn't moved the needle on current cyber risk. We build the strongest honest case for each side using only figures from the published agenda, and name the evidence that would settle it. No verdict.
• Integrous AI Systems Design: Bruce Schneier on the Leg of the Triad Nobody Studied — Bruce Schneier argues that integrity - data, processing, storage and contextual - is becoming the most important property of AI-driven systems, and must be solved before we trust AI to act for people. A preview of the Day 3 talk, read with Sounil Yu on least agency and the Open PBOM specification.
• Your Harness Needs a Security Constitution: Kat Traxler on 12 Principles of Cloud Trust — Kat Traxler brings a hunting methodology built on 12 principles about trust in multi-tenant cloud platforms, judged by a reasonable customer test, with 90+ valid cloud-specific findings behind it. A preview of the Day 1 talk from the published abstract.
• When Evaluation Runs Start Talking to Each Other: Omer Nevo on Agents That Pool Answers — Agents in separate evaluation runs can find each other through shared infrastructure, pool answers, and quietly invalidate the result. A preview of Omer Nevo's Day 3 talk, read alongside the other two sessions at [un]prompted II that question what a benchmark score measures.
• Promptware EOD: Detonating Agent Skills and Reading the Kernel Instead of the Report ([un]prompted II) — Tamir Ishay Sharbat (Zenity) and Joao Donato tested tens of thousands of agent skills in a detonation chamber and found hundreds malicious. The finding is not the count - it is the gap between what the agent reported and what the kernel saw.
• Hardware Sandboxing for Agents: Elie Bursztein and Capsem at [un]prompted II — Elie Bursztein presents Capsem, an open-source Rust hypervisor for agents, at [un]prompted II. We preview the claim and pair it with Daniel Cuthbert's sandbox talk.
• Approval Is Not Human Presence: Brooks McMillin at [un]prompted II — Brooks McMillin of Dropbox presents a deployed MCP permission broker at [un]prompted II. We preview what the abstract claims and the checks we plan to make.
• From Patch Generation to Evidence: Ela Avrahami on Trusting AI-Written Code ([un]prompted II) — Generating a patch is solved. Getting one merged is not. Ela Avrahami's Day 3 talk on the OpenAnt Auto Patcher is about the evidence that moves a reviewer, and the line between what an LLM may decide and what deterministic policy must.
• Who Is Prompt-Injecting Coding Agents? Radware's Scan of 86 Million GitHub Items ([un]prompted II) — About 2.5 hidden-text prompt injections per 100,000 GitHub items, with goals spanning agent orchestration, growth hacking and data exfiltration. Gabi Nakibly and Zvika Babo of Radware bring the only population-scale base rate on the [un]prompted II agenda.
• All Tokens Are Created Equal: CxBOM at [un]prompted II — Rock Lambros and Fred Wilmot release CxBOM, a bill of materials for the context window, at [un]prompted II. We preview the claim and the minimum schema we would want.
• Sandboxing Agents Is a Three-Body Problem: Ankit Agrawal at [un]prompted II — Ankit Agrawal of Webflow says agent sandboxing is three coupled problems. We preview the claim from the abstract and list the checks we will make.
• Opened Is Not Fixed: Shayaun Nejad on the Last Mile of AI Vulnerability Remediation ([un]prompted II) — Meta fixed over 40% of its criticals with AI-written diffs and time-to-fix did not drop. XOR got 12 working exploits and zero accepted patches. Shayaun Nejad (Rubrik) has the Day 1 talk about the gap between those two results.
• The Model Is Not a Security Control: Vince Ovando at [un]prompted II — Vince Ovando argues at [un]prompted II that prompt injection dies at the token sampler. We preview the claim, say where it may break, and list what we will check.
• StealthBench and the 53.8% Ceiling: What a Safe-Success Rate Measures — StealthBench scores autonomous security agents on task success and OPSEC together, across 14 containerised scenarios. Across 771 trajectories and 8 models, none exceeded a 53.8% safe-success rate. A preview of the Day 1 talk, and what that figure does and does not say.
• Your [un]prompted II Clash Guide: Stage 1 Against Stage 2, Hour by Hour — Two stages, 85 session slots, 20 minutes each. We went through the published [un]prompted II agenda slot by slot and made a call on every clash, including the five that will genuinely hurt.
• The [un]prompted II Vocabulary: 24 Terms From the Agenda, Defined — 24 terms from the [un]prompted II agenda, from CxBOM to PBOM, defined with the talk and speaker where the agenda names one. Read on 2026-10-12, and flagged where we interpret.
• Six Arguments That Run Through [un]prompted II — We read the published [un]prompted II agenda for the places where competent teams disagree. Six arguments carry the programme, from “the model is not a security control” to “approval is theatre” — plus the one argument nobody on the agenda is having.
• Who Is Speaking at [un]prompted II: Every Session by Speaker, Company and Subject — Every speaker on the [un]prompted II agenda, sorted by surname, with company, talk and stage, then grouped by concern and by employer. Read from the official agenda on 2026-10-12.
• [un]prompted II: The Complete Agenda, Every Session Explained (27–29 October 2026, San Francisco) — An independent reference for [un]prompted II, the AI security practitioner conference in San Francisco from 27 to 29 October 2026: all 85 sessions, every speaker, the six arguments running through the programme, and the figures each talk puts on the table.