4 ms·

You should come to my upcoming BlackHat talk on how we did this while avoiding false positives :D https://www.blackhat.com/us-25/briefings/schedule/#ai-agents-

by moyix 1y ago

You should come to my upcoming BlackHat talk on how we did this while avoiding false positives :D https://www.blackhat.com/us-25/briefings/schedule/#ai-agents-for-offsec-with-zero-false-positives-46559 https://www.blackhat.com/us-25/briefings/schedule/#ai-agents...

tptacek 1y ago
You should publish the paper quietly here (I'm a Black Hat reviewer, FWIW) so people can see where you're coming from. I know you've been on HN for awhile, and that you're doing interesting stuff; HN just has a really intense immune system against vendor-y stuff.
- moyix 1y ago
  Yeah, it's been very strange being on the other side of that after 10 years in academia! But it's totally reasonable for people to be skeptical when there's a bunch of money sloshing around. I'll see if I can get time to do a paper to accompany the BH talk. And hopefully the agent traces of individual vulns will also help.
  - tptacek 1y ago
    J'accuse! You were required to do a paper for BH anyways! :)
    - moyix 1y ago
      Wait a sec, I thought they were optional? > White Paper/Slide Deck/Supporting Materials (optional) > • If you have a completed white paper or draft, slide deck, or other supporting materials, you can optionally provide a link for review by the board. > • Please note: Submission must be self-contained for evaluation, supporting materials are optional. > • PDF or online viewable links are preferred, where no authentication/log-in is required. (From the link on the BHUSA CFP page, which confusingly goes to the BH Asia doc: https://i.blackhat.com/Asia-25/BlackHat-Asia-2025-CFP-Preparation.pdf https://i.blackhat.com/Asia-25/BlackHat-Asia-2025-CFP-Prepar... )
      - tptacek 1y ago
        I think you're fine, most people don't take the paper bit seriously. It's not due until the end of July regardless (you don't need a paper to submit for the CFP).
        daeken 1y ago
        The scramble to get your paper done in time is traditional! (And why my final paper for the onity lock hack ended up with an entire section I decided was better off left unsaid; woops)
    - leenify 1y ago
      Hmm, is that really true? I spoke at BH last year and was not required to submit a paper. And based on the briefings link, there surely isn't a paper link, only slides and tool.
nickpsecurity 1y ago
"we" I remember your work on seeding vulnerabilities into C programs. I didnt know you got into AI-assisted pentesting. I already have more confidence in the product. :)

by moyix 1y ago

tptacek 1y ago

You should publish the paper quietly here (I'm a Black Hat reviewer, FWIW) so people can see where you're coming from. I know you've been on HN for awhile, and that you're doing interesting stuff; HN just has a really intense immune system against vendor-y stuff.

moyix 1y ago
Yeah, it's been very strange being on the other side of that after 10 years in academia! But it's totally reasonable for people to be skeptical when there's a bunch of money sloshing around. I'll see if I can get time to do a paper to accompany the BH talk. And hopefully the agent traces of individual vulns will also help.
- tptacek 1y ago
  J'accuse! You were required to do a paper for BH anyways! :)
  - moyix 1y ago
    Wait a sec, I thought they were optional? > White Paper/Slide Deck/Supporting Materials (optional) > • If you have a completed white paper or draft, slide deck, or other supporting materials, you can optionally provide a link for review by the board. > • Please note: Submission must be self-contained for evaluation, supporting materials are optional. > • PDF or online viewable links are preferred, where no authentication/log-in is required. (From the link on the BHUSA CFP page, which confusingly goes to the BH Asia doc: https://i.blackhat.com/Asia-25/BlackHat-Asia-2025-CFP-Preparation.pdf https://i.blackhat.com/Asia-25/BlackHat-Asia-2025-CFP-Prepar... )
    - tptacek 1y ago
      I think you're fine, most people don't take the paper bit seriously. It's not due until the end of July regardless (you don't need a paper to submit for the CFP).
      - daeken 1y ago
        The scramble to get your paper done in time is traditional! (And why my final paper for the onity lock hack ended up with an entire section I decided was better off left unsaid; woops)
  - leenify 1y ago
    Hmm, is that really true? I spoke at BH last year and was not required to submit a paper. And based on the briefings link, there surely isn't a paper link, only slides and tool.

nickpsecurity 1y ago

"we" I remember your work on seeding vulnerabilities into C programs. I didnt know you got into AI-assisted pentesting. I already have more confidence in the product. :)