Humans still beat AI alone.

DEF CON 34 just wrapped. In under two minutes, Dom runs through three key AI takeaways from this year’s talks: AI literacy rising on both the red and blue team side, a growing wave of attacks on AI software itself, and open source models still flying under the radar next to the frontier labs.

Missed DEF CON this year? Recordings tend to land on YouTube in autumn.

As promised in the video, here are the talks worth watching.

AI for offensive security:

– Can AI do novel security research? Meet the HTTP Terminator by James “albinowax” Kettle
– Killing AI slop: a multi-model orchestration framework that only reports findings it can prove by Armaan Pathan
– Field notes on offensive agents: reusability, reliability and what breaks by Dominika Pietrzak and Ibai Castells (full disclosure, we’re a little biased on this one)

Exploiting AI solutions:

– A billion-user blast radius: owning ChatGPT’s secure sandbox by Simcha Kosman
– Your WAF blocked us, that was the exploit – remote agent takeover via Cloudflare, Sentry and Claude Zero-Day for data exfiltration by Barak Sternberg, Nevo Poran and Ron Bobrov
– SEND: teaching machines to lie to defenders by Yi Ting Shen and Ariz Soriano

Education on open source options:
– Pickled and exposed: RCE in AI serving frameworks by Iggy (Igor Stepansky)

Subscribe for more from the RAID Files.