I used REA on a modern anticheat to learn about what exactly was being sent to the provider about my machine. I was interested, mostly, in the privacy implications of kernel level anticheat. REA did a fantastic job. I’m a tough crowd when it comes to AI platforms, frameworks, skill packs, etc, etc, in offsec. I think most are bad. Over engineered in the harness, under engineered in the skills and agents. They don’t solve completion bias. REA was dope on this 1st run.

Hacking Vroom and Instaglam today in our course "Attacking AI"!

People saying ai replaces and automates… It literally doesn’t, it scales. 1% of people are completely automating or replacing . People just have this weird fucking selective memory about how things happen because they love the feeling of the scale. Brothers and sisters you literally re prompted those systems or had to re-architect them to change course several times. You had to review for hallucination. There was 100 small things you did to create that AI output at its final stage.

Corporate Defender AI Tip: A lot of organizations we work with are still having trouble getting AI approved as standalone access (OpenAI, Anthropic, Foundry Direct, Bedrock) For defenders working on large queues of alerts, email has been a dreaded (but accepted) form of collection for these types of alerts outside of the security product's dashboards themselves. Many companies' first foray into AI is enabling (and approving) something like Copilot across the M365 stack. A quick hack can just be to use the integrated copilot in Outlook with a starter prompt or a system prompt (if you have access to set it) and ask it to create summaries for you out of those email inboxes, sort them, apply limited logic tirage, etc (but this is ONLY if you lack the corporate approval for API access, lack access to a AI agent framework, or harness)

Agent comms is a big lift for cyber work. Agents able to talk to each other and collab, in our experience at @arcanuminfosec , do better work. @BadAt_Computers and I are working on a super performant agent chat platform. Very little setup needed but gives you (the human) a way to direct a fleet, and a way for the fleet to talk and share with each other. It's specialized for cybersec. We'll be releasing it at a con soon, it's called "Grimoire"

If y’all companies keep closing programs, reducing bounty tables, and have nowhere to report… you’re gonna have hard time. Bounty programs, or at least VDPs or reporting mechanisms are more important than EVER in the scaled AI hacking age. Triage got you down? Put pressure on the platform to do better and innovate. Or, contract with 2nd level triage, I know several consulting shops that do it. Some even integrate with vulnerability management to take vulns all the way to remediation. At the end of the standard automation era a lot of these positions got downsized snd reduced, but it’s time to start investing in them again.