Why AI-Assisted Bug Hunting Needs Guidance
A speaker says AI-assisted bug finding works better with iterative steering: tailored agent files, harnesses, guardrails and prompts that specify what to find and what to avoid.
YouTube
Curated cybersecurity video content, discussions, interviews, presentations, and educational material from YouTube.
323 articles
Google Pays $90,000 for Cookie-Signing Vulnerability Demonstrated as Server-Side Delay
Simon Kowik found that a secret in a Google developer-site cookie could forge valid cookies and trigger Python pickle code execution. He demonstrated the issue with server delays, reported it, and Google fixed it.
NVIDIA’s Agent Safety Platform Combines Sandboxing with an Optional Hardware Watchdog
NVIDIA says Open Shell restricts AI agents through sandbox permissions, while optional Sentry on BlueField 4 can monitor and quarantine agents. The presenter has not independently tested NVIDIA’s claims and cautions that authorized actions can still cause harm.
Project Swarm Lets Users Deploy Honeypots to Investigate Internet Exploitation
John Hammond and Grey Noise founder Andrew Morris demonstrate Project Swarm, showing how users can deploy honeypot sensors, inspect exploit traffic, download packet captures and investigate suspicious scanning.
Douglas Day Explains How Custom AI Agents Are Changing Bug Bounty Research
Bug bounty researcher Douglas Day describes his custom AI discovery pipeline, reporting a four- to fivefold increase in findings. He stresses tailored prompts, application context and months of validation before automated submissions.
BHIS Discusses Russian Data Center Strikes, Ransomware Services and AI Defense
BHIS panelists discuss reported strikes on Russian data centers, allegations against a ransomware recovery provider, French supermarket refrigeration attacks, and practical safeguards for AI-assisted security operations.
A Bug Bounty Hunter’s AI-Assisted Bot Automates Reconnaissance and Triage
A bug bounty hunter demonstrates a low-cost AI-assisted bot for asset discovery, API mapping and lead triage. The prototype still produces false positives, and promising findings remain subject to human review.
EFF Explains Online Privacy Risks and Practical Steps to Protect Your Data
An EFF guest walks David Bombal through Surveillance Self-Defense guides, explaining secure messaging, VPN limitations, AI data privacy risks and practical device protections tailored to individual needs.
Just Hacking Training Marks Two Years and Details AI-Driven Huntress CTF
Just Hacking Training celebrates its second anniversary as John Hammond explains Huntress CTF's AI-assisted time trials, dynamic challenge variants and automation-focused scoring, alongside updates on hands-on security labs.
LAN Turtle Hub Demonstrates Covert Remote Access and USB Interception
The video describes the LAN Turtle Hub as a USB Ethernet adapter and hub that can provide remote access, sniff network traffic, poison DNS, intercept USB storage, plant a malicious shortcut, and copy files over Wi-Fi.
Apple Plans Tighter macOS Disk Access Controls as AI-Agent Risks Grow
Threat Wire reports Apple plans deeper macOS full disk access controls amid AI-agent privacy concerns, alongside reports of AI-related security incidents, bug bounty overload, a GitLab command-execution flaw and a Linux KVM vulnerability.
Security Researcher Discusses AI Guardrails, EDR Killers and VPN Limitations
In an interview with David Bombal, researcher Marcus discusses AI restrictions on malware analysis, ransomware actors’ use of vulnerable drivers, and the limits of VPN protection against malicious captive portals.
Vercel Reportedly Pays $50,000 for KVM Sandbox Escape
A researcher reportedly received a $50,000 Vercel bounty for a KVM guest-to-host sandbox escape. Vercel’s CEO confirmed the zero-day was found through its bug bounty program; Vercel uses Firecracker microVMs to isolate sandboxed code.
SSRF Flaws Could Expose Internal Networks Through AI Tools
The video describes SSRF weaknesses found in AI tools associated with Google, JPMorgan Chase, and two unnamed governments. Redirect handling or inadequate address checks could let tools access internal addresses and, depending on configuration, cloud credential-related.
BHIS Panel Debates AI Agent Security, Patch Management and Shiny Hunters
A BHIS panel discusses reported AI agent intrusions, DNS tunneling, Shiny Hunters and patch-management failures. Speakers emphasize compensating controls and organizational accountability; BHIS also announces a CEO transition.
IBM Panel Examines Fake GPTs, Email-Gateway Malware and NetScaler Exploitation
IBM’s Security Intelligence panel examines ClickFix attacks using fake custom GPTs, malware impersonating SpamSniper on email gateways, and NetScaler exploitation, with advice on threat hunting, logging, segmentation and incident response.
Using Sysinternals and Wireshark to Check a Potentially Infected PC
The speakers recommend Sysinternals as a starting point for checking a Windows PC and show how Wireshark’s DNS filter can reveal network queries. They also discuss how Windows telemetry and third-party data collection complicate understanding where data goes.
Security Now Examines GLM 5.3 Exploit Capabilities, Firefox Fixes and RSA Blind-Signature Research
Security Now discusses Anthropic’s tests of GLM 5.3 exploit generation and safeguard bypasses, Firefox 157 security fixes, and research weakening RSA blind signatures without breaking ordinary certificate signatures.
Inside Conti: Ransomware Attacks, Royal Data Leaks and the Gang’s Fracture
Darknet Diaries examines Conti’s ransomware operations, attacks on Ireland and Costa Rica, and its apology after leaking royal client data. Researchers describe how internal chat leaks exposed the gang and helped fracture its operations.
How to Isolate IoT Devices with VLANs on a Home Network
The video demonstrates isolating IoT devices on a home network with OPNsense VLANs, a managed switch, DHCP and firewall rules. It also features a sponsored Flare monitoring demo; Wi-Fi integration is deferred.
Shiny Hunters Targets Clop as Police Arrest Alleged Leader
The panel discusses Shiny Hunters' reported takeover of Clop's leak site, the arrest of an alleged group leader, and the group's claims about FBI data, alongside guidance for assessing extortion activity.
NahamSec Connects Claude to Caido for AI-Assisted Web App Testing
NahamSec demonstrates routing web-testing traffic through Caido on a VPS and connecting it to Claude via MCP and skills. In a training lab, Claude maps API routes from JavaScript, creates replay requests, and checks for possible exposed data and unauthenticated access.
Security Researcher Says AI Harnesses Matter More Than the Model
A speaker advises researchers to validate AI output, minimize false positives, study complex vulnerability chains leading to remote code execution, and build harnesses that make their work more productive.
Jason Haddix Demonstrates AI Prompt-Injection Risks in Chatbots
At DEF CON, Jason Haddix demonstrates prompt-injection attacks against chatbots, including simulated account-recovery and meeting-summary scenarios. He says the examples reflect reported real-world flaws and highlights repeat testing and free practice labs.