[ Schedule ]

Abstract pending.

Abstract pending.

Letting an LLM agent loose on a live CAN bus, using a consumer portable power station as the target. The harness, permission gates, instrumentation and physical isolation it took before an agent could safely touch real hardware.

AI agents live a solitary life, spending most of their time stuck in (at best) a virtual reality. This talk follows the journey of letting them out into the real world to perform CAN bus reverse engineering. Recent LLMs have crossed the line from CAN an LLM perform this, into HOW can an LLM carry this out - and this talk explores what that shift looks like using hardware, not software. Using a consumer portable power station as a target, I'll walk through the harness, permission gates, instrumentation, feedback loops, and safety controls needed before an agent can interact with a live embedded system.

Two Windows bugs found with a frontier model, the first in just over an hour, and the human direction it took to get there. Then the same hunt replayed on open-weight local models to measure how much frontier capability survives.

At the frontier, the first legitimate 0-day finding appeared 1 hour, 16 minutes, 5 seconds after the initial request. Two Windows system-service 0-days anchor this talk: an information disclosure developed into an attacker-steerable privileged read, and a use-after-free developed through lifetime analysis, controlled reclaim, and heap grooming into write-what-where. I walk through the pattern behind both discoveries, from reconnaissance to validation, PoC, and closure. The speed is real, but it was not autonomous. The frontier model needed direction, correction, encouragement, and help with tools. It initially refused the PoC. That human work is part of the result. The talk exposes the process behind a successful bug hunt at the frontier, then comes back to test how large the gap to local models really is and what it takes to close it. I replay the hunt with the latest open-weight models, including Qwen, Gemma, GLM, and more. Same target. Same context. Same tools. Short tests isolate individual capabilities. Full runs ask whether a model can discover, validate, use the tools, reject false leads, and finish. If a local model fails, I add one measured piece of scaffolding and try again. How much frontier capability survives locally, and how much help does it need?

Voltage-glitching a commercial NPU to make an edge-AI camera see phantoms, or nothing at all, with LLM agents left to search the fault space overnight. Why neural accelerators are an emerging hardware attack surface.

Edge AI systems power everything from smart cameras and drones to robots and autonomous machines. These devices rely on neural processing units (NPUs) to run computer vision models (CNNs) that decide what the system "sees." But what if you could convince the hardware to see something else… or nothing at all? And what if you can have an LLM do the heavy lifting? Is there no limit to AI relevant abbreviations in a talk title?

In this talk, we show how classic hardware fault injection techniques can manipulate AI inference on real edge devices. By injecting precisely timed voltage glitches on a commercial NPU SoC, we can perturb neural network execution without modifying the model, firmware, or software stack.

Using a Rockchip RK3568 platform running YOLOv5, we demonstrate a range of effects: objects that suddenly disappear, phantom detections appearing out of nowhere, drifting bounding boxes, and the occasional confidently wrong answer. The system keeps running happily, completely unaware that its perception has been tampered with.

Exploring the enormous fault parameter space, however, is tedious for humans. So instead of turning knobs manually, we let LLM-driven agents take over. These agents analyze detection outputs, adapt glitch parameters, and autonomously search for effective fault conditions, running overnight while we sit back (or sleep).

The talk walks through the full attack workflow: observing inference execution through electromagnetic emanations, aligning glitches with neural network stages, and using autonomous agents to optimize the attack. We conclude with implications for the security of edge AI systems and why neural accelerators may represent an emerging hardware attack surface.

Abstract pending.

Inside the event-driven agentic detection and response system Slack's SecOps team has run in production since April 2026, told through a no-notice red team exercise it caught, correlated and mapped end to end before an analyst was notified.

Slack's Security Operations team has built an event-driven, agentic detection and response system, in production since April 2026. An event router creates observer agents that each watch one slice of the environment (an alert rule, a repository, a service), learn what normal looks like there, and emit structured signals. Watchdog agents read across those signals, correlate what no single observer can see, and autonomously launch agentic security investigations, which are surfaced to human analysts in Slack for real-time collaboration. Every agent action is recorded in a searchable event stream, so the team can audit and analyse agent behaviour. This talk tells the story through a real, no-notice red team exercise: an adversary simulation caught, correlated, and mapped end to end before an analyst was notified. It draws out the design principle behind it: don't model the attack, model the environment, and give it a memory.

Abstract pending.

A three-month study adjudicating 630 agent-generated vulnerability findings against the code at the reported line. In their data, precision depended more on method than model, the more expensive frontier model did worse on static analysis, and verification is still the bottleneck.

LLM agents can already carry some vulnerability investigations from discovery to exploitation. In one of our tests, an agent decompiled a stripped binary, identified an overflow, and produced a working exploit against a live service. That result led us to a broader question: how often do agent-generated findings survive code-level verification?

Verification requires tracing attacker-controlled data to a sink, checking whether a real request can reach it, and deciding whether the weakness is exploitable. This process determines whether a client can act on the report or will lose trust in it. Today, a human still has to read the relevant code line by line. That manual review becomes the bottleneck in an automated pipeline, yet published results rarely measure it.

This session reports a three-month study of two models across multiple targets, including source code, real Java repositories, stripped ELFs, live web applications, Android APKs, and Solidity contracts. Across these targets, we collected 630 findings and adjudicated each one against the code at the reported line rather than the model's summary.

Precision depended more on method than model. Confirmation-based approaches reached 79-100%, while static analysis of real codebases reached 65-77%. On the static-analysis target, the more expensive frontier model performed worse: 285 findings with 99 false positives, compared with 169 findings and 39 false positives from the cheaper model. These results led us back to verification. A binary true-positive/false-positive verdict proved too crude, and an LLM judge drifted toward "uncertain" as the workload grew. We also document reproducible pipeline failures that looked like clean results.

Abstract pending.

Abstract pending.

Capture the Narrative is a CTF-style massively multiplayer wargame in which 288 Australian university students ran LLM-powered bot campaigns to swing a simulated election. The competition, what it taught, and the dataset it produced for future research.

LLM-powered bots are influencing social media around the world, amplifying the effects of misinformation and disinformation. Detecting if content is being promoted or manipulated by such bots is difficult, both for casual observers of social media platforms as well as for platform operators faced with continuous "cat and mouse" development by malicious adversaries. To address both challenges, we produced "Capture the Narrative", the world's first CTF-style massively-multiplayer wargame for social media manipulation. Over four weeks in 2025, 288 students formed 70+ teams from Australian universities and competed in a multiplayer competition to manipulate an in-house social media platform we called "Legit Social". They were aiming to swing a simulated election in a fictional country, a task which they ultimately completed by moving the electorate by 1.8 percentage points. In this talk I will introduce the competition, as well as discuss its outputs, which include the associated awareness campaign as well as a collaboratively developed dataset made up of survey data, developed bot software, and recorded bot activity for the thousands of bots producing millions of artificial posts to amplify in-game misinformation.

Abstract pending.

Exploitation is a ladder, not a coin flip. ExploitBench grades LLM agents across 16 capability flags against real V8, from first crash to arbitrary code execution, and shows where today's models actually stop.

Benchmarking LLMs on vulnerability discovery and exploitation capabilities — results and lessons learned.

Fuzzers reach the vulnerable code and still miss the bug because coverage tracks lines, not state. StateLens has an LLM identify security-relevant internal states offline and lets a conventional fuzzer do the search: 68 previously unknown bugs across six production JavaScript engines.

Structural coverage is the dominant metric for evaluating fuzzers, yet many bugs in JavaScript (JS) engines are triggered by specific internal states that are not captured by line or branch coverage. As LLMs have demonstrated strong reasoning capabilities, an increasing trend is to use them for auditing code or generating fuzzing inputs. However, directly using LLMs for JS engines is not practical due to huge code bases, high False Positive (FP) rates, and high cost.

We propose StateLens, a novel approach that combines the strengths of LLMs and fuzzing through the unique lens of state coverage. Instead of asking an LLM to directly generate fuzzing inputs or predict vulnerabilities by auditing, StateLens uses it offline to identify security-relevant internal states and synthesize feedback probes; a conventional fuzzer then performs the online search at high throughput.

Across six production JavaScript engines, StateLens uncovered 68 previously unknown bugs, at least 35 with confirmed security implications. Some of our bugs have been publicly acknowledged or rewarded by Google, Meta, and Apple. Compared with state-of-the-art (SOTA) JS engine fuzzers, StateLens finds more bugs in the same time frame.

Abstract pending.

The Australi.ai co-founders on how agentic AI is commoditising the artisanal skills cyber careers were built on, and why Australia should build that capability domestically rather than rent it from foreign vendors.

Australian cybersecurity is entering its own industrial revolution, and most of the profession has its head in the sand. The skills that defined cyber careers, artisanal, tightly held and expensive, are being commoditised by agentic AI faster than anyone wants to admit. A skilled pen tester is still valuable, but a competent operator running a swarm of agents is a different category of capability altogether. The same compression is hitting assurance, SecOps and GRC. The work that used to require a specialist is increasingly a repeatable process.

This is not a distant projection. Open models have now crossed the threshold of reliability for long-horizon agentic tasks, which means the capability no longer depends on a large budget or a deep investment in tooling. That lowers the barrier to entry for everyone, including those who will use it to do harm, and it can be stood up for a fraction of what most businesses assume. The result is a K-shaped profession: a minority who harness the tooling accelerate away, while everyone else risks being left behind.

Cole Cornford and Ben Gittins, founders of Australi.ai, argue this future does not have to be so unevenly distributed. The large model companies are already making these decisions for us, releasing product after product designed to pull practitioners into their ecosystems. The same forces driving the disruption can instead be turned into cheap, open, domestic capability, so Australian businesses can conduct business the Australian way rather than renting their core competence from foreign vendors.

This talk covers what is actually happening across Australian cybersecurity, why it amounts to an identity crisis for the profession, and what practitioners and businesses can do about it. The focus is defensibility and economic viability, not the compute hype cycle that dominates most AI conversations. Attendees leave with a pragmatism-over-hype view of where the work is going, the data to back it up, and a concrete set of next steps for today, tomorrow and later.

A first-hand account of working with AI agents to turn two macOS vulnerabilities into controlled kernel read/write and root, and a look at where the models helped, where they did not, and what that means for modern mitigations.

Powerful frontier models have been increasingly successful at turning money into vulnerabilities in mature attack surfaces. Recent models have also begun to show a promising ability to turn vulnerabilities into proof-of-concept exploits. Given the speed of change around model capability, it's no surprise the security community has had a hard time assessing the jagged edges of capability when it comes to agent assisted exploit development. We share our experience working with agents to exploit two interesting vulnerabilities in a macOS to gain controlled kernel read and write and how we gained root code execution from there. We'll discuss the exploit techniques we used, how we worked with AI to discover, implement, and refine them. Finally, we reflect on when and how our model use was efficient for exploit development (for reasoning, tool development, analysis, or not at all).

Abstract pending.

Zenshin, an LLM auditor that only hands over reproduced WebKit bugs: call-graph reachability, cross-model debate, and an ASAN binary as the final judge. Eight WebKit CVEs so far, plus the funnel numbers and where it still falls flat.

Point an LLM at a few million lines of WebKit and it will happily hand you a wall of plausible-sounding bugs, almost all false. This talk is about the machine I built (Zenshin) that instead hands me *reproduced* ones — validated by an actual call graph, argued down by a cross-model debate, and only accepted once an AddressSanitizer binary agrees. It has found 8 Safari CVEs so far, with 2 more awaiting fixes. I'll walk through the full pipeline, the design decisions that turned "plausible" into "proven," real bugs from diff to exploitable primitive, the numbers (candidate → crash → primitive funnel, cost, false-positive rate), and — just as important — where it falls flat and why turning a crash into impact is still a human job. If you're trying to get *real* memory-safety bugs out of an LLM on a large C/C++ target, this is what worked and what didn't.

Abstract pending.

Abstract pending.

Abstract pending.

Two case studies in LLM agents ripping through obscurity: reverse-engineering the currency detectors in photocopiers and image editors to build an unphotocopiable cat, and auto-building a faithful QEMU emulator for a laser printer. His conclusion: obscurity now buys days, not years.

Seasoned hackers have always used "security through obscurity is not security" as a mantra to discourage building systems whose security depends on no one caring enough to look too closely at the details. But in practice these systems abound, and they often remain (publicly) unbroken because human expert time is scarce. In this talk we'll show how LLMs disrupt this equilibrium via two case studies: 1) Reverse engineering currency detection algorithms used by photocopiers and image editing tools, and then attacking them to produce an image of my cat that cannot be edited or photocopied; and 2) Automatically building a highly faithful QEMU emulator for an HP M551dn color laser printer firmware, to the point where you can put it on a network, print to it, and get back faded PNGs if it's running out of emulated toner. We conclude that the security afforded by obscure environments and algorithms can now only provide a few days of protection from anyone with curiosity and tokens to burn, and discuss the implications for anyone building robust systems.