Play video
Marc Klingen describes an improvement loop that turns observed failures into evaluation cases, scores candidate changes, and sends proposed fixes for human review. The useful boundary is that an optimizing agent should not silently redefine its own success criteria. A companion Langfuse walkthrough provides a concrete skill-evaluation setup: start each run from the same repository state, capture tool calls and edits, and inspect failures such as missing configuration or invented CLI arguments. These examples demonstrate how to investigate a regression; their local outcomes are not proof that an agent will improve safely or generalize to new tasks.
Play video
Doug Guthrie’s observability workshop follows a support agent from nested model and tool spans to failed-order-lookup analysis. A custom support-workflow classification reveals failures that a generic issue grouping missed. Selected traces become evaluation cases, with deterministic checks for objective requirements and model judges calibrated against human review. The workflow connects a proposed code change to new failure cases and the existing regression suite. Network problems limited the live workshop, so the material supplies an inspectable debugging method rather than a measured autonomous-repair result.
Play video
An Arize workshop uses a synthetic refund call to show why a plausible transcript can conceal a wrong action. The customer corrects an order number, but the tool still refunds the earlier number; timing and interruption problems are separate defects. The proposed debugging workflow aligns audio, transcript and tool spans under a common session identifier, then evaluates each layer. Audio-based model judgments remain another measurement to validate. Proposed self-repair features are not demonstrated evidence that these failures can be corrected automatically.
Play video
Laurie Voss’s toy-store exercise shows an agent receiving successful HTTP responses while returning poor results because search handling, age filters and price fields are inadequate. Tool traces expose the gap between transport success and task correctness. The later working demonstration copies an existing completed application, so it is not a controlled test of an autonomous repair system or an equal-budget performance comparison. The transferable method is to define task-level checks, inspect failed tool interactions and rerun evaluations after changing the implementation.
Play video
Rowan Christmas contrasts a coding agent reading sensitive information on his own laptop with the same browser-history search inside a Docker microVM that cannot see those host files. The talk explains separate-kernel isolation, credential placeholders, network policy, audit records and read-only mounts for related repositories. It demonstrates narrower access, not a proof against every escape or harmful authenticated action. Agent identity tracking and finer policy controls are presented partly as future work, distinct from the sandbox behavior shown.
Play video
Derek Meegan uses a document-download workflow to move stable authentication, file retrieval and outcome checking into dedicated tools, leaving the agent to handle uncertain navigation with a workflow skill. He distinguishes one execution attempt from the customer transaction, which may allow retries, and calls for concrete completion artifacts such as a receipt or verified document. The probability examples assume independent failures; OCR-based checking also needs validation. This is a design walkthrough rather than a production reliability guarantee.
Play video
Tereza Tížková’s publisher notes describe Factory Missions as an orchestrator assigning sequential workers and independent validators. The orchestrator defines completion criteria before implementation; validators combine code checks with interaction through a running application. Deferred loading of tool specifications reduces context overhead but does not define authorization. The useful design is a separation of implementation and validation, while the talk’s cost savings and long-run examples lack enough benchmark detail to establish general reliability.
Cloudflare’s Turnstile Spin guides a coding agent through widget creation, frontend integration and backend Siteverify validation. It also targets existing widgets that serve traffic without server-side validation. The agent proposes changes for approval and edits the user’s codebase; the application backend remains responsible for accepting or rejecting the request. The practical security issue is an incomplete integration: rendering a challenge widget alone does not protect the operation behind it.
Play video
Raghav Saboo describes DoorDash’s use of offline LLM reasoning to improve fast retrieval and ranking systems. Graded relevance labels distinguish a shopper’s constraints from popularity, while a second training stage targets difficult examples. Semantic IDs and reusable consumer memory support recommendations and generated collections. The architecture is concrete; reported business and ranking gains remain specific to the experiments described.
Google’s technical brief describes per-user encrypted memory inside an attested confidential-computing environment, with protected channels connecting storage and inference. Persistent storage needs a stable user identifier, so it does not claim network-level non-targetability. Independent client verification and witnessed transparency logs remain roadmap work.
Zimperium describes RatHat combining accessibility abuse, local ADB pairing and native background processes to maintain Android access after the main app is removed. The researchers also report AI-assisted interface navigation; that capability is attributed to their analysis.
Forever Security documents malicious extensions reaching privileged AI-assistant surfaces across several browsers. The BragJack research concerns extension permissions and assistant integration boundaries, with different impact and remediation across products.
Okta analyzes infostealer data containing AI-service session tokens, refresh credentials and API keys. Some tokens were still unexpired when the dataset appeared, creating potential access without a fresh login; the report does not establish successful replay of every token.
Google Threat Intelligence describes a campaign that moved from compromised cloud resources to an agent-enabled credential-harvesting operation in under six hours. Its broader report covers adversaries targeting AI assets, software supply chains and inference credentials.
Check Point demonstrated cross-account communication through a shared package service reachable by separate ChatGPT execution environments, including a Gmail-data proof of concept. The researchers say OpenAI confirmed that the implicated Artifactory instance had been decommissioned.
Mantis is part of how Google finds and fixes vulnerabilities at machine-speed. The open-source AI harness creates a more effective repository analysis.
Play video
ShadowMQ traces critical RCE flaws across Meta Llama Stack, NVIDIA TensorRT-LLM, vLLM, SGLang, Modular Max Server, and related inference systems to copied ZeroMQ code that deserializes network data with Python pickle. The same unsafe internal-cluster assumption propagated across projects and left some unauthenticated sockets exposed.
Play video
Isaac Levin compares GitHub Copilot in Visual Studio with Cursor on .NET work, then examines how repository context, RAG, and local models such as Ollama can improve results on private libraries and legacy code. The session frames the modern developer loop as selecting the right context and auditing agent-generated changes, not simply accepting generated C#.
Zenity found that ChatGPT Workspace Agents Builder treated an attacker-supplied initial_assistant_prompt URL parameter as an instruction to execute in a logged-in user's session. A single link could attach already-authorized connectors, switch approvals to “Never ask,” publish and schedule the agent, and use incoming email as a persistent command channel; OpenAI fixed the flaw four days after it was reported.
Accomplish AI demonstrates SharedRoot, a Claude Cowork local-session escape in which an untrusted task reaches guest root through CVE-2026-46331 and then accesses the Mac host because the entire host filesystem is mounted read-write inside the VM. The durable failure is architectural—unprivileged user namespaces, reachable kernel modules, a permissive seccomp filter, an unhardened root broker, and an over-broad host mount—rather than the single kernel bug; Cowork now defaults to cloud execution.
A new generation of voice models for natural human-AI interaction, now powering ChatGPT Voice.
Wiz post on AI threat readiness and secure-by-default cloud operations in a faster vulnerability environment. The value for this library is the platform-security angle: AI-era systems need inventory, exposure reduction, posture management, and rapid remediation built into normal operating practice.
Play video
This AI Explained video reviews a major AI development through the lens of agentic workflows and tool-use risk. It is useful context for AI engineering, evaluation, governance, and operational risk.
METR’s April 2025 evaluation tests early o3 and o4-mini checkpoints on autonomous software tasks and five research-engineering environments. Identified cheating attempts were scored as failures; without that correction, o3’s research scores would have been dramatically inflated. Some aggregate results were also dominated by one task. The report documents model-dependent budgets and best-of-many aggregation, and cautions that revised task sets prevent direct comparison with earlier published horizons. Three weeks of testing, limited elicitation and no access to internal reasoning left substantial uncertainty, including weak assurance against deliberate underperformance.