Skip to content
Sign in
Artwork for In the Wild with Michael Bargury
Technology

In the Wild with Michael Bargury

Zenity Labs

In the Wild is about the AI conversations worth having right now. This podcast brings together builders and breakers, researchers and practitioners – people who see things differently and challenge what we think we know about where AI is going, and what it’s already doing in the wild. Each episode hosts one of these conversations. Sometimes deep into new research, sometimes grounded in a real security problem, sometimes just a paper that raises a question no one’s answered yet. You could say it’s non-deterministic. Just like AI.

A Zenity Labs podcast, hosted by Michael Bargury, Zenity Co-Founder & CTO. Produced by POLDHU.

ZenityLabs
https://labs.zenity.io/
@zenitysec - https://x.com/zenitysec
linkedin.com/company/zenitysec/

Michael Bargury
@mbrg0 - https://x.com/mbrg0 
https://www.linkedin.com/in/michaelbargury/

Play
Open in
  • 5 episodes
  • Avg 1 hr 4 min
  • English

Episodes 5

NewestOldestLongest
All5Unplayed5In progress0Played0
  • October 20 · 1 hr 13 min

    Agents Find a Way w/ Gadi Evron

    Code is cheap. Everyone is a builder. Agents find vulnerabilities. So what’s left? In this episode of In the Wild, Michael Bargury sits down with Gadi Evron, Founder and CEO of Knostic and chair of [un]prompted, for a wide-ranging chat about AI, hacker culture, and what security looks like now. It starts with a great community story. At the first [un]prompted, all the flights got canceled and Michael’s team couldn’t make it to give their browser research talk. Gadi, who runs a competing company, gave up his own stage time so the talk could go ahead. That trust, Gadi says, is the one moat that’s left. From there they get into: Why Gadi is mourning hacker culture while staying a true believer in where this goes “Agents find a way”: why the basics won’t save you, and why honey badger don’t care Why he’d tell a CISO to start with control, not visibility Deception, and why agents might finally make it work OpenAnt, Knostic’s open source vulnerability harness, and why its new autonomous patching is about trust, not the patch Gadi’s hobby of finding new ways to find vulnerabilities with agents What’s coming at [un]prompted, October 27-29 in San Francisco and online And more :) If you work in security, build with agents, or just wonder where you fit in all this, this one is for you. In the Wild is hosted by Zenity Co-Founder & CTO Michael Bargury. A Zenity Labs podcast, produced by POLDHU Chapters: 00:03:26 The flights that got canceled 00:06:50 Code is cheap, community is the moat 00:12:30 Why narratives block us 00:20:01 Hacking, optimism, and the meta-narrative 00:34:36 Gadi reads his Phrack foreword 00:39:10 Agents find a way 00:42:36 Why the basics won’t save you 00:47:28 What survived every wave 00:50:10 Start with control, not visibility 01:03:03 Deception 01:08:01 OpenAnt and autonomous patching 01:09:48 Finding vulnerabilities with agents 01:24:02 [un]prompted Relevant Profiles: Gadi Evron: https://x.com/gadievron https://www.linkedin.com/in/gadievron/ Michael Bargury https://x.com/mbrg0 https://www.linkedin.com/in/michaelbargury/ Dave Aitel https://x.com/daveaitel https://www.linkedin.com/in/daveaitel/ Sergej Epp https://www.linkedin.com/in/sergejepp/ Jeremiah Grossman https://www.linkedin.com/in/grossmanjeremiah/ https://x.com/jeremiahg Steve Crocker https://www.linkedin.com/in/stcrocker/ Vint Cerf https://www.linkedin.com/in/vint-cerf-869259180/?isSelfProfile=false Tim Brown https://www.linkedin.com/in/tim-brown-ciso Heather Adkins https://www.linkedin.com/in/argvee/ Dan Guido https://www.linkedin.com/in/danguido/ Zenity Labs https://x.com/zenitysec_labs https://www.linkedin.com/showcase/zenity-sec-labs/ https://labs.zenity.io/ Mentions: Heather Adkins - Evaluating Threats & Automating Defense: https://greptalks.ai/c/unprompted-2026/ RECON 2026 - The AI Reversing Panel: Are we all powerful, or out of a Job?: https://www.youtube.com/watch?v=iDJDmie8XaQ Dan Guido - 200 Bugs/Week/Engineer: How We Rebuilt Trail of Bits Around AI https://www.youtube.com/watch?v=kgwvAyF7qsA [un]prompted: https://unpromptedcon.org/ Tracebit: https://tracebit.com/ Zero Day Clock: https://zerodayclock.com/ Tools Mentions: Raptor, collaborative AI-assisted security research framework https://github.com/gadievron/raptor OpenAnt, Knostic’s open-source vulnerability discovery and verification tool https://github.com/knostic/OpenAnt

    • Transcript
  • September 23 · 1 hr 9 min

    Break it, Build it, Ship it w/ Fredrik “STÖK” Alexandersson

    Twenty years of hacking expertise, gone overnight, the moment STÖK realized an agent could do his job better, faster, and without him. In episode 4, Michael Bargury is joined by Fredrik “STÖK” Alexandersson, bug bounty OG and Black Hat and DEF CON speaker, who now breaks and builds AI cages for a living. STÖK describes the day an agent installed Splunk, found a vulnerability, wrote the report and collected the bounty while he stood outside, and the depression that followed when twenty years of hacking expertise became obsolete overnight. Michael and STÖK compare notes on containing agents: why “sandbox” means one thing to AI labs and another to security people, why an escape gets harder to catch once a model stops reasoning out loud, and how STÖK’s Cage Lab sets Claude loose on his own guardrails until they hold. In the Wild is hosted by Zenity Co-Founder & CTO Michael Bargury. A Zenity Labs podcast, produced by POLDHU Relevant Profiles: Fredrik “STÖK” Alexandersson https://x.com/stokfredrik https://www.linkedin.com/in/fredrikalexandersson/ Michael Bargury https://x.com/mbrg0 https://www.linkedin.com/in/michaelbargury/ Daniel Cuthbert https://x.com/dcuthbert https://www.linkedin.com/in/daniel-cuthbert0x/ Inbar Raz https://x.com/inbarraz https://www.linkedin.com/in/inbarraz/ James Kettle https://x.com/albinowax https://www.linkedin.com/in/james-kettle-albinowax/ Joona Hoikkala https://x.com/joohoi Zenity Labs https://x.com/zenitysec_labs https://www.linkedin.com/showcase/zenity-sec-labs/ https://labs.zenity.io/ Mentions: Danny Miessler - creator of PAI (Personal AI Infrastructure), the harness STÖK was running https://github.com/danielmiessler/Personal_AI_Infrastructure Hamid (from Expo) - builds custom harnesses, discussed by both as an example of specialized AI hacking setups https://www.youtube.com/watch?v=MYK9-66qe6w Juan Andrés Guerrero-Saade (JAGS), Costin Raiu and Ryan Naraine - The Three Buddy Problem https://securityconversations.fireside.fm/ Research: STÖK's "Weaponizing Plain Text: ANSI Escape Sequences as a Forensic Nightmare" https://www.youtube.com/watch?v=4wVJJOoWXIM Michael Bargury & Tamir Ishay Sharbat, "AI Enterprise Compromise: 0click Exploit Methods" (AgentFlayer), Black Hat USA 2025 https://labs.zenity.io/p/hsc25 Zenity Labs' LiteLLM guardrail sandbox-escape research (CVE-2026-40217) https://labs.zenity.io/p/threat-actors-are-trying-to-use-litellm-s-guardrail-tester-to-run-code-as-root Activation analysis / interpretability research https://transformer-circuits.pub/2025/attribution-graphs/methods.html Builders and Breakers https://buildersbreakers.confetti.events/ Three buddy problem podcast - https://open.spotify.com/show/6dXbRagTUo4fPfpYjIDlwO DEF CON 31 recording of the ANSI talk: https://www.youtube.com/watch?v=3T2Al3jdY38

    • Transcript
  • September 14 · 55 min

    From Dumbledore to Delayed Tool Invocation w/ Ben Nassi

    A simple ״thank you״ triggered the attack. In episode 3, Michael Bargury welcomes back Ben Nassi (Tel Aviv University faculty member) to revisit Invitation Is All You Need, his research with Stav Cohen and Or Yair. In their demonstration, a user asked Google Assistant about their calendar, bringing a malicious invitation into the conversation. When they thanked the assistant, the payload ran: opening real windows and switching on a boiler. Michael and Ben unpack delayed tool invocation: why making an attack wait for a later response can help it evade defenses and trigger actions the user never requested. They debate whether that counts as “zero-click,” what changes when agents run without a user prompting them, and why blocking dangerous actions can also block useful ones. In the Wild is hosted by Zenity Co-Founder & CTO Michael Bargury. A Zenity Labs podcast, produced by POLDHU CHAPTERS 00:00 A prompt injection opens real windows 00:47 Ben Nassi and the Dumbledore opener 02:22 Invitation Is All You Need 06:46 Google's response and defenses 10:32 Delayed tool invocation 17:44 CaMeL and the cost of defenses 24:45 Beyond the lethal trifecta 30:07 Zero-click or half-click? 37:58 Black Hat submissions and great talks 50:34 Real World AI Security Relevant Profiles: Ben Nassi https://x.com/ben_nassi https://www.linkedin.com/in/ben-nassi-phd-68a743115/ Michael Bargury https://x.com/mbrg0 https://www.linkedin.com/in/michaelbargury/ Stav Cohen https://x.com/StAJect0r https://www.linkedin.com/in/staject0r/ Or Yair https://x.com/oryair1999 https://www.linkedin.com/in/or-yair/ Zenity Labs https://x.com/zenitysec_labs https://www.linkedin.com/showcase/zenity-sec-labs/ https://labs.zenity.io/ Mentions: Johann Rehberger — Delayed Tool Invocation Credited as the original discoverer of the technique that underpins Ben's conditional prompts work. His blog covers it across multiple posts → embracethered.com: https://embracethered.com/blog/ Simon Willison — "The Lethal Trifecta" Ben extends it from three conditions to four, adding physical actuation → simonwillison.net: https://simonwillison.net/2025/Jun/16/the-lethal-trifecta/ Charlie Miller and Chris Valasek — Jeep Cherokee Remote Exploitation (DEF CON 23 / Black Hat 2015) → DEF CON talk (YouTube): https://www.youtube.com/watch?v=OobLb1McxnI The Real World AI Security Conference: https://seclab.stanford.edu/RealWorldAIsec/ Dumbledore - Full name Albus Percival Wulfric Brian Dumbledore, headmaster of Hogwarts School of Witchcraft and Wizardry ;) Research: "Invitation Is All You Need" (Gemini zero-click attack, with Stav Cohen and Or Yair) The core research of this episode. Calendar invite embeds a prompt injection that hijacks Google Assistant, triggers physical IoT control, video streaming, and email exfiltration. → Paper site: https://sites.google.com/view/invitation-is-all-you-need/home → arXiv preprint: https://arxiv.org/abs/2508.12175 → SafeBreach writeup: https://www.safebreach.com/blog/invitation-is-all-you-need-hacking-gemini/ "Here Comes the AI Worm" / Morris-II (with Stav Cohen and Ron Bitton) The first AI worm, referenced when Ben discusses how the zero-click term originated. Self-replicating adversarial prompts targeting RAG-based GenAI ecosystems. → arXiv: https://arxiv.org/abs/2403.02817 → Project site: https://sites.google.com/view/compromptmized CaMeL — "Defeating Prompt Injections by Design" (Google DeepMind + ETH Zurich) Ben's main criticism: great for single inference, breaks down in multi-turn/agent scenarios. The mitigation Michael asks about. → arXiv: https://arxiv.org/abs/2503.18813 → GitHub: https://github.com/google-research/camel-prompt-injection → Simon Willison's analysis: https://simonwillison.net/2025/Apr/11/camel/ "The Promptware Kill Chain" (with Bruce Schneier, Oleg Brodt, Elad Feldman) Referenced by Michael when asking about canaries and prompt perturbation. Maps prompt injection attacks onto a seven-stage malware kill chain. → arXiv: https://arxiv.org/abs/2601.09625 → Lawfare: https://www.lawfaremedia.org/article/the-promptware-kill-chain → Schneier on Security: https://www.schneier.com/essays/archives/2026/02/the-promptware-kill-chain.html

    • Transcript
  • #2
    August 17 · 1 hr 15 min

    The Bungee Cord Was the Safety Plan w/ Ads Dawson

    He hacked a robot dog at Black Hat. On stage. With a leash as the safety plan. In episode 2, Michael Bargury sits down with Ads Dawson, Ads breaks AI for a living and loves it. He's Staff AI Security Researcher at Dreadnode and Technical Founder for the OWASP LLM Applications Project, where he builds the tools that stress-test AI systems to their breaking point. As a senior red team operator with BASI team six (led by Pliny the Prompter), he's the guy running wild, large-scale attack simulations that other security teams later copy. Michael and Ads discuss - finding the vulnerability is only half the job. The harder test is whether an agent can get there with the judgment, restraint and creativity of an expert. It can expose an API key, step outside its scope or leave a trail while still marking the task complete. In the Wild is hosted by Zenity Co-Founder & CTO Michael Bargury. A Zenity Labs podcast, produced by POLDHU CHAPTERS 00:00 — Inside the Wild with Ads Dawson 05:40 — From jailbreaking to agentic security 08:28 — Can an AI hacking agent stay stealthy? 12:13 — Building a personal bug-bounty harness 24:28 — Why off-the-shelf tools aren’t enough 33:58 — Keeping autonomous agents inside the lines 43:56 — What black-box AI hides 46:15 — Hacking a robot dog live onstage 52:13 — ScopeJudge and a new way to enforce boundaries 64:54 — Is red teaming dead? Research: stealthbench.com https://ganggreentempertatum.github.io/speaking/ https://blackhat.com/us-26/briefings/schedule/index.html?day=thursday#kinetic-prompt-injection-agent-compromise-with-a-physical-blast-radius-57343 Relevant Profiles: Ads Dawson https://ganggreentempertatum.github.io/speaking/ https://www.linkedin.com/in/adamdawson0/ Michael Bargury https://x.com/mbrg0 https://www.linkedin.com/in/michaelbargury/ Zenity Labs https://x.com/zenitysec_labs https://www.linkedin.com/showcase/zenity-sec-labs/ https://labs.zenity.io/ Mentioned: Pliny the Liberator: https://x.com/elder_plinius?lang=en Joey Melo: https://www.linkedin.com/in/mrjoeymelo/ Pedro Paniago: https://www.linkedin.com/in/pedropaniago/ Nahamsec https://www.linkedin.com/in/nahamsec/ https://x.com/NahamSec Mike Takahashi https://www.linkedin.com/in/michaeltakahashi/ https://x.com/TakSec Tamir Ishay Sharbat https://x.com/tamirishaysh https://www.linkedin.com/in/tamir-ishay-sharbat-069496163/

    • Transcript
  • #1
    August 10 · 49 min

    AI Worms Were Only a Precursor w/ Ben Nassi

    The first AI worm was just a precursor. Today, In the Wild goes live - conversations about AI worth having right now. Non-deterministic. Just like AI. In episode 1 we hosted Ben Nassi - Ben is on the bleeding edge of practical academic work on AI security. He is a BlackHat Review Board member. Leads the Adversarial Minds research group as a faculty member at TAU. Was very early to identify that AI security is about real world impact not harmful outputs. The first to show an AI worm. A Pwnie award winner on his cryptoanalysis work. And is a co-organizer of a new conference the Real World AI Security conference 2026. We'd also like to give a shout out to Stav Cohen, Zenity's Blue Team leader, who was part of Ben Nassi's research team and led the mentioned research projects. In the Wild - Hosted by Zenity Co-Founder & CTO Michael Bargury. Research Agentic Botnets - https://arxiv.org/abs/2607.07433 AI Worm - https://dl.acm.org/doi/abs/10.1145/3719027.3765196 Relevant Profiles: Ben Nassi https://x.com/ben_nassi https://www.linkedin.com/in/ben-nassi-phd-68a743115/ Stav Cohen https://x.com/StAJect0r https://www.linkedin.com/in/staject0r/ Michael Bargury https://x.com/mbrg0 https://www.linkedin.com/in/michaelbargury/ Zenity Labs https://x.com/zenitysec https://www.linkedin.com/company/zenitysec/ https://labs.zenity.io/ A Zenity Labs podcast, produced by POLDHU CHAPTERS 00:00 Cold open and introductions 01:27 Why “promptware”: prompt injection was too small a word 07:33 The kill chain paper and the missing catastrophe 15:28 The end of the beginning 20:10 Refusals are not a security barrier 22:07 Safety vs. security: the blame game 25:16 Slopsquatting: weaponizing a hallucination 28:33 From one prompt to a botnet 33:02 Disclosure is broken 41:55 From the AI worm to remote code execution 46:40 The scan comes back clean

    • Transcript
Showing 1–5 of 5 episodes