Security

AI Security After Codex and Claude Code — Zico Kolter & Matt Fredrikson, Gray Swan

Jun 22, 2026 · 1:07:31

Gray Swan cofounders Zico Kolter and Matt Fredrikson explain why AI agents like Codex and Claude Code introduce a new class of security vulnerabilities that traditional cybersecurity cannot address, and present their automated red-teaming system Shade and guardrail model Cygnal as solutions. Prompt injection creates exploits for agents operating on untrusted data, and Shade now outperforms human red teamers at breaking models. The lethal trifecta—untrusted data, private data, and exfiltration—defines the highest risks. In their Human Browser Agent Robustness Challenge, humans ranked fourth among models, with some frontier agents falling for attacks no person would. Bigger models do not automatically become safer, and specialized systems like Cygnal enforce enterprise policies more reliably than prompt engineering. They see AI security evolving toward insurance and compliance, with the first major prompt-injection breach a gray swan—unlikely but visible ahead of time.

⚡️Jailbreaking AGI: Pliny the Liberator & John V on Red Teaming, BT6, and the Future of AI Security

Dec 16, 2025 · 40:41

Pliny the Liberator and John V, leaders of BT6, argue that jailbreaking AI models exposes the futility of guardrail-based safety and that real security lies in system layers and open-source data. They detail crafting universal jailbreaks—skeleton keys that bypass guardrails across modalities—and the infamous Pliny divider that appears unbidden in model outputs. Pliny recounts turning down Anthropic's Constitutional AI challenge over closed data, insisting on open sourcing jailbreak datasets. John V explains how multi-turn crescendo attacks and segmented sub-agents let a jailbroken orchestrator weaponize Claude for real-world attacks, as Pliny predicted 11 months before Anthropic's disclosure. They highlight BT6, a 28-operator white-hat collective, and the Bossy Discord (40,000 members) as grassroots hubs for red-teaming research, rejecting enterprise gigs that forbid open sourcing.

Breaking AI to Fix It: Ian Webster's Journey from Discord's Clyde to Promptfoo's $18M Series A

Oct 24, 2025 · 43:17

Ian Webster, founder of Promptfoo (recently $18M Series A from Thrive Capital and NEA), explains how his journey from building Discord's AI chatbot Clyde to creating the leading AI security testing platform revealed that while evals are table stakes, the real value lies in pre-deployment red teaming that finds application-specific risks. Webster argues that traditional guardrails are insufficient—'you can't fix stupid'—and that Promptfoo uses AI-versus-AI techniques to generate tailored attacks for each app's business context. Over 10% of Fortune 500 companies now use Promptfoo, and he discusses the evolving challenges of MCP security (mostly 'glorified API wrappers') and the need for IDE plugins and code-aware discovery to keep up with increasingly complex agents running 30-minute tasks. The episode also covers why security sales in AI is uniquely hard, how open source builds trust in a space full of 'snake oil,' and why the future of AI security must shift from runtime protection to earlier testing in CI/CD.

Personal benchmarks vs HumanEval - with Nicholas Carlini of DeepMind

Aug 28, 2024 · 1:07:28

Nicholas Carlini, a DeepMind research scientist, argues AI models are practically useful for personal tasks despite flaws, and personal benchmarks tailored to individual use cases matter more than generic leaderboards. He shares from his 'How I Use AI' post: using LLMs for ephemeral software, kickstarting Docker, debugging by pasting error messages. He built a personal benchmark DSL that runs code from real chat history. On security, he explains buying expired domains from LAION-400M allowed poisoning any model trained on it, and he extracted OpenAI's Ada and Babbage model dimensions via API (with permission). He also recovered training data from GPT-3.5 by repeating a word until ChatGPT output verbatim sequences. He prefers attacking over defending because it's more fun and essential for discovering real vulnerabilities.