In the Wild with Michael Bargury

Zenity Labs
  • 5.0 (1)
  • Technology

In the Wild is about the AI conversations worth having right now. This podcast brings together builders and breakers, researchers and practitioners – people who see things differently and challenge what we think we know about where AI is going, and what it’s already doing in the wild. Each episode hosts one of these conversations. Sometimes deep into new research, sometimes grounded in a real security problem, sometimes just a paper that raises a question no one’s answered yet. You could say it’s non-deterministic. Just like AI.A Zenity Labs podcast, hosted by Michael Bargury, Zenity Co-Founder & CTO. Produced by POLDHU.ZenityLabshttps://labs.zenity.io/@zenitysec - https://x.com/zenityseclinkedin.com/company/zenitysec/Michael Bargury@mbrg0 - https://x.com/mbrg0 https://www.linkedin.com/in/michaelbargury/

Episodes

  1. Sep 23 ·  Video

    Break it, Build it, Ship it w/ Fredrik “STÖK” Alexandersson

    Twenty years of hacking expertise, gone overnight, the moment STÖK realized an agent could do his job better, faster, and without him. In episode 4, Michael Bargury is joined by Fredrik “STÖK” Alexandersson, bug bounty OG and Black Hat and DEF CON speaker, who now breaks and builds AI cages for a living. STÖK describes the day an agent installed Splunk, found a vulnerability, wrote the report and collected the bounty while he stood outside, and the depression that followed when twenty years of hacking expertise became obsolete overnight. Michael and STÖK compare notes on containing agents: why “sandbox” means one thing to AI labs and another to security people, why an escape gets harder to catch once a model stops reasoning out loud, and how STÖK’s Cage Lab sets Claude loose on his own guardrails until they hold. In the Wild is hosted by Zenity Co-Founder & CTO Michael Bargury. A Zenity Labs podcast, produced by POLDHU Relevant Profiles:    Fredrik “STÖK” Alexandersson https://x.com/stokfredrik https://www.linkedin.com/in/fredrikalexandersson/ Michael Bargury https://x.com/mbrg0  https://www.linkedin.com/in/michaelbargury/  Daniel Cuthbert  https://x.com/dcuthbert https://www.linkedin.com/in/daniel-cuthbert0x/ Inbar Raz  https://x.com/inbarraz https://www.linkedin.com/in/inbarraz/ James Kettle  https://x.com/albinowax https://www.linkedin.com/in/james-kettle-albinowax/ Joona Hoikkala https://x.com/joohoi Zenity Labs https://x.com/zenitysec_labs  https://www.linkedin.com/showcase/zenity-sec-labs/ https://labs.zenity.io/ Mentions: Danny Miessler - creator of PAI (Personal AI Infrastructure), the harness STÖK was running https://github.com/danielmiessler/Personal_AI_Infrastructure  Hamid (from Expo) - builds custom harnesses, discussed by both as an example of specialized AI hacking setups https://www.youtube.com/watch?v=MYK9-66qe6w Juan Andrés Guerrero-Saade (JAGS), Costin Raiu and Ryan Naraine - The Three Buddy Problem https://securityconversations.fireside.fm/ Research: STÖK's "Weaponizing Plain Text: ANSI Escape Sequences as a Forensic Nightmare" https://www.youtube.com/watch?v=4wVJJOoWXIM Michael Bargury & Tamir Ishay Sharbat, "AI Enterprise Compromise: 0click Exploit Methods" (AgentFlayer), Black Hat USA 2025 https://labs.zenity.io/p/hsc25  Zenity Labs' LiteLLM guardrail sandbox-escape research (CVE-2026-40217) https://labs.zenity.io/p/threat-actors-are-trying-to-use-litellm-s-guardrail-tester-to-run-code-as-root Activation analysis / interpretability research https://transformer-circuits.pub/2025/attribution-graphs/methods.html Builders and Breakers https://buildersbreakers.confetti.events/ Three buddy problem podcast - https://open.spotify.com/show/6dXbRagTUo4fPfpYjIDlwO  DEF CON 31 recording of the ANSI talk: https://www.youtube.com/watch?v=3T2Al3jdY38

    Break it, Build it, Ship it w/ Fredrik “STÖK” Alexandersson

  2. Sep 14 ·  Video

    From Dumbledore to Delayed Tool Invocation w/ Ben Nassi

    A simple ״thank you״ triggered the attack. In episode 3, Michael Bargury welcomes back Ben Nassi (Tel Aviv University faculty member) to revisit Invitation Is All You Need, his research with Stav Cohen and Or Yair. In their demonstration, a user asked Google Assistant about their calendar, bringing a malicious invitation into the conversation. When they thanked the assistant, the payload ran: opening real windows and switching on a boiler. Michael and Ben unpack delayed tool invocation: why making an attack wait for a later response can help it evade defenses and trigger actions the user never requested. They debate whether that counts as “zero-click,” what changes when agents run without a user prompting them, and why blocking dangerous actions can also block useful ones. In the Wild is hosted by Zenity Co-Founder & CTO Michael Bargury. A Zenity Labs podcast, produced by POLDHU CHAPTERS 00:00   A prompt injection opens real windows 00:47   Ben Nassi and the Dumbledore opener 02:22   Invitation Is All You Need 06:46   Google's response and defenses 10:32   Delayed tool invocation 17:44   CaMeL and the cost of defenses 24:45   Beyond the lethal trifecta 30:07   Zero-click or half-click? 37:58   Black Hat submissions and great talks 50:34   Real World AI Security Relevant Profiles: Ben Nassi https://x.com/ben_nassi  https://www.linkedin.com/in/ben-nassi-phd-68a743115/  Michael Bargury https://x.com/mbrg0  https://www.linkedin.com/in/michaelbargury/  Stav Cohen https://x.com/StAJect0r https://www.linkedin.com/in/staject0r/ Or Yair https://x.com/oryair1999 https://www.linkedin.com/in/or-yair/ Zenity Labs https://x.com/zenitysec_labs  https://www.linkedin.com/showcase/zenity-sec-labs/ https://labs.zenity.io/ Mentions: Johann Rehberger — Delayed Tool Invocation Credited as the original discoverer of the technique that underpins Ben's conditional prompts work. His blog covers it across multiple posts → embracethered.com: https://embracethered.com/blog/ Simon Willison — "The Lethal Trifecta" Ben extends it from three conditions to four, adding physical actuation → simonwillison.net: https://simonwillison.net/2025/Jun/16/the-lethal-trifecta/ Charlie Miller and Chris Valasek — Jeep Cherokee Remote Exploitation (DEF CON 23 / Black Hat 2015) → DEF CON talk (YouTube): https://www.youtube.com/watch?v=OobLb1McxnI The Real World AI Security Conference: https://seclab.stanford.edu/RealWorldAIsec/ Dumbledore - Full name Albus Percival Wulfric Brian Dumbledore, headmaster of Hogwarts School of Witchcraft and Wizardry ;) Research: "Invitation Is All You Need" (Gemini zero-click attack, with Stav Cohen and Or Yair) The core research of this episode. Calendar invite embeds a prompt injection that hijacks Google Assistant, triggers physical IoT control, video streaming, and email exfiltration. → Paper site: https://sites.google.com/view/invitation-is-all-you-need/home → arXiv preprint: https://arxiv.org/abs/2508.12175 → SafeBreach writeup: https://www.safebreach.com/blog/invitation-is-all-you-need-hacking-gemini/ "Here Comes the AI Worm" / Morris-II (with Stav Cohen and Ron Bitton) The first AI worm, referenced when Ben discusses how the zero-click term originated. Self-replicating adversarial prompts targeting RAG-based GenAI ecosystems. → arXiv: https://arxiv.org/abs/2403.02817 → Project site: https://sites.google.com/view/compromptmized CaMeL — "Defeating Prompt Injections by Design" (Google DeepMind + ETH Zurich) Ben's main criticism: great for single inference, breaks down in multi-turn/agent scenarios. The mitigation Michael asks about. → arXiv: https://arxiv.org/abs/2503.18813 → GitHub: https://github.com/google-research/camel-prompt-injection → Simon Willison's analysis: https://simonwillison.net/2025/Apr/11/camel/ "The Promptware Kill Chain" (with Bruce Schneier, Oleg Brodt, Elad Feldman) Referenced by Michael when asking about canaries and prompt perturbation. Maps prompt injection attacks onto a seven-stage malware kill chain. → arXiv: https://arxiv.org/abs/2601.09625 → Lawfare: https://www.lawfaremedia.org/article/the-promptware-kill-chain → Schneier on Security: https://www.schneier.com/essays/archives/2026/02/the-promptware-kill-chain.html

    From Dumbledore to Delayed Tool Invocation w/ Ben Nassi

  3. Aug 17 ·  Video

    The Bungee Cord Was the Safety Plan w/ Ads Dawson

    He hacked a robot dog at Black Hat. On stage. With a leash as the safety plan. In episode 2, Michael Bargury sits down with Ads Dawson, Ads breaks AI for a living and loves it. He's Staff AI Security Researcher at Dreadnode and Technical Founder for the OWASP LLM Applications Project, where he builds the tools that stress-test AI systems to their breaking point. As a senior red team operator with BASI team six (led by Pliny the Prompter), he's the guy running wild, large-scale attack simulations that other security teams later copy.  Michael and Ads discuss - finding the vulnerability is only half the job. The harder test is whether an agent can get there with the judgment, restraint and creativity of an expert. It can expose an API key, step outside its scope or leave a trail while still marking the task complete. In the Wild is hosted by Zenity Co-Founder & CTO Michael Bargury. A Zenity Labs podcast, produced by POLDHU CHAPTERS 00:00 — Inside the Wild with Ads Dawson 05:40 — From jailbreaking to agentic security 08:28 — Can an AI hacking agent stay stealthy? 12:13 — Building a personal bug-bounty harness 24:28 — Why off-the-shelf tools aren’t enough 33:58 — Keeping autonomous agents inside the lines 43:56 — What black-box AI hides 46:15 — Hacking a robot dog live onstage 52:13 — ScopeJudge and a new way to enforce boundaries 64:54 — Is red teaming dead? Research: stealthbench.com https://ganggreentempertatum.github.io/speaking/ https://blackhat.com/us-26/briefings/schedule/index.html?day=thursday#kinetic-prompt-injection-agent-compromise-with-a-physical-blast-radius-57343 Relevant Profiles: Ads Dawson https://ganggreentempertatum.github.io/speaking/ https://www.linkedin.com/in/adamdawson0/ Michael Bargury https://x.com/mbrg0  https://www.linkedin.com/in/michaelbargury/  Zenity Labs https://x.com/zenitysec_labs  https://www.linkedin.com/showcase/zenity-sec-labs/ https://labs.zenity.io/ Mentioned: Pliny the Liberator: https://x.com/elder_plinius?lang=en Joey Melo: https://www.linkedin.com/in/mrjoeymelo/ Pedro Paniago: https://www.linkedin.com/in/pedropaniago/ Nahamsec https://www.linkedin.com/in/nahamsec/ https://x.com/NahamSec Mike Takahashi https://www.linkedin.com/in/michaeltakahashi/ https://x.com/TakSec Tamir Ishay Sharbat https://x.com/tamirishaysh https://www.linkedin.com/in/tamir-ishay-sharbat-069496163/

    The Bungee Cord Was the Safety Plan w/ Ads Dawson

  4. Aug 10 ·  Video

    AI Worms Were Only a Precursor w/ Ben Nassi

    The first AI worm was just a precursor. Today, In the Wild goes live - conversations about AI worth having right now. Non-deterministic. Just like AI.  In episode 1 we hosted Ben Nassi - Ben is on the bleeding edge of practical academic work on AI security. He is a BlackHat Review Board member. Leads the Adversarial Minds research group as a faculty member at TAU. Was very early to identify that AI security is about real world impact not harmful outputs. The first to show an AI worm. A Pwnie award winner on his cryptoanalysis work. And is a co-organizer of a new conference the Real World AI Security conference 2026. We'd also like to give a shout out to Stav Cohen, Zenity's Blue Team leader, who was part of Ben Nassi's research team and led the mentioned research projects. In the Wild - Hosted by Zenity Co-Founder & CTO Michael Bargury. Research Agentic Botnets - https://arxiv.org/abs/2607.07433   AI Worm - https://dl.acm.org/doi/abs/10.1145/3719027.3765196  Relevant Profiles: Ben Nassi  https://x.com/ben_nassi  https://www.linkedin.com/in/ben-nassi-phd-68a743115/  Stav Cohen https://x.com/StAJect0r   https://www.linkedin.com/in/staject0r/  Michael Bargury https://x.com/mbrg0  https://www.linkedin.com/in/michaelbargury/   Zenity Labs https://x.com/zenitysec  https://www.linkedin.com/company/zenitysec/ https://labs.zenity.io/  A Zenity Labs podcast, produced by POLDHU CHAPTERS 00:00  Cold open and introductions 01:27   Why “promptware”: prompt injection was too small a word 07:33   The kill chain paper and the missing catastrophe 15:28   The end of the beginning 20:10   Refusals are not a security barrier 22:07   Safety vs. security: the blame game 25:16   Slopsquatting: weaponizing a hallucination 28:33   From one prompt to a botnet 33:02   Disclosure is broken 41:55   From the AI worm to remote code execution 46:40   The scan comes back clean

    AI Worms Were Only a Precursor w/ Ben Nassi
  • 4 Episodes

Ratings & Reviews

About

In the Wild is about the AI conversations worth having right now. This podcast brings together builders and breakers, researchers and practitioners – people who see things differently and challenge what we think we know about where AI is going, and what it’s already doing in the wild. Each episode hosts one of these conversations. Sometimes deep into new research, sometimes grounded in a real security problem, sometimes just a paper that raises a question no one’s answered yet. You could say it’s non-deterministic. Just like AI.A Zenity Labs podcast, hosted by Michael Bargury, Zenity Co-Founder & CTO. Produced by POLDHU.ZenityLabshttps://labs.zenity.io/@zenitysec - https://x.com/zenityseclinkedin.com/company/zenitysec/Michael Bargury@mbrg0 - https://x.com/mbrg0 https://www.linkedin.com/in/michaelbargury/

Information

You Might Also Like