SecTor 2026 | Using Claude or Codex? We Can Hack Your App?

This talk argues AI will transform cybersecurity far beyond securing AI agents: LLMs are inherently predictable, so AI-generated code shares repeatable vulnerabilities attackers can exploit at scale 3:48.

Key Takeaways:
• AI commoditized both coding and hacking—non-experts can find zero-days via prompts, and closed-model capabilities reach open models within ~6 months, where safety alignment is easily removed 4:54.
• AI attackers adapt instantly to signatures and anomaly detection, defeating defenses built for human attackers; AI Security Institute benchmarks show hacking capability jumping from near-zero (GPT-4) to full network takeover within ~6 months 10:25.
• The speakers demoed "predictability" attacks: UI fingerprinting identifies the model that generated a site, letting attackers find vulnerabilities in similar generated apps and exploit the target—finding a real XSS 18:39.
• Across ~1,000 apps and six models, vulnerabilities repeated across models and domains (up to 94% persistence); a coverage lookup table for most models costs only ~$400 24:55.

Defenses must evolve now, before models become far more capable in the next one to two years 29:24.

Sources:

• 3:48 Core thesis
• 4:54 Commoditization and open-model risks
• 10:25 AI attackers and capability benchmarks
• 18:39 UI fingerprinting demo
• 24:55 Vulnerability recurrence results
• 29:24 Call to action