So I just got back from "Offensive AI Conference" in San Diego and it was a great event - for a first time conference it ran especially smoothly, the attendees were an amazing crowd, and many of the talks were extremely strong. There's something about a conference that is not recording the talks that gets people to actually sit and listen to them via the magic of FOMO, but also, when a conference is "invite only" then you just in general get less shenanigans - people are invested in being there. On the other hand, I worry that the glut of more "invite only" conferences actually locks out people who are underrepresented or not established in the industry, which is perhaps not ideal?
Two talks I thought went particularly well were:
- Ruikai Peng and Olivier Laflamme's talk on a methodology for binary analysis using LLMs they constructed (wrapping binja) - which they demoed finding an a 0day on a popular consumer firmware or two. Ruikai is apparently....16 years old? Insane. - Jason Garman and Aaron Brown's talk on Cyber Auto-Agent, which has a lot of interesting innovation in it but also is available https://github.com/westonbrown/Cyber-AutoAgent on GitHub. It's a web application assessment tool that (they claim) meets or exceeds XBOW's published number on the XBOW eval set (although I'm sure that's very out of date). Worth an install, for sure!
When I took my kids to Defcon this year it was not really for business - it was vibe hacking in the strictest sense. These are trying times and I wanted to feel the community around me, even if that community was busy kicking an inflatable beach ball around in the lobby, or soldering badges together, or awkwardly dancing to nerdcore played at unreasonable volumes. In some ways, hearing the beating of the wings of the fifty thousand strong locust swarm of hackers that descends on Vegas every summer is very reassuring. In that sense, Defcon has always been more about pure distilled hacker vibe than anything else.
But Offensive AI Conference was a business and technical meet up - much in the way Infiltrate used to be - where the DJ is actually told to turn down the volume of the music at the initial party because people are trying to have 50 different little meetings, where you attend the talks because the talks do actually matter.
In any case, I assume next year they will grow, but also, still be annoyingly hard to get into. :)
-dave