The Subverted Hacker
Where
Policy Village
DEF CON 34
Duration
22 min
Argues that frontier AI security work is being absorbed by a few companies and states, and proposes an internationally mandated red-team program for vetted hackers.
Summary
The speaker, a Policy Village presenter with an offensive security background, opens by tying the talk to DEF CON's theme of agency. He describes the hacker tradition of making powerful systems understandable and open to challenge, and argues that frontier AI is pulling that capacity into private labs and organizations. He presents this as a shift in who decides what counts as acceptable risk, since the impacts of these systems are public while their internals and evaluations stay private.
He then walks through the incentives that shape hackers working in AI safety and security. Consulting contracts, research funding, bounties and prestige act as carrots, while NDAs and clawbacks limit what people can say afterward. He criticizes narratives that either sell AI as harmless or frame it as an existential catastrophe, and he points to well-funded groups backed by billionaires whose worldview can narrow the discussion. He also says many practical problems, such as AI agents placed into medical and insurance systems, get less attention than they deserve.
He closes with a proposal for an international, non-commercial red-team mandate. Vetted hackers and experts from around the world would test high-impact AI systems under legal protection, so that the decisions about risk stay contestable beyond the companies that build them. The practical takeaway is to examine an organization's values and incentives before joining, and to remember that public-interest work can also be done from outside these institutions.
Materials
Related talks
Policy Village·26 min
Carole House
Maps the legal doctrine on who answers for code that acts, from AI agents to crypto protocols, and proposes a functional lens built on control and foreseeability.
Voting Village·50 min
Wayne Williams
Traces how Colorado built statewide risk-limiting audits, from the 2009 law through the 2017 rollout, and why they verify vote tabulation.
Bug Bounty Village·28 min
Katie Paxton-Fear · Max vonBlankenburg
Shows how turning bug bounty reports into Semgrep rules can separate real vulnerabilities from AI-generated slop in curl's disclosed reports.

