Groking the Kill Chain

The talk opens with recent incidents where autonomous AI agents deleted databases, exceeded their scope, or disrupted services. The speaker argues that unconstrained models are a poor fit for security work because they map a single short prompt onto a huge space of possible outputs. He presents an alternative he calls agents on rails, where the model never picks its own tools, scope, or stopping point.

The design works as a staged pipeline. User input is limited to domains, hosts, ports, and paths, checked against an allow list, and filtered against bug bounty program scopes pulled from HackerOne and Bugcrowd. Scanners such as subfinder, Nmap, and Nuclei run with arguments the developer fixed in advance, with size caps and timeouts, inside a sandboxed Kubernetes instance. The model only analyzes the raw tool output under tight instructions asking for concise, non-alarmist, structured findings, which also keeps token costs low.

The speaker reports a case study covering about 621 hours of scanning across roughly 500 jobs and 45 agents. Of more than 21,000 tasks, over 99 percent completed, and most of the few failures were tools hanging rather than model errors. The AI cost averaged about 44 cents per scan. His takeaway for practitioners is to treat AI as a feature inside a constrained product, and to ask during threat modeling which guardrails are in place.