When AI Goes Offensive, Exploiting the Unexploitable

The talk argues that manual reconnaissance and scanner-driven testing struggle with scale and depth, so the speaker's team has been building offensive AI agents that reason about a target the way a red teamer would. The agent design adds observe and judge steps to the usual reason-act-learn loop, so false positives get filtered before anyone spends hours chasing them. The stack described includes a model, a vector store that remembers past attempts, an agent framework and a crawler.

Two demonstrations follow. In the first, an agent starts from a token obtained with limited access in an assumed-breach scenario, reads its permissions, enumerates directory and application resources, and plans a multi-stage chain that ends with persistent backdoor accounts in a Microsoft Graph environment. When a step fails, the error is passed to another agent that revises the approach. In the second, a single agent works through an unauthenticated file-read flaw in a Kafka Connect deployment, creating a malicious connector and confirming access to sensitive system files.

The takeaways are practical. Agents need a defined role, a narrow scope and explicit safety constraints in their prompts, and a human should steer them early. Model choice and token cost shape results, and the speaker sees the most value in recon and in carrying context forward between steps.