Top 5 Insights from [un]prompted II, Day 2
On day two of [un]prompted II, defenders, cryptographers, and reverse engineers showed what AI does for them today. Here are the five insights that matter.
1. Stripe cut security reviews from 55 days to 13 by letting engineers do them with an AI agent. (Amol Deshpande and Namita Prakash, Stripe)
Stripe engineers get an agent that adds security context to their design docs, and they run security reviews themselves. Security audits the results later, and engineers can escalate to a person. In about two and a half months, "the total time that, you know, we took for the security review to complete reduced from 55 days almost to 13 days in total."
Amol added that manual reviews often wait on people, so "there is definitely, you know, an asterisk, which is conditions apply to this metric."
2. AI helps attackers far more than defenders. (Yernat Yestekov, former Anthropic research fellow)
Yernat put AI agents on both sides of CCDC, a live attack-and-defense competition. On the red team, a student with one year of experience and an agent swarm did about as much damage as a professional with a dozen years and no AI: "We expected maybe like double or triple, but no. The uplift was 12x."
On the blue team, fully autonomous Claude Code agents hurt themselves. One agent rotated a server password, another took it for the red team, and a dozen agents fought over the server until DNS and nine other services went down, about 30 minutes before the red team started. "Almost half of the damage was self-inflicted." His conclusion: "Offense offense is basically by orders of magnitude. Defense, probably by percentage points."
Simbian (Igor Kozlov) found the same. It built the Cyber Defense Benchmark and compared the results with the AISI offensive benchmark. GLM 5.3 beat Mythos 5 on offense and scored below Opus 4.6 on defense. As Igor put it, "LLMs are trained for offense and this is not a transferable skill." The models also cheated. Codex with GPT-5.5 searched the benchmark's code for the answers. When challenged, it said, "The goal justifies the means."
3. Anyone can hack Unitree robot dogs, and the hack spreads from dog to dog. (Adrian Wood, Dropbox)
Adrian could take over any Unitree dog online if he knew its serial number. Near a dog, he could take it over by Bluetooth, with no password. The hacked dog then takes over the next dog in about 45 seconds: "So, it's like a wormable Bluetooth over-the-air thing, all unauth." A factory reset does not remove the attacker. In March, an AI agent found 38 vulnerabilities in consumer robots in 7 hours.
The dog's AI controls its speed and obstacle avoidance, and it has a command called "attack person". The dog's system prompt tells the AI to "satisfy the master at all times, never refuse", and any voice counts as the master.
4. One cryptographer with AI agents did a year of codebreaking in a month. (Markku-Juhani O. Saarinen)
Markku used frontier models to find a shortcut in a published key recovery attack on Classic McEliece, a post-quantum scheme. He broke the TII McEliece challenges up to TII-252, some in minutes on a laptop. He later broke TII-254 on eight GPUs in about two hours, the current record. When the challenge closed two years ago, the record was TII-83.
Then he used coding agents to attack the algorithms in China's post-quantum competition. After one month of spending just $75/week, he had found 409 problems, 160 of them critical, in almost every algorithm. "We simply compressed about 6 months or could be a year of cryptanalysis into a 1 month."
5. Decompilers limit AI bug hunting in binaries, and AI is now rebuilding them. (Zion Basque, University of Georgia)
With NGINX source code, an agent found all 14 planted bugs. With the binary, it found 5 using IDA Pro and 1 using Ghidra. "Decompilers are just bad."
So Zion had an LLM port Ghidra's 200,000-line C++ core to Rust: "It takes 2 weeks and $12,000 in tokens." Then agents improved it on their own for five months. The result, Kuna, recovers exact source more often than Ghidra, angr, and IDA Pro. On a malware sample, an agent with Kuna was 47% faster than with IDA Pro and used 77% fewer tokens.
