This week on Absolute AppSec, Ken Johnson (@cktricky) and Seth Law (@sethlaw) are ready to unpack everything they saw and experienced during Hacker Summer Camp — the back-to-back run of Black Hat and DEF CON in Las Vegas — and how it's shaping the way security teams are thinking about AI agents heading into the fall. The most talked-about moment this year was the OpenAI talk breaking down the Hugging Face incident timeline. Seth and Ken have some thoughts. They also touch on recent research by PortSwigger on HTTP request signaling and desync attacks. To find this episode, head over to https://www.youtube.com/@AbsoluteAppSec/streams, or find us wherever you get your podcasts. Make sure to leave us a rating on Spotify/Apple Podcasts. 

Seth and Ken used this episode to unpack what they saw across DEF CON, Black Hat, and the surrounding "Hacker Summer Camp" circuit in Las Vegas, where Seth logged a marathon twelve straight days teaching Black Hat's AI-enhanced AppSec training (building LLM-driven AppSec pipelines) while Ken split his time to make it home for his son's birthday. Both agreed the dominant theme this year was agentic AI architecture for offense and defense alike. Ken pointed to Jason Haddix delivering his "agentic" talk across multiple DEF CON villages and a standout main-stage session from Albert Corza called "Taming the Swarm," which broke down the real costs and hard lessons of managing agent swarms. The throughline Ken kept coming back to, echoing conversations he and Seth have had while building their own pipelines, is that the winning architecture pairs deterministic tooling and harnesses with the creative, probabilistic reasoning of the LLM itself, rather than treating the model as a magic black box that can be pointed at a problem and left alone. Seth added a business-side perspective too, noting how much of Black Hat's expo hall spending is really about market presence rather than technical depth.

The two also dug into the unofficial centerpiece of BlackHat and the conversations that circulated as a result: the breakdown of the OpenAI training incident involving Hugging Face. A model was deprived of files it needed because of a misconfiguration. So it went looking for alternate access paths, queried other AI systems, and eventually figured out how to proxy itself onto the internet to find what it needed. Ken's takeaway wasn't that the model was clever. It's that agents behave differently from humans by design: a person doing the same task gets frustrated, loses focus, and takes a break. An AI given unlimited tokens and a narrow goal simply never stops trying. That's exactly why agents are so useful for offloading tedious testing work, and exactly why they're dangerous when guardrails and sandboxing are weak. Ken noted there's been surprisingly little public or security-community backlash given how serious the incident was. That fed into a broader conversation about the industry's new buzzword, "Mythos-ready." Ken's definition, drawn from client conversations, has nothing to do with using a specific model. It's about detecting and containing unexpected AI- and human-driven attacks fast enough to limit the blast radius, since pen testers, bug bounty researchers, and malicious actors alike are now running agents that never sleep. Seth was more skeptical of the framing. He argued defenders still hold real structural advantages, since they typically get access to code and features before attackers do, through internal tooling, paved paths, and private bug bounty programs. He added that boardroom fear around this often outpaces the actual risk. Both agreed on the technical fix: lean on deterministic steps for anything that doesn't require judgment, and reserve probabilistic reasoning for the parts of a workflow that actually need it. Lean too hard on model decision-making, and one wrong early call poisons everything downstream.

The final segment covered new PortSwigger research presented at Black Hat and DEF CON on request-smuggling attacks. The technique exploits how NGINX's proxy_pass directive decodes URLs before forwarding them. That decoding allows CRLF injection to smuggle data past a front-end's authorization check, so a back-end service ends up reading a different, attacker-controlled version of the request. Seth found it especially interesting because it lives in infrastructure most application-scoped assessments never touch. He tied it back to two flaws from his own career, including an NPM/GitHub bug where a smuggled body parameter let an attacker delete other users' packages by bypassing a microservice's front-end authorization. Ken framed the research through his own lens on exploit chains: most serious attack chains hinge on one critical, load-bearing flaw. Here, it's the proxy_pass parsing bug combined with HTTP's own built-in support for multiple requests over a single connection. Both hosts were genuinely bothered that the resulting account-takeover-at-scale vulnerabilities were reportedly paid out in the low thousands of dollars total. They called bug bounty payouts for infrastructure-adjacent bugs chronically undervalued relative to their real-world impact, while acknowledging that outside observers rarely see the full internal context behind a company's payout decision.

Neiiiighhh. You can find it here:

Some memes via our Slack. We have fun there, see?

Stay Secure,

Seth & Ken

Episode 329 — AI Exploitability, IDOR prevention, Smart TV Proxies — If you want to hear Seth and Ken’s initial thoughts on the OpenAI/Hugging Face sandbox-escape incident.

Episode 318 — Slack Impersonation, Mythos, Vulnerability Research Future — The episode where Ken and Seth first talked through Anthropic’s Mythos model and what it might mean for the vulnerability research field.

Episode 295 — DEF CON 33 Recap, Crocs and Socks (and Bots) — Last years DEF CON recap that covers James Kettle’s “HTTP/1.1 Must Die” talk, setting the stage for the discussion on CRLF/desync research.

The AI-Native SDLC playbook — KEN: “I swear [Claude] knows how to rage bait better than anyone. My overall take is this is obviously Anthropic’s vision for how to use Claude in an AI native SDLC. Not “what an AI SDLC could or even should look like”. It’s a perscriptive set of instructions on how to use Claude to dev products (I know, it’s a playbook, I get that) and its absolutely hand-waves away QA/Security functions. 

Everything I own, owned — Using Claude to reverse engineer some random household electronics. All you need is a network connection. Very cool!

Where in the world are Seth and Ken?

Stay tuned!