Hacking AI Applications
summary
Generative-AI code and integrations produce concrete vulnerabilities: a February 2025 study of ~733 snippets finds ~25% of JavaScript lines vulnerable and only ~20% auto-fixable. Live demos show GPT/Copilot-style code producing a Fastify file-upload that concatenates filenames (path traversal), Claude 3.7 emitting a regex that triggers ReDoS in a public signup endpoint taking minutes, and an LLM-generated SQL payload that gets logged and concatenated into SQLite to drop the users table. Covers prompt injection and IDE auto-suggest risks.
AI-written summary · about
chapters (10)
- 0:00Introduction to AI hacking
- 3:15Evolution of AI coding tools
- 7:50Vulnerable AI-generated code
- 12:21AI amplifying insecure patterns
- 18:42Regex denial of service attack
- 20:29AI-powered app vulnerabilities
- 23:39Prompt injection in banking
- 26:50Weaponizing LLMs for attacks
- 29:58Security risks in AI responses
- 30:19Future of AI security concerns
related talks
46mBreaking AI: Live coding and hacking applications with Generative AI
30mWhat Are the Security Risks Associated with AI-Generated Code? 🤔
52mUsing GenAI on and inside your code, what could possibly go wrong?
44mBreaking AI: Live Coding and Hacking Applications with Generative AI
55mUsing GenAI on and inside your code, what could possibly go wrong?
01h 24mOffensive Cybersecurity by AI Promises and Pitfalls
53mHow AI is impacting cybersecurity. Does it?
23mVibes Not Vulns: Securing the Era of AI-Written Software