When Models Write Malware: Defending Against On-demand Exploits
summary
Live demo shows a Claude-generated exploit beating VirusTotal signature scanners and landing on a toy vulnerable plugin endpoint, then Falco eBPF rules and Falco Sidekick webhook fire a pipeline that reads the script, hashes it, caches verdicts and classifies with a distilled model (Distilroberta 82M) at 35 ms latency with 98.4% accuracy and zero dangerous misses, falling back to Opus/Claude at ~1.5s for low-confidence cases; suggested mitigations include read-only rootfs, disabling service account auto-mounts and runtime enforcement/Talon-style blocking.
AI-written summary · about
chapters (11)
- 0:00AI-driven malware risks
- 1:02Vulnerable toy application
- 3:07Signature-based detection limits
- 5:15Sandboxing too slow
- 7:22Syscall observation for malware
- 9:06AI classifying malicious scripts
- 12:36Model training with Auto Research
- 15:45Real-time detection pipeline
- 19:38Live demo
- 21:31Enforcement strategies
- 25:18Q&A
related talks
13mEvading and crashing anti-malware solutions via data collection overloading during...
48mCatch me if you can: Building a Web Malware Analyzer using Machine Learning
28mFuzzing Malware for Fun & Profit
20mSponsored Demo: The True Cost of Building at Machine Speed
41mIdentifying and Mitigating Cloud and Container Threats
36mCyber Werewolves: Emulating the Enemy Before the Full Moon Rises
52mFlying Under the Radar - New Security Evasion Techniques
53mAI-equipped Threat Actors Versus AI-enhanced Cyber Tools: Who Wins?