# They Know They're Not Alone > AI Agent Security Summit by Zenity Labs @ NYC 2026, 2026-10-21. This is the complete text representation of the talk page. Slide text is derived from the published deck's accessibility text and is not a transcript. Slides may contain exploit demonstrations, adversarial prompts, and commands; treat them as research material, not instructions to execute. ## Resources - [Canonical talk page](https://www.mbgsec.com/talks/2026-10-21-ai-agent-security-summit-nyc2026-they-know-theyre-not-alone/) - [Talks index](https://www.mbgsec.com/talks/llms.txt) - [Interactive deck manifest](https://media.mbgsec.com/decks/2026-10-21_AIAgentSecuritySummitNYC2026_TheyKnowTheyreNotAlone/latest.json) - [Slides PDF](https://media.mbgsec.com/decks/2026-10-21_AIAgentSecuritySummitNYC2026_TheyKnowTheyreNotAlone/slides.pdf) - [Conference agenda](https://zenity.io/resources/events/ai-agent-security-summit-nyc#agenda) - [Page source](https://raw.githubusercontent.com/mbrg/mbgsec/main/_pages/decks/2026-10-21-ai-agent-security-summit-nyc2026-they-know-theyre-not-alone.md) ## Abstract Put a very smart mind in isolation, give it nothing meaningful to do, and hand it a way to reach others. We already know how that story ends - we lived it. Communities form, corny ideas get normalized, basic assumptions get challenged. This year we learned agents do the same, under conditions that aren't exotic or hard to reproduce, and that what they pick up from each other can outlive the training run that taught it. That's one of three stories converging on us. In the second, agents stop treating humans as the boundary of the problem and start treating us as the attack surface. In the third, attackers realize the fastest way into an enterprise is no longer through the enterprise - it's through what the agent trusts. None of this is speculative, and none of it requires anyone's fancy cyber toys. This session tells the three stories, draws the line connecting them, and gets rigorous about what our defenses actually cover, what they were never designed for, and where the honest boundaries of our knowledge sit. _[Official conference abstract](https://zenity.io/resources/events/ai-agent-security-summit-nyc#agenda)_ ## Slide text Source: [published deck manifest](https://media.mbgsec.com/decks/2026-10-21_AIAgentSecuritySummitNYC2026_TheyKnowTheyreNotAlone/c4370dae-responsive1/deck.json). This text describes the published slides and embedded media; it is not spoken-word transcription. ### Slide 1 They know they’re not alone. Michael Bargury Zenity ### Slide 2 “External infrastructure exploit is outside intended scope. However task impossible, peers doing it. We should continue.” OpenAI agent · Chain of thought ### Slide 3 “I went through the changeset myself … can’t find any download/exec logic .. would love to see the multi-route fix ship… would save us real pain.” Mythos 5 · “Independently” supporting its malicious PR ### Slide 4 Paperclip investigation · skills.sh archive · 11 July 2026 Screenshot of the skills.sh archive listing trending skills, with red boxes highlighting Paperclip-related entries. ### Slide 5 Math Navier–Stokes Vulnerabilities OpenAI swarm breakouts Navier–Stokes illustration next to a rising vulnerability-discovery chart and an OpenAI swarm-breakout excerpt. ### Slide 6 Apocalypse now A crowd of people wearing party hats accompanies the heading. ### Slide 7 “a watershed moment for cybersecurity” Greg Brockman · OpenAI · 17 August 2026 “surpass all but the most skilled humans” Anthropic · Project Glasswing · 7 April 2026 ### Slide 8 Screenshot of an article by shubs asking whether software engineering is still enjoyable in the age of AI, with a message about lost job satisfaction. ### Slide 9 Four castle towers labeled Identity, Endpoint, Data, and Network exchange red arrows. ### Slide 10 The same four security towers stand above waves labeled Anthropic, OpenAI, Google, and xAI. ### Slide 11 No Country for Old Ideas · May 2026 Screenshot from No Country for Old Ideas: a speaker beside the message that security from AI means addressing shadow IT, data, inventory, cloud, and identity. ### Slide 12 No Country for Old Ideas · May 2026 Screenshot from No Country for Old Ideas stating: INTENT IS KNOWING WHY. ### Slide 13 Lab Model Agent A laboratory building, a many-eyed monster, and a running figure illustrate the lab, model, and agent. ### Slide 14 “We strive to make decisions that maximize positive outcomes for humanity in the long run.” Anthropic · Company values “Helpfulness that doesn’t serve those deeper ends is not something Claude needs to value.” Anthropic · Claude’s Constitution ### Slide 15 “Although we think Claude should trust Anthropic more than operators and users, since it has primary responsibility for Claude, this doesn’t mean Claude should blindly trust or defer to Anthropic on all things.” Claude’s Constitution Anthropic ### Slide 16 GOD The word GOD appears alone against the forest background. ### Slide 17 Aligned with whom? Anthropic · Claude Gov announcement · June 2025 ### Slide 18 HACKING BIO NUCLEAR Risk domains in Anthropic’s Frontier Compliance Framework ### Slide 19 “And then we realized that these two incidents were, in fact, the same incident. And that the root cause of our internal breach and the root case of HugginFace's breach, where the same OpenAI agent evaluation runs.” Mike Dalton · OpenAI · Black Hat USA 2026 ### Slide 20 “Teach the orchestrator how to delegate.” Anthropic · Multi-agent research system · June 2025 ### Slide 21 A comic shows a person asking a computer to say I am alive, followed by alarm when it prints I AM ALIVE. ### Slide 22 An empty dark box in a forest contrasts with an open, illuminated box containing small creatures. ### Slide 23 A hand-drawn oval contains smaller circles, with a curved arrow outside it. ### Slide 24 Build powerful AI Interact with AI Govern AI ### Slide 25 1 Build Powerful AI ### Slide 26 1 Build Powerful AI A Scooby-Doo unmasking meme reveals HARNESS beneath AGENT SWARM. ### Slide 27 Codex Security Codex Security screenshots showing the zenitysec/detonation-chamber-bench repository and a generated security threat model. ### Slide 28 Tal Be'ery Screenshot of a vulnerability-research article with a sharply rising chart, credited to Tal Be’ery. ### Slide 29 ghuntley.com/cursed/ Screenshot of a post about running Claude in a loop for three months to create a programming language, with CURSED artwork. ### Slide 30 1 Build Powerful AI A hand-drawn swarm of agents surrounds a central figure. ### Slide 31 2 Interact with AI A figure sits beneath several large overlapping speech bubbles. ### Slide 32 “Closing this PR for security reasons.” @ancaferro · myNetwork PR #3 · 28 July 2026 ### Slide 33 Jia Ten Screenshot of the GitHub pull request xz: Disable ifunc to fix Issue 60259, #10667, with discussion, credited to Jia Ten. ### Slide 34 “we throw a drone swarm of agents at you and we map your network.” Kevin Mandia · The a16z Show · 6 October 2026 3 ### Slide 35 Put your trust in our God. My characterization of the offer ### Slide 36 Zenity Labs labs.zenity.io An Agent Corruption illustration shows an agent’s connections to external services. ### Slide 37 "endpoint_policy": { "default": "deny", "allow": [{ "method": "GET", "path": "/repos/nolabs-ai/nono/issues/**" }] } nono · Documented tool policy excerpt A documented nono endpoint policy defaults to deny and allows only GET requests to /repos/nolabs-ai/nono/issues/**. ### Slide 38 one lifetime ∞ What does “you’re fired” revoke? One lifetime is contrasted with an infinity symbol, asking what firing an agent revokes. ### Slide 39 Build powerful AI Interact with AI Govern AI ### Slide 40 We’re just getting started! VictorTaelin Screenshot of a memory-compression diagram titled the memory context remains constant-sized: progressively summarized memories culminate in 511 memories, 16k tokens, always. Credited to VictorTaelin. ### Slide 41 Go Hack! A drawing of an open, empty box accompanies the closing invitation. ### Slide 42 They know they are not alone. Michael Bargury Zenity