2025
Donato Capitella presented his team's research at Black Hat in Toronto shortly before recording.
“I am actually just back from Canada, uh, where I was presenting our research at Black Hat, uh, in Toronto.”
Topic
Donato Capitella
7 facts from 1 episode, in date order. These are what speakers said on the shows, each linked to the moment it was said. They aren't independently verified.
2025
Capitella attended a two-day conference in Stockholm called Secure AI, devoted to generative AI security.
“And before that, I was at another conference in Stockholm called Secure AI, a complete two days just focused on gen AI security.”
Undated
Capitella says a main way to exfiltrate data from LLM applications is to make the model output a markdown image whose URL points to an attacker-controlled server and carries stolen data in the query string.
“one of the main vectors to exfiltrate information in LLM applications is to make the LLM produce a a markdown image. And in the URL, uh, you can, you can point the URL to an attacker controlled server”
Undated
In the action selector pattern, the LLM only picks a fixed action from the user's input, which Capitella describes as the most secure pattern.
“You are just using the LLM to basically select a fixed action from the user input, so that kind of removes often in that case any anything bad the attacker can do.”
Undated
Capitella compares the policy enforcement in code-then-execute to SELinux on the Linux kernel, calling it a reference monitor for LLM agents.
“It's very reminiscent for people in cybersecurity of what SE Linux does on on a Linux kernel. So it's kind of this reference monitor, uh, for for LLM agents.”
Undated
Capitella implemented all six design patterns from the paper in one weekend and published them in a Git repository.
“I like this paper so much that one weekend I actually implemented all of the these six design patterns. I think I I put it in a Git repo.”
Undated
Capitella argues that rate-limiting attackers and responding to repeated guardrail triggers parallels password-lockout protections against brute-force guessing.
“Likewise, you don't allow the attacker to send 100,000 prompts per second to explore, to find something that's gonna jailbreak it.”
Episodes