12/11/2026
🎤 𝗪𝗲 𝗽𝗿𝗲𝘀𝗲𝗻𝘁 𝗼𝘂𝗿 𝗞𝗲𝘆𝗻𝗼𝘁𝗲 𝘀𝗽𝗲𝗮𝗸𝗲𝗿 : Markus Vervier
Frontier AI labs say the vulnerability problem has an expiry date: a rough 18 months of AI-found bugs, then “vulnzero”, when we stop shipping security bugs for good.
Markus isn’t buying it.
In “Who Audits the Auditor? Why AI Won’t Ship Us Bug-Free Software”, Markus reports from the front lines. He spends his days both attacking AI systems and building them. AI does find bugs faster than ever, but the AI tools are also becoming the most exposed part of the stack:
🔹 A README file hijacks the coding assistant that’s reviewing it
🔹 An autonomous pentest agent hands its credentials to a fake login page
🔹 A poisoned model passes its backdoor on to the next generation, Ken Thompson’s “Trusting Trust” rebuilt for 2026
The real problem isn’t that the models aren’t smart enough. It’s that we’re handing judgment to systems that can’t tell instructions from data, and adoption is outpacing our ability to assess the risk.
𝗔𝗯𝗼𝘂𝘁 𝗠𝗮𝗿𝗸𝘂𝘀
Markus has 18+ years in offensive security as a researcher, code auditor and pentester. He’s known for finding vulnerabilities in Signal (with JP Aumasson) and libOTR. For the last four years he’s been building Nemesis by 𝗣𝗲𝗿𝘀𝗶𝘀𝘁𝗲𝗻𝘁 𝗦𝗲𝗰𝘂𝗿𝗶𝘁𝘆, a breach and attack simulation platform that turns one-off pentests into continuous, automated attack simulation. His current focus is AI-assisted offensive tooling, used as a force multiplier for skilled researchers rather than a replacement for them.
You’ll walk away with a realistic picture of what AI changes in software security and what it doesn’t, plus the questions to ask before your team trusts a model to make your code safe.
📅 November 20
📍 CEME Charleroi
🎟️ Get your ticket: link in the comments
AI AISecurity OffensiveSecurity
