Stanford Security Lunch

Abstract: By looking at the history of attacks on ChatGPT and related agentic surface areas, we discuss how the mental model for mitigation has evolved, and we focus on an ideology that helps reason about flaws in LLM systems.

Bio: (Adrian Spânu) Adrian Spânu is a Member of Technical Staff at OpenAI on Agent Security, where he builds defenses for AI agents that browse the web and occasionally get bad ideas. He focuses on shipping guardrails and observability that make agent behavior legible, controllable, and harder to abuse - especially when the web gets adversarial. He's here for prompt injection, exfiltration tricks, and turning ''lol'' into ''postmortem.'' (Thomas Shadwell) Some years ago, Thomas was given a medal by the UK government for hacking its tax system (writeup: ''how to hack the uk tax system''). Zero medals were produced throughout the rest of his career despite also hacking apple id (writeup: ''how to hack apple id''), producing at least 3 ways to pop calc.exe remotely in Steam and finding CVE-2022-41034, a 1-click remote code execution in VSCode. This forced him to give up the glamorous life of arguing with bug bounty triagers and settle down teaching computers self-defense and the meaning of Love at small research lab OpenAI. He won a DEF CON black badge in 2024 and is open to considering that a kind of medal. Thomas previously worked at Twitch, the UK National Cyber Security Centre, and ChatGPT predecessor ''Google''.