Offensive AI and AI security

From Alias Robotics, in Vitoria, Spain. An agent framework for offensive security, with a published paper and verified results in bug bounty programmes. It is the most serious European project in this space, it is open source, and it is two hours' drive from here. Worth following even if you never run it.

The paper. Read it for the evaluation methodology, which is what almost never accompanies tools of this kind: with no measurement protocol, any agent's numbers are marketing.

An autonomous multi-agent scanner that detects, exploits and validates. The validation stage is the interesting part: it is precisely where the rest of these projects fail and end up delivering noise for somebody to discard by hand.

Orchestrates the usual tooling — nmap, nuclei, ffuf — with a model that chains and prioritises but issues no verdict: validation comes from the tool, not the model. That is exactly the right principle, and what separates a useful assistant from a generator of invented findings.

The pioneer. Several projects now beat it, but its split between reasoning, generation and parsing remains the clearest explanation of why a bare language model does not perform a penetration test.

From the ipa-lab group. Deliberately minimal: its value is that you can read all of it in an afternoon, and there is peer-reviewed work behind it on Linux privilege escalation. The best entry point if you want to understand the loop rather than just run it.

To keep your bearings. A maintained census of a field that changes every few weeks. Use it as radar, not as judgement: inclusion is not endorsement.

The ATT&CK equivalent for artificial intelligence systems. It is the shared vocabulary: without it, two reports on the same model are not comparable and the client cannot aggregate anything.

A reasonable starting point for scope. Treat it as a taxonomy rather than a checklist: whoever walks the whole list and signs has audited the document, not the system.

From Microsoft. Automates generative AI red teaming and gives systematic coverage of adversarial prompt families. Good for breadth; depth is still manual.

From NVIDIA. A vulnerability scanner for language models, with hundreds of ready-made probes. It is the closest thing to an nmap for models, with the same virtue and the same flaw: it tells you what is there, not what it means.