Time Table

In recent years, threat actors have been observed abusing AI to carry out autonomous attacks. The speed and scale of AI-driven attacks have made the use of AI indispensable on the defensive side as well. However, while defenders have made progress in automating detection and response with AI, these approaches merely react to attack signals; approaches that actively exploit the fact that the adversary is an AI have not been sufficiently explored. In other words, it is possible to turn the fact that the attacker is an AI against it, with countermeasures that act on its decision-making process.

This research aims to realize “Antigent,” an agent that dynamically counters AI that conducts attacks autonomously. The speaker has experience developing and testing AI from the attacker’s perspective, including AI for penetration testing and AI-driven malware, and applies this understanding of the characteristics of offensive AI to the design of defensive AI.

In this talk, we will demonstrate, through live demos, an approach in which defensive AI counters offensive AI. For the offensive AI, we use an agent environment that anyone can build (open-weight LLMs and publicly available penetration testing skills), and for the target to be defended, we prepare a custom-built test environment. Antigent infers the offensive AI’s next action from observed command and behavior patterns, dynamically poisons the inputs used in its decision-making to derail its action plan, and aims to contain and neutralize it within the organization. We will also show that Antigent itself can become a new target for attackers, and present the red-teaming perspectives that are essential before putting it into production.

Through this talk, attendees will understand the effectiveness and limitations of the approach of dynamically responding by acting on the decision-making of offensive AI, design guidelines for implementing it in a self-contained way within their own organization, and the key points of how to verify the safety of Antigent itself before deploying it in production.