An AI Security Engineer on Speed, Scale, & Staying Human

AI WORKFLOW STORY #18

This AI Workflow Story features Chris, who is an AI Security Engineer and the voice behind ToxSec.

He explains how he uses AI to run end-to-end security reviews, dig through long research papers, validate findings through adversarial agent workflows, and a lot more things.

If you're a security professional trying to understand where AI actually fits into your workflow, a leader wondering whether your organization can handle what these systems produce, or simply looking for ways to turn AI into a genuine security asset, you'll find Chris's workflow very useful.

Chris' Introduction

I'm Chris. I've been working around software and security for about a decade now, but I actually got my start in the military. After I got out, I used the GI Bill to study software engineering at Arizona State University.

Somewhere along the way, I met a few people who were really into hacking, and I caught the cybersecurity bug from them. Once I finished my undergrad, I went to the University of Washington for my master's in cybersecurity while working for a defense contractor. After graduating, I was recruited by the NSA, spent quite a bit of time there, and eventually left for AWS.

AI security was a surprisingly natural next step. I had the software background, the security background, and suddenly these very strange systems showed up that combined both while breaking a bunch of the assumptions we had gotten comfortable with. That was pretty hard for me to ignore.

Inside Chris's AI Workflow

You describe AI systems as one of the most dangerous new frontiers in security. What changed that made you decide this was the area you wanted to focus on?

I actually got interested in AI philosophically while I was at ASU. I loved the bigger questions around intelligence and what these systems could eventually become, but I mostly let that interest sit in the background for a while.

Then, early in my time at AWS, I built an AI agent to help automate some security workflows. It worked well enough that an AI security team noticed what I was doing and eventually brought me over.

There is also a practical reason for that transition: finding people who understand both security and AI is surprisingly difficult. There are great AI engineers and great security engineers, but that overlap is still relatively small. I happened to stumble into it at exactly the right time.

What is the most valuable AI workflow you personally use in your cybersecurity research today?

Without giving away too much, the most powerful workflow I use is an agentic system that helps with end-to-end security reviews. It is closer to a swarm than a single agent, with different components specializing in different parts of the review.

From the human side, though, the workflow is surprisingly simple. It is almost point and shoot. Give it the target and let the agents do what they are good at.

The hard part comes afterward. A security finding is only useful if it is accurate, relevant, and properly contextualized for the team that actually owns the product. That last mile is still incredibly important. Finding something suspicious is becoming cheap. Understanding whether it actually matters is a much harder problem.

You use AI to research and organize your writing but not to generate your core ideas. Why have you chosen to draw that line?

I want the core ideas behind ToxSec to come from my actual work in security. I deal with AI regularly, so when a weird new architecture appears or I run into a problem that makes me stop and think, there is usually an article hiding somewhere inside it.

I've actually started dictating most of my articles out loud. It lets me get much more of my real voice into the writing, including some of the weird phrasing and side thoughts that disappear when everything gets polished to death.

I think keeping ToxSec human is becoming more important as AI gets better. Knowledge and writing throughput are not really the bottlenecks anymore. Anyone can generate 5,000 words. Having something interesting to say is the scarce part.

I absolutely use AI around that process, though. Every day I use it to search for interesting stories, papers, and developments, especially for the stories we cover on the podcast every Saturday. It is basically an absurdly overpowered RSS reader that can filter out a lot of the low-fidelity noise.

You mentioned using AI to dig through long research papers, chase citations, and fact-check claims. Which part of that process saves you the most time?

Pulling the critical information out of long research papers is probably the biggest time saver. I can work through dozens of papers, understand the basic findings, follow citations, and quickly figure out which ones are actually relevant to what I'm researching.

But there is an important second step. When something has really good, concentrated insight, I add it to my reading list and go read the full paper.

I think AI is an excellent sieve for information. It helps you move through an enormous amount of material and find the few things worth your limited attention. Once you find one of those things, though, there is still enormous value in sitting down and actually reading it.

What is one AI security threat that you think businesses are seriously underestimating right now?

Speed and scale.

I think a lot of organizations underestimate just how many more security eyes are about to be looking at their products, except many of those eyes are going to be agents.

Historically, you could release flawed software and sometimes have months before anybody interesting found the mistake. That assumption gets shakier when autonomous red-team systems can continuously enumerate targets, inspect code, test hypotheses, and hand the interesting stuff to stronger models or humans.

The economics of finding vulnerabilities are changing. Attackers do not suddenly have to become dramatically smarter. They can simply look at dramatically more things.

What is the biggest misconception people have about AI security today?

There is way too much doom-and-gloom coverage that treats AI security tools like omniscient hackers. They are not.

Yes, these systems can be incredibly good at finding vulnerabilities. They can also produce a ton of false positives, and they still struggle with understanding the whole product around a finding.

I've seen code that looks like a critical vulnerability when you inspect the snippet in isolation. Then you zoom out and realize an attacker would essentially need root-level access before they could even reach it. Technically interesting? Sure. Critical vulnerability? Probably not.

That context matters enormously. AI is getting very good at seeing the suspicious tree. Humans are still pretty useful when somebody needs to understand the forest.

You've spent your career breaking and defending systems. How is attacking an AI system fundamentally different from attacking traditional software?

Traditional software feels deterministic. There are rules. Inputs go through logic, logic produces outputs, and attacking it can sometimes feel like solving a very complicated math problem.

AI security feels different because probability enters the picture. You might have a great jailbreak that works beautifully eight times and then fails twice for reasons that are not immediately obvious. That feels extremely awkward when you come from traditional security.

And interestingly, the best person attacking an AI system is not always the most technically gifted person in the room. Creativity matters enormously. A lot of AI attacks feel closer to social engineering than writing a clever exploit script. You are manipulating context, language, trust, and interpretation.

That changes who can be good at breaking things.

What's one AI attack technique, such as jailbreaking, poisoning, or model manipulation, that you think security teams need to understand better?

I think the bigger idea matters more than any single technique: with AI, language itself becomes part of the attack surface.

And language is enormous.

There are effectively endless ways to frame an instruction, hide intent, combine context, or influence how a model interprets something. Over enough interactions, somebody is eventually going to find a context that gets through defenses you thought were solid.

So I think teams need to stop designing around the idea of a perfectly defensible model and return to one of the oldest ideas in security: defense in depth.

Assume the model will eventually do something you did not want it to do. Then ask the more useful question: what controls did we put around it so that when that happens, the damage is trivial?

What is one AI security workflow or technique you use that most cybersecurity professionals probably aren't using yet?

I have to be a little careful with this one, but I think we are still under-using specialized multi-agent workflows.

I see a lot of people take the smartest model they can access, hand it an enormous task, and say, "Do the security review."

I've had much better results breaking that work apart. Smaller agents can specialize in individual jobs, pass findings between one another, challenge each other, and escalate the difficult problems to stronger models or humans.

It starts looking less like one brilliant AI security engineer and more like managing a tiny security team that happens to run at machine speed.

The platform I've been using for this is not publicly available yet, but hopefully that changes soon.

When you use AI for cybersecurity research, how do you verify that the model hasn't introduced a false claim or misunderstood a technical detail?

There are two big things.

First, human review is mandatory before a report reaches another human. AI can dramatically accelerate the work, but it does not get the final word.

The second is something I've been experimenting with more: adversarial validation between agents. Instead of having the discovery agent grade its own homework, a separate agent on a different model is explicitly prompted to challenge the finding.

So if Claude says it found a vulnerability, maybe ChatGPT gets the report with one job: prove Claude wrong.

It turns out models can be wonderfully petty when you prompt them correctly.

More seriously, separating discovery from validation has been extremely useful for reducing hallucinations and false positives before a finding ever reaches the human reviewer.

What is one task you would never trust an AI system to handle without human review in cybersecurity?

Remediation.

This is where AI systems can turn a correct diagnosis into a spectacularly bad afternoon.

You can give an agent a vulnerable resource and tell it to fix the problem, and technically, deleting the resource may fix the vulnerability. Or it can generate a perfectly reasonable patch that closes the security hole and also breaks production.

The objective was satisfied. Everyone else is now screaming.

For now, I'm very comfortable using AI to generate remediation and triage suggestions. But when you cross the line from recommending a change to actually modifying production systems, I still want a human making that decision.

If a company is beginning to use AI across its business today, what is the first security question its leadership team should ask?

I would ask whether they actually have the capacity to deal with what these systems produce.

That includes budget. Security agents can consume enormous numbers of tokens when you run them across large environments. But the bigger constraint is human capacity.

Imagine deploying an AI security agent and waking up to 100 new security tickets. Great. Who understands them? Who validates them? Who decides which ones matter? Who works with engineering to fix them?

Generating more findings does not automatically make you more secure. If your AI system creates work faster than your organization can understand and resolve it, you have mostly built an extremely expensive ticket generator.

What's one thing you've changed your mind about regarding AI security over the past year?

The timeline.

I've been excited about LLMs finding vulnerabilities for quite a while. I expected these systems to get good. What surprised me was how quickly they got good.

If you had asked me a year ago when we would see some of the capabilities we are seeing now, I probably would have put them several years further out. My personal timeline has moved forward by something like five years, and the slightly ridiculous part is that I feel like I have to reconsider it every few months.

The direction did not surprise me.

The speed absolutely did.

What's one prediction about AI security that you believe most people will disagree with today?

I think humans are going to remain important in cybersecurity for quite a while.

There is a popular version of the AI story where the agents get good enough and the technical jobs simply disappear. I think what we are seeing looks more like a shift in leverage.

A lone security researcher can increasingly become the manager of a small team of AI researchers. One person can supervise reconnaissance, code review, validation, triage, and other specialized work that previously required far more human hours.

That may mean fewer people are required to accomplish a particular task. But historically, when we dramatically reduce the cost of doing something, we tend to discover a lot more of that something worth doing.

Security has never suffered from a shortage of things we should probably be checking.

So I'm actually pretty optimistic. I do not think the security engineer disappears. I think the security engineer gets a much bigger team.

If this story helped you, ️

👏 Clap • 🔁 Repost • 💬 Comment • 📤 Share

This story is published on AI Center. If you enjoy practical AI tips, subscribe to our newsletter.