Lessons from Building Offensive AI for Multi-Layered Codebases

AI tools can find the obvious bugs. They follow the most suspicious-looking signal until it checks out, then move on. The boring parameter — the one that actually leads somewhere — often gets skipped. This talk breaks down the structural reasons AI agents fail at exhaustive vulnerability discovery, and what a better approach looks like.