We're Gonna Need a Bigger Lab: AI-Assisted CVE Hunting from Repo to Real World

AI is changing how vulnerability research gets done, but most of the conversation stays theoretical. This talk follows two researchers down two different paths to real CVEs, using AI as a working partner at every stage.

Brayden covers the open-source side: how he picks open-source projects that are worth researching, how he uses AI-assisted code review to understand unfamiliar codebases and spot likely bugs, and how he turns those candidates into working proofs of concept.

Phil covers the closed-source side, starting from a real penetration test that led to a CVE in VMware. He shows how AI helped him reverse engineer the target and build a PoC, and how he validated it in a local lab before it went near a production environment.

The two cases together show where AI speeds up research, where it confidently gets things wrong, and how to keep a human in charge of validation. Attendees will leave with practical workflows they can apply to their own targets, whether they have the source code or not.