Black Hat USA 2025 | Hillai Ben Sasson & Andres Riancho, Wiz

Clips
More from Black Hat USA 2025

Hillai Ben Sasson

Senior Security Researcher

Wiz Vulnerability Research

Andres Riancho

Cybersecurity Researcher

Wiz Vulnerability Research

play_circle_outline Introduction of guests from Wiz and their background in cybersecurity and AI research.

play_circle_outline Discussion about the shifting definitions of AI security among different stakeholders.

play_circle_outline Guarding the Cloud: Addressing AI Model Attacks and NVIDIA's Container Escape Vulnerability in Major Corporate Structures

play_circle_outline Emphasis on security teams evolving their relationships with other departments in organizations.

Info
Transcript

Hillai Ben Sasson & Andres Riancho, Wiz

Hillai Ben Sasson

Senior Security Researcher Wiz Vulnerability Research

Andres Riancho

Cybersecurity Researcher Wiz Vulnerability Research

At Black Hat USA 2025, Wiz security researchers Hillai Ben Sasson and Andres Riancho join theCUBE’s Jackie McGuire to unpack their latest AI vulnerability discoveries and share candid insights from the show floor. The discussion dives into how AI security is often misunderstood, why it is fundamentally an infrastructure security challenge and how new technologies like Model Context Protocol (MCP) are repeating old API security mistakes. Sasson and Riancho reveal details of recent research targeting AI model hosting platforms and open-source AI infrastructure,... Read more

explore Keep Exploring

What are the backgrounds of the speakers and how did they come to work at Wiz? add

What is the definition of AI security and how does it relate to infrastructure security? add

What research has been conducted regarding AI vulnerabilities, particularly in relation to cloud services and open source libraries? add

What changes have been observed in the attitudes toward AI usage and security practices within enterprises over the past year? add

bolt Powered by CUBE AI

Hillai Ben Sasson & Andres Riancho, Wiz

search

Jackie McGuire

>> Hello, CUBE community. Welcome back to Black Hat 2025 at the Mandalay Bay in Las Vegas, Nevada. I'm Jackie McGuire, your practice lead and principal analyst for security and favorite security media host, and I am thrilled to be joined by two of my favorite people from Wiz today. We have Hillai Ben Sasson and Andres Riancho. Thank you, gentlemen, for joining us.

Hillai Ben Sasson

>> Thank you.

Andres Riancho

>> Thank you.

Jackie McGuire

>> Did I get the pronunciation right?

Hillai Ben Sasson

>> You nailed it, perfect.

Jackie McGuire

>> It's a miracle. All right. So it's been a handful of days of Black Hat, so we're all running on fumes right now, so everybody be gentle. But I would love to start out with, you guys have done some really, really awesome things in the last couple of months, and I want to start out with maybe both of you give a little introduction and how you ended up at Wiz, and then we'll go into Black Hat stuff.

Hillai Ben Sasson

>> Right. So hi, I'm Hillai, and Wiz is actually my first job, believe it or not. But I've always been into cybersecurity, whether it was a hobby as a little kid, we're not going to talk about the things that I did when I was a little kid, but you can believe me, but it's always been a hobby. I actually got to Wiz with some shared friends that I met back in the Army, they pulled me in. I was like, yeah, that sounds amazing, I'm in, and Wiz has been amazing ever since. We're doing some very interesting research with some great people.

Jackie McGuire

>> That's awesome. Andres, how about you?

Andres Riancho

>> I've been in cybersecurity for a couple of decades, so I'm a little bit older than my friend here.

Jackie McGuire

>> Same, same. It's okay, it's all right. We're seasoned, that's all.

Andres Riancho

>> Yeah, of course, of course, more experienced.

Hillai Ben Sasson

>> Like fine wine.

Jackie McGuire

>> Yeah, exactly.

Andres Riancho

>> I have an application security background, then I transitioned into cloud security, and now we have been doing a little bit of AI research in the last six, nine months. So that's my background, and I joined Wiz almost a year and a half ago.

Jackie McGuire

>> Awesome. All right. So I know you guys are going to talk a little bit about some research and stuff that you've done around AI, but I thought we'd talk about Black Hat. So I'm sure you've had lots of overstimulating conversations, I am about all peopled out this week. But what are the key themes that you've pulled out in your conversations with customers, with other vendors? Because I think the sentiment is definitely shifting. So what are some of the more interesting things you've heard?

Hillai Ben Sasson

>> So I think that everyone really likes to talk about AI security, but I think that everyone also has a different definition of AI security. I think that it's all over the place and everyone has a different definition for what AI security means for them. I think that what we've zeroed in on when we tried to figure out what AI security really is with examples is that AI security is just infrastructure security. It's not some groundbreaking new thing that everyone invented from the ground-up, it's the same sort of thing.

Jackie McGuire

>> It's Python and APIs, right?

Hillai Ben Sasson

>> It's Python, but no, this time it's not an API, it's an MCP.

Jackie McGuire

>> An MCP.

Hillai Ben Sasson

>> A totally different thing, but it really is the same thing. All the mistakes that people did when they introduced APIs, now they're doing them again when they're introducing MCPs. So I think it's this circle of life of this new technology emerges, but the same patterns of mistakes, same misconfigurations, same everything that they did in the previous iteration of new things.

Jackie McGuire

>> Well, DNS serves as an example, they'll still be getting it wrong in 30 years, so it's okay.

Hillai Ben Sasson

>> It's always DNS, it's always DNS.

Jackie McGuire

>> What about you, what do you think are some of the more interesting things that you've pulled out?

Andres Riancho

>> Yeah. We've seen a lot of companies trying to add AI to their offerings, and in some cases, at least from my personal perspective, it feels forced, and in many other cases, it's the most amazing use of LLMs and AI that we can have and see. But with time, I believe that some of those forced use cases are going to tend to disappear.

Jackie McGuire

>> Yeah, yeah, I definitely... I'm not going to call anybody out, but there are a handful of companies over the last six months that have actually fully rebranded to AI companies and-

Hillai Ben Sasson

>> While they're not doing anything real with AI.

Jackie McGuire

>> Yeah. And so, you weren't alive then, but it's like during dot-com boom, right, very-

Andres Riancho

>> And blockchain also. At some point in time-

Jackie McGuire

>> Yeah, oh God....

Andres Riancho

>> everyone wanted to use blockchain. But actually, our relational database was going to solve the same issue, so yeah.

Jackie McGuire

>> Yeah. I always lament the fact that something monetary was what that ended up being used for, because I always thought that blockchain was going to be fundamentally groundbreaking for distributed compute. I have all these smart devices in my house that each have some level of compute, send high-latency transactions to me and use my house as a mini data center, but no, we'd rather make meme coins.

Hillai Ben Sasson

>>

Jackie McGuire

>> Yeah, yeah. All right. So we're gearing up for Devcon next, and that is one of my favorite conferences, because that's where the real hackers are and where you learn about the mischievous kids, like someone on this set who are trying to break things. So you guys have actually been trying to break some things lately, and I know you've released some research on hacking AI and the things that you've learned from that, so do you want to give us a high-level overview of what that research was?

Hillai Ben Sasson

>> Right, yeah. So during the past, I think, year or two, we started really diving into this AI vulnerability research thing, trying to figure out what it even means, because like I said, everyone talks about it, no one finds it out. So we started out by doing a lot of AI cloud services, like all these platforms that people use in order to host AI models, like Hugging Face and Replicate and all these kind of platforms that all the big players use to host their models, and we were able to do malicious model attacks, deploy malicious models into the platform, and then move laterally and figure out how to access all the other customers' private models and data sets and everything. We're talking about real customers, like OpenAI and xAI and Google and Meta, everyone uses these platforms. So this was the first iteration of this. And then, the second iteration of this, which is the newest iteration of this, is all the things that are AI infrastructure, all the open source projects that everyone builds AI on. What we presented just presented right now at Black Hat was research that we did on a library developed by NVIDIA, an NVIDIA open source library, we found a container escape vulnerability. Every container built with this library, we were able to escape out of. And the thing is that every single cloud provider was vulnerable to this, everyone builds their stuff on top of this library, so this is one vulnerability to hack every single cloud provider. This is just one example, this is what we found. What else are people going to find?

Andres Riancho

>> And the impact is huge, because once you can escape the container, you have access to the workloads for other tenants that are running inside the same host.

Jackie McGuire

>> Load balancers?

Andres Riancho

>> And potentially, you can also do privileged escalation on the network and get access to the clusters, if it's a Kubernetes cluster, you can get access to that. And we were able to prove exactly this scenario on a couple of vendors, and those were our new case studies that we showed that.

Jackie McGuire

>> I think one of the sentiment changes I saw from last year to this year is this, okay, everybody in our enterprise is going to be using AI whether we want them to or not, and we need to shift from security is always the no team to the, hey, we noticed that you just spun this thing up, maybe here are some best practices to secure these workloads. I think I've seen this shift, and I think it's a positive thing, because historically, what's kept security teams from being as effective as they could is not necessarily the most healthy relationship with the rest of the enterprise and their internal customers. So I think we're almost forcing security teams to be better diplomats now to secure AI, because if you tell people you can't use it, they're just going to use it on their personal device, and you can't monitor data exfiltration that somebody's looking at their work laptop and typing into their phone, so I think that we need to adopt a more open-minded approach as security professionals. So in your research, the NVIDIA container escape, for example, that is somewhere with NVIDIA, there's an inherent trust there, and so you can almost weaponize that trust, because to your point, it's become very ubiquitous because it's a very large company. So how do you think about that from a security perspective, the balance between just inherently trusting proven companies and technology, and understanding that even those companies are not always getting it right?

Hillai Ben Sasson

>> Right. So like you said, NVIDIA is ubiquitous, everyone uses NVIDIA. This is how we got this research really is we started thinking, okay, what's the one common denominator between all those AI providers and AI workloads and steps in AI development, and the one common denominator is NVIDIA, they're always there. Everything runs on NVIDIA GPUs, everyone uses these NVIDIA libraries to work with NVIDIA GPUs. So once we figured that out, the steps were almost simple. So I think that it's good, it means that there's innovation and NVIDIA is building great products, but also, at the same time, nothing can be trusted blindly. So the NVIDIA security team were very responsive, they fixed those issues, and as long as you kept your infrastructure up-to-date-

Jackie McGuire

>> Everybody does that immediately, everybody patches right away, everybody updates right away.

Hillai Ben Sasson

>> It's important, it's important updates. Not sure, I'm not sure that's true, but you should patch.

Jackie McGuire

>> One of the difficulties, I think, is... So I actually came into security through data science, so I went to a data science bootcamp, they taught me how to write Python, and it was basically like, open your Jupyter Notebook, import and install anything you could possibly think of that you may ever want to use. And then, nobody ever told me not to hard code API keys, nobody ever told me not to... There were so many things... I didn't even know that typosquatting was a thing. It's like if you can pip install it, it's safe. So I think there's this conflict between everybody's trying to use these things, with vibe coding and all these things, and I think every CEO out there is drooling over the potential for exponential growth and exponential acceleration of productivity, but there's this flip side.

Andres Riancho

>> I believe that the... Sorry to interrupt.

Jackie McGuire

>> No, no, yeah.

Andres Riancho

>> The flip side here, I believe, is maturity. So we have Apache, we have Nginx for two decades now, and all of the vulnerabilities, or most of the vulnerabilities and trivial bugs that were in that software were already discovered, fixed and patched. NVIDIA Container Toolkit and many other software components, infrastructure components that are used for AI, have two years, three, maybe four, so they still need to mature a lot, and they keep adding features at a rate that is incredible, it's great for product development, it's not great for security. But at some point, when all of those components mature, we're going to have a much safer AI space.

Jackie McGuire

>> So I know your job is not to give CISO advice, but if I'm listening to this and I'm a CISO of, say, a mid-market company, I don't have a seven-figure security budget, what are the first couple of things that you think people leading security teams should be thinking about with regard to these types of vulnerabilities? Obviously, keeping up with patching and updating is important, but beyond that, are there the first couple of things you would think of that start here, because this is the most basic hygiene?

Hillai Ben Sasson

>> So I would say that one of the things that's really important to keep in mind is that this is experimental technology. The innovation is in a insane rate, I don't think we've ever seen any innovation in any field that's so fast. I think GPT-5 came out like an hour ago, right?

Jackie McGuire

>> Yeah, yeah. One of the colleagues was like, "Hey, did you read the news about GPT-5?" I'm like, dude, I had six shots of espresso and ran here with my hair on fire, I haven't read anything.

Hillai Ben Sasson

>> Fresh off the press. So everything is going on so fast, all these people are innovating to incredible levels of everything, really, and it's important to keep in mind that this is still in the experimental phase, it's still very new. These versions come up so fast and people are coming up with new technologies so fast. A couple of months ago, it was MCPs. Now, people are talking about agentic AI. The cycle is so, so fast, so while it is important to keep up with this new technology, it's important also to keep in mind that it is experimental, mistakes are going to happen, people move fast and break things. So it's important to isolate, to figure out if this use case, if I should plug that in, plug this new experimental technology into the most sensitive part of my environment, or if I should maybe isolate it better, try to figure out the use cases, try to figure out how to isolate this very new, experimental, shiny new thing and isolate it from my important stuff.

Jackie McGuire

>> So give people safe places to do risky things.

Hillai Ben Sasson

>> Exactly.

Andres Riancho

>> The basics are still very important. I'm going to implement this MCP, should it be exposed to the internet? Yes, no? That's a question that in many scenarios, people don't ask themselves. They're going to ask the same question for an API or for a web server when they are doing the implementation of those. I think that the basic, if you do infrastructure security well, you're going to cover 80% of what can go wrong with AI implementations inside the company. Something similar happens with employees using LLMs to do their work every day, if you already have some kind of solution that's going to prevent data leaks, most likely, that solution is going to also be able to intercept the traffic to the LLM provider, and you should have that.

Jackie McGuire

>> All right. So unfortunately, the answer is go back to the basics and maybe make sure you're already doing things correctly, because that'll solve a lot of these issues.

Hillai Ben Sasson

>> Not a very sexy answer, right?

Jackie McGuire

>> Yeah, no, it's not, but I think unfortunately, that's the reality. The majority of breaches we see, the amount of times we see things that are just 100% bad security hygiene, employees reusing personal passwords that have been stolen at work. Humans are fallible people and agents are fallible things too, so I think it's not a great answer, but Wiz can help, I assume, so luckily, you have expertise. And that's the other thing, I think, that for me is huge is as security teams, we've done multiple surveys that show that the smaller a company is, the more likely they are to think they should manage their own security, which is bizarre and counterintuitive, but I think they feel like they don't need to hire an outside function, because I'm just a... Blah. And it used to be that if you're not huge, no, you're not going to be a target. But these days, where you can automate attacks, everybody's a target, because you're just crawling to find open anything where you can get in. So for me, it also goes back to just you need to be aware of the fact that it's not just if, it's a when, because the rate of change in attackers has also been exponentially increased. We were just talking to Cloudflare yesterday, where they were like, they'll just get in and you're just on a list of places that have already been compromised, you don't know it, and it's just a fact of waiting for them to get to you on the list. So call in professionals, because you can't scale your three person security team when things catch on fire and still do the day-to-day work of your security team, so call in professionals like Wiz, call in your MSPs, call in your MSSPs and ask for help, because you really need it.

Hillai Ben Sasson

>> True. I think, obviously, security products should always be the way you're trusting security, but also I think that the importance of collaborating with security researchers, whether it's the big ones have bug bounty programs, but even if you're a small company that couldn't have it, you should still be open to receiving reports from good people who want to say, "Hey, you have an open Jupyter Notebook, you have this thing, you have that thing, you should take care of it." So yeah, not all of the small companies have that mindset in mind, and then when they don't have that mindset, the first person to report it to them will want extortion money instead of saying, "Hey, I'm a good guy, you should fix this."

Jackie McGuire

>> Yeah, awesome. Well, unfortunately, we're out of time. I would love to go longer, but Hillai, Andres, thank you so much for joining us. We would love to have you back again, this was great.

Hillai Ben Sasson

>> Thank you.

Andres Riancho

>> Thank you.

Jackie McGuire

>> Thanks. For theCUBE, I'm Jackie McGuire. We'll be back shortly with more interviews and amazing content from Black Hat 2025 at the Mandalay Bay in Las Vegas, Nevada. Stay tuned.