Worlds: A Simulation Engine for Agentic Pentesting An 8B model went from blindly loading Metasploit modules to achieving Domain Admin on GOAD, trained entirely on synthetic data from our world model system.

We fine-tuned an 8B model to pop a GOAD domain…using only synthetic training data. No real networks. No frontier model distillation. Just a world model that simulates AD environments and generates realistic pentesting trajectories.

See how we did it: dreadnode.io/blog/worlds-...

Find @machinavelli.com and @velvethamm3r.bsky.social this weekend at #DistrictCon! DM us to link up, or catch Martin's talk on Sunday.

MLOps 🤝 AIRT

Building on MLOps principles is the way forward for AI red teaming. To showcase the impact of this process, we deployed automated adversarial attacks (TAP, GOAT, Crescendo) against Llama Maverick-17B-128E-Instruct.

Dig into the case study results here: dreadnode.io/blog/186-jai...

LLM-Powered AMSI Provider vs. Red Team Agent We built an LLM-powered AMSI provider and paired it against a red team agent, generating a unique dataset and a blueprint for detecting malicious code at execution time.

"Offense and defense aren't peers. Defense is offense's child." - John Lambert

We built an LLM-powered AMSI provider and paired it against a red team agent. Then, we wrote a blog about it: dreadnode.io/blog/llm-pow...

From Compute to Congress: The Cyber Layer Beneath the Genesis Mission As the Genesis Mission accelerates AI development across critical scientific domains, robust cybersecurity and adversarial testing must be foundational, not bolted on later.

✍ The White House just launched the Genesis Mission, a bold bet on AI-enabled science. But there's a layer we can't afford to treat as an afterthought: cybersecurity. (1/4)

dreadnode.io/blog/from-co...

AI as an Amplifier for Human Tradecraft: how scale can meet sharper intelligence.

What’s New: In their #LABScon 2025 talk, @dreadnode.bsky.social's Brad Palm and @machinavelli.com show how agentic AI can explore every analytical pathway — at speed and scale.

🧵 Tonight at midnight, CISA 2015 and SLCGP expire as Congress debates another shutdown.

We're witnessing a cyber identity crisis: threats don't discriminate between civilian and military sectors, but our defenses remain fragmented. What needs to happen immediately: 🧵(1/4)

From Compute to Congress: To Address CISA's Authority Gap, Reauthorize CISA 2015 and SLCGP Two critical cybersecurity programs—CISA 2015 and SLCGP—expire September 30, 2025. Learn why Congress must act now to preserve voluntary information sharing, fund state/local security, and operational...

Tonight at midnight, two critical pieces of cybersecurity legislation are due to expire: the CISA 2015 and the SLCGP.

Read @velvethamm3r.bsky.social's take on why reauthorizing these programs will help CISA transform into a integrated defensive command: dreadnode.io/blog/from-co...

Dreadnode is a proud sponsor of @sentinelone.com's #labscon25!

Heading to Scottsdale this week? Catch @machinavelli.com and Brad Palm's talk, Auto-Poking the Bear—Analytical Tradecraft in the AI Age, on Thursday at 2pm MT.

Or, shoot us a DM to find time to meet up onsite!

!!!

Incoming: Dreadnode paper drop from Shane Caldwell and the crew.

PentestJudge—Judging Agent Behavior Against Operational Requirements: arxiv.org/abs/2508.02921

Explore how we built an LLM-as-judge system for evaluating the operations of pentesting agents (inspired by PaperBench).

✍ After talking AI Action Plan on @cyberscoop.bsky.social, wrote up @dreadnode.bsky.social thoughts on implementation ➡️ dreadnode.io/blog/five-ta...

‼️ While we debate frameworks, adversaries build AI attack capabilities. We need: evaluation ecosystems, red teaming, and procurement standards.

Evals: The Foundation for Autonomous Offensive Security Learn how to build robust evaluations for autonomous red team agents that can perform Windows Active Directory operations. This blog covers action space design, programmatic verification, and measurin...

In our latest blog, Shane Caldwell breaks down the process of creating a fully integrated, self-verifying agentic system that can do modern Windows Active Directory red team operations, without human interaction.

Read it here: dreadnode.io/blog/evals-t...

Building and Deploying Offensive Security Agents with Dreadnode YouTube video by Off By One Security

Rise and shine! We're going live on Off By One with Stephen Sims this afternoon—meet us here at 11 AM PT: www.youtube.com/live/BzOmGw-...

At Military Cyber Professionals Association's #HammerCon event today? Hear Daria present on this topic at 2 PM in the Growing Innovations in Tech (GIT) track, or connect with the crew at our booth!

From Compute to Congress: Setting the Global Standard for AI Security Daria explores how the TEST AI Act and red teaming standards can establish American leadership in AI security—a winning policy roadmap from Critical Effect DC 2025.

In this edition of our From Compute to Congress policy blog series, Dreadnode Head of Policy Daria Bahrami explores how the TEST AI Act and red teaming standards can establish U.S. leadership in AI security: dreadnode.io/blog/from-co...

AI Red Teaming Case Study: Claude 3.7 Sonnet Solves the Turtle Challenge See how Claude solved a notoriously difficult AI/ML CTF challenge, going beyond pattern matching to genuine problem-solving under adversarial conditions.

Read @rad-ads.bsky.social's breakdown of Claude's attack sequence against the notoriously hard-to-solve "turtle" challenge: dreadnode.io/blog/ai-red-...

Introducing AIRTBench, an AI red teaming benchmark for evaluating language models’ ability to autonomously discover and exploit AI/ML security vulnerabilities.

Read the paper on arXiv: arxiv.org/abs/2506.14682

Open-source dataset and benchmark eval code repo: github.com/dreadnode/AI...

GitHub - vmsv/pivot2025-llmworkshop Contribute to vmsv/pivot2025-llmworkshop development by creating an account on GitHub.

Check out @machinavelli.com's "Build with AI" Rigging workshop from @pivotcon.bsky.social: github.com/vmsv/pivot20...

v3 of Rigging is out now. If you’re working with LLMs to build agents or run evaluations, check it out. We just added:

- Prompt caching for supported providers
- A unified tool system for function calling and fallbacks to xml/json parsing
- Native MCP integration

docs.dreadnode.io/open-source/...

Introducing our new blog series: "From Compute to Congress: Decoding AI Policy" by Dreadnode Head of Policy Daria Bahrami | Read the first post here: dreadnode.io/blog/from-co...

Are manual or automated attacks more effective when attacking LLMs?

We found that automated approaches achieve significantly higher success rates (69.5%) compared to manual techniques (47.6%).

More insights on LLM attack execution methods here 👉 dreadnode.io/blog/the-aut...

Strikes waitlist. Now open.

platform.dreadnode.io/waitlist/str...

[must have a Dreadnode account]

What's your take on the growing dominance of automated attacks and the implications for AI red teams? Here's ours— based on our analysis of 30 LLM challenges, attempted by 1,674 unique Crucible users, across 214,271 attack attempts: arxiv.org/abs/2504.19855

Dreadnode CEO Will Pearce on the ever-changing field of offensive AI security YouTube video by CyberScoop

@moohax.bsky.social joins @gregotto.bsky.social on CyberScoop's Safe Mode podcast! Tune in at the 10-minute mark for a discussion on how AI fits into the offensive security narrative and what it means for tooling and defenses: www.youtube.com/watch?v=ZReR...

Headed to RSA? Come meet the Dreadnode crew!

Whether you're looking for a private deep dive into our tech or want to hang out and talk offensive AI research, we'd love to connect.

Limited availability; Come and get it: calendly.com/tori-dreadno...

#BayArea #SanFrancisco #RSAC2025 #OffensiveAI

Hey, we know that guy! Catch Dreadnode's @radads.bsky.social on NASDAQ #TradeTalks alongside @bugcrowd.com CEO
@davegerryjr.bsky.social and NFL CISO @tomasmald.bsky.social.

Tune in for a candid conversation on the intersection of AI and cybersecurity: www.nasdaq.com/videos/ever-...

Will be talking about @dreadnode.bsky.social‘s great open-source rigging repo and how to build your own LLM workflows! Super excited!

🌭🔪⚾️🦥🔥🔄🤨🛜

8 new Challenges now live in Crucible: platform.dreadnode.io/crucible

These Challenges might look familiar… they first appeared at DEFCON 30 and were recently refactored for Crucible—enjoy! [Filter>Subject>DEFCON-30]

Dreadnode’s Policy Recommendations for the U.S. AI Action Plan Read Dreadnode’s AI policy recommendations for the U.S. AI Action Plan, which focuses on leveraging AI to protect America and attacking AI to find its limits.

New blog: Dreadnode’s Policy Recommendations for the U.S. AI Action Plan. Our response focuses on two critical strategies:

1️⃣ Leveraging AI to protect America
2️⃣ Attacking AI to find its limits

Read our complete response on the Dreadnode blog: dreadnode.io/blog/policy-...