6.1: In Chapter 1, we introduced the statistical model of AI solutions. In addition, AI solutions typically require large corpuses of data to be trained on.
a. How do these factors function as natural obstacles that hinder AI adoption for offensive AI efforts1?
💡 Offensive campaigns often rely on highly specific, novel zero-day exploits. Why does a model trained on millions of past, known vulnerabilities struggle to reliably predict a completely new attack path?
b. However, AI can still scale offensive operations. What tasks in a typical red team/penetration testing engagement can be scaled with the use of AI, and how? Go beyond our discussions in the book.
💡 Think about the repetitive grind of a penetration test, such as parsing thousands of subdomains, generating custom wordlists, or summarizing massive vulnerability scans. Can LLMs be used to accelerate tedious reconnaissance phases? Today, there are also start-ups that do AI penetration testing. What does that mean?
1 This assumption is beginning to be challenged with topics such as the Hugging Face breach by OpenAI in July 2026. Here, we must clarify that the discovery of bugs can also be a pattern-recognition exercise (in which case it becomes a significantly simpler exercise once a certain coding anti-pattern is discovered). It should be clarified that the scope of this question is looking more towards novelty in techniques required for offensive AI efforts and chaining vulnerabilities for meaningful security impact.
6.2: Phishing and vishing attacks have become more convincing, making them a bigger issue to deal with as the average layperson will more likely fall for such an attack eventually.
a. Do technological solutions exist to detect vishing attacks, as well as AI-enabled phishing attacks? Explore how they can be incorporated at individual and organizational levels.
💡 Consider tools that analyze voice biometrics for synthetic artifacts, or NLP engines that flag unusual urgency in an email. How can organizations deploy these seamlessly without disrupting daily communication?
b. How would attackers circumvent such solutions?
💡 If a detector relies on spotting poor grammar or robotic pacing, an attacker will try to fine-tune their generator to add intentional stutters and regional slang. Does this remind you of the arms race between malicious AI use and detection?
6.3: There are a variety of case studies on the topic of AI-enabled and AI-facilitated attacks.
a. Break down these attacks into the various tasks required for a successful offensive engagement.
💡 Consider the cyber kill chain.
b. Based on your understanding of different AI-enabled and AI-facilitated offensive tools (examples include Burp AI2), use threat models such as MITRE ATT&CK/CAPEC/ATLAS (TTP-oriented taxonomies) to understand the types of tasks AI helped within the offensive campaign most and least.
💡 What must an AI engine know to exploit different types of vulnerabilities? Are there certain types of vulnerabilities that are more complex to provide relevant context to AI engines?
c. Let us use the example of Claude Code Security in Discussion 5.1 (d). Claude Code Security validates findings in source code by the generation of adversarial examples. Would such a tool provide internal red-teamers with sufficient testing coverage to secure in-house applications developed with their own CI/CD pipelines?
💡 While generating automated adversarial examples is powerful, does it test the underlying business logic flaws? An example of a business logic flaw: a user could buy an item for negative credits.
d. How do your answers in (a), (b) and (c) link to the concepts of skill floor and skill ceiling concepts in this chapter?
💡 There are many known tasks that AI can be good at speeding up. These are considered “skill floor” tasks due to the highly commoditized nature of said tasks. Are there non-commoditized tasks, which require more bespoke skills?
2 Burp AI - PortSwigger. (2025). Portswigger.net. Link
6.4: AI systems can be abstract. MAESTRO highlights how a layered approach towards threat modeling enables us to understand AI systems better3.
a. Describe how each of the seven layers correspond to existing AI systems.
💡 It is probably easiest to begin this question by starting off with a multi-agent system in question. If stuck, refer to a threat model such as this as a starting point.
b. How does MAESTRO enable us to understand different types of AI systems, ranging from simple AI assistants to full-fledged agentic AI systems?
💡 By being able to ask questions about an AI implementation, it becomes clearer to distinguish between implementations such as API wrappers around a model hosted by a third-party, versus implementations that involve a greater deal of agentic AI engineering work.
c. Consider insights in Chapter 5 to comment on whether MAESTRO alone useful enough for threat modeling teams to provide the greatest amount of utility to other security functions?
💡 MAESTRO is helpful to decompose our understanding of a multi-agent system. But if you refer to Chapters 2 and 6, the mention of MITRE ATT&CK as a taxonomy of threats for infrastructure does not appear to include AI-specific threats. Are there such AI-first taxonomies?
3 Not to be confused with another ArXiv paper on MAESTRO, that also deals with multi-agent systems here.
6.5: Chapter 6 tries to provide some level of nuance in terms of cyber-offense operations where AI is involved.
a. Why is it difficult to distinguish between fact and fiction in the cyber-offense space?
💡 Cybersecurity vendors are highly incentivized to sell fear, often marketing minor AI-assisted attacks as catastrophic, autonomous "terminator" threats. Comment on how marketing hype obscures technical reality?
b. How can different members of the cybersecurity ecosystem help? Do the suggestions relate to the issue of our human “skill floor” and “skill ceiling”?
💡 Perform a stakeholder mapping of the cybersecurity ecosystem. Cybersecurity is a domain where there exists significant numbers of independent security researchers and bug bounty hunters. Are they useful in this effort? Repeat this thought for other stakeholders.
6.6: We mention Mythos for the first time in Chapter 64. Mythos was dubbed as the first frontier model that was too unsafe for public release due to its capabilities in exploiting security vulnerabilities.
a. Do you expect other models to catch up with Mythos in its capabilities?
💡 Why not?
b. Read Zero Day Clock in relation to Mythos. What does this demonstrate in terms of AI augmentation in cyber-offense?
💡 Think about why some of the recent vulnerability discoveries have been very big news, and whether they are correlated to actual losses suffered by businesses.
c. Comment on the Call to Action sections in Zero Day Clock.
💡 Read through some of the engineering points made in the Zero Day Clock. Point 3 is a good starting point.
4Project Glasswing: what Mythos showed us. The Cloudflare Blog, 2026. https://blog.cloudflare.com/cyber-frontier-models/.
6.7: Another way Mythos has been used is through the ExploitGym research mentioned in Chapter 65. ExploitGym illustrates the feasibility of using models like Mythos to turn security vulnerabilities into real attacks. The authors mention how ExploitGym is inherently dual-use.
a. How is a proof-of-concept such as ExploitGym usable by both offensive and defensive teams?
💡 Think from the perspective of training labs.
b. In ExploitGym, it is mentioned that GPT-5.5’s model does not rank significantly behind Mythos, producing working exploits beginning with a proof-of-vulnerability for 120 instances out of 898 instances of ExploitGym (Mythos ranked slightly ahead with 157 instances). What does this tell you about the progress of model development in cyber-offense capabilities?
💡 To extend this question, think about the role of open-source models like Kimi and GLM.
c. Would the performance difference between Mythos and GPT-5.5 suggest that general-purpose models such as GPT-5.5 may mean average consumers can also wield it for cyber-offense campaigns?
💡 We already have data on model benchmarks, since Mythos. Did the claims of Mythos age well?
5Wang, Z., N. Schiller, H. Li, S. S. Narayana, M. Nasr, N. Carlini, X. Qi, E. Wallace, E. Bursztein, L. Invernizzi, K. Thomas, Y. Shoshitaishvili, W. Guo, J. He, T. Holz, and D. Song. ExploitGym: Can AI Agents Turn Security Vulnerabilities into Real Attacks? ArXiv.org, 2026. https://arxiv.org/abs/2605.11086.