Show Notes
At Pwn2Own Berlin 2026, a security researcher used agentic AI to help her win. The AI surfaced real, verified bugs, then wrongly called her winning bug “not unexploitable in practice.” Spoiler - it was.That uneven record is exactly what security leaders need to understand about the promise and limits of agentic AI.
In this episode, host Dustin Childs sits down with Valentina Palmiotti – better known as Chompie – who took home $70,000 for zero-days in the NVIDIA Container Toolkit and Red Hat Enterprise Linux. Drawing from firsthand experience, Chompie shares agentic AI’s proven value for defenders and why human expertise remains essential.
What we cover:
What agentic AI can genuinely do in skilled hands today, and where it still fails
Why your real exposure isn't new bugs, it's the widening gap before known ones get patched
How agentic AI is best viewed as a tool that frees skilled teams for higher-value work
Why stick around:
This is a real-world view of agentic AI beyond the hype: what security work AI can accelerate and the judgement calls it can’t make without human input.
Episode resources:
Pwn2Own Berlin 2026 — Day One results (TrendAI Zero Day Initiative)
Chompie on X
Dustin Childs on LinkedIn
Johnny Hand on LinkedIn
TrendAI on LinkedIn
About AI Security Brief
AI Security Brief is where security and technology leaders come to get ahead. Join us for real conversations on the AI trends, threats, and decisions that can’t wait.
About TrendAI™
TrendAI™ empowers organizations to lead the future of AI with proactive security designed to inspire innovation and eliminate risk. TrendAI™. AI Fearlessly.
More from AI Security Brief
Your AI initiative gets the green light. But now all the parameters and guardrails you built into your plan need to be executed. Who owns AI once it goes live? Who’s watching as AI use expands? And if the AI workflow fails, can anyone still run the process it replaced?
The “AI trust paradox” in cybersecurity goes like this: organizations invest in AI automation, then hold back from fully implementing it. Yet as attackers continue to use AI to move faster, defenders need to leverage AI to fix things as fast as it finds them.
In traditional IT, isolating a compromised endpoint can stop an attack. In operational technology (OT) environments, that same action could disrupt control of a pipeline, cause a rupture, or trigger environmental damage.
There's no silver bullet when it comes to AI security strategy, and treating one model, tool, or vendor as the answer can limit an organization’s ability to adapt.
Is your organization truly AI native, or did you just bolt AI onto existing infrastructure? Your answer could be an indicator to how much risk you’re carrying without realizing it.