8 Minutes to Admin. We Caught It in the Wild. Welcome to VibeHacking

8 Minutes to Admin: How VibeHacking Caught a Real AI-Assisted Intrusion in the Wild

Speaker: Sergej Epp, CISO, Sysdig

Conference: [un]prompted 2026 — The AI Security Practitioner Conference

Date: March 4, 2026, San Francisco

Watch on YouTube: https://www.youtube.com/watch?v=xCtcQkJBReQ

Reading time: ~8 minutes

TL;DR: Sysdig CISO Sergej Epp presented a real incident in which an AI-assisted attacker went from stolen credentials to full AWS admin access in 8 minutes — and got caught, loudly, because AI-generated attacks leave forensic artifacts that defenders can learn to recognize. His framework: attackers have "an accent," and speed makes it louder. Start listening.

"The Faster They Go, the More They Confess"

▶ Watch: Introduction and the core paradox (0:00)

Sergej Epp opened with a provocation that cut against the prevailing narrative of AI-powered offense: yes, AI accelerates exploits, reconnaissance, and lateral movement. But that acceleration also makes attacks louder. "The faster they go, the more they confess. Let that sink in."

This isn't wishful thinking. Epp presented real evidence from a November 28th intrusion caught entirely in the logs — including the attacker's choice of AI model, their server naming conventions, and their hallucinated AWS account IDs.

The Incident: 8 Minutes, Full Admin

▶ Watch: The incident breakdown — 0 to admin in 8 minutes (0:30)

The incident began classically: S3 bucket credentials were compromised out of a Rack database. Within 8 minutes, the attackers had full administrative access to the AWS environment. Sysdig captured everything — all the CloudTrail logs, all the SusCo logs.

The trail of evidence was remarkable for what it revealed about AI involvement:

The Lambda function. The attackers tried to execute a Lambda function three times within a single minute. The code included comments in Serbian — a language not typically found in enterprise codebases — and showed clean exception handling and multiple user account logic. They succeeded on the third attempt.

The hallucinated account IDs. When attempting lateral movement via AssumeRole, the attackers tried account IDs consisting of ascending and descending number sequences (e.g., 123456789012 and 210987654321). "Do you recognize the pattern? If you ask your favorite AI to generate example AWS account IDs, that's what you get." These are training data artifacts — the model learned from sample data, not real AWS environments.

The confession in the session name. The attacker's role session name in the logs read claude-session. "They were confessing without even knowing it."

The GPU naming debacle. The attackers tried to spin up eight high-end GPUs at approximately $50 per hour each — and named the instances "Steven GPU Monster." The name "Steven" appeared multiple times across the logs as a server naming convention. "If you know a Steven, out of Serbia, who is doing a lot with Claude, let us know. We can help with OPSEC."

The hallucinated GitHub repo. The LLM tried to clone github.com/anthropic/training-scripts — a repository that doesn't exist. Whether hallucination or confusion, the repo simply wasn't there.

The timeline showed a distinctive rhythm: 8 minutes of machine-speed activity, then roughly 50 minutes of silence, then another burst. "That's a typical prompting behavior pattern. You prompt, the model executes successfully, and then you wait for its output. And they had multiple attacks running in parallel."

▶ Watch: Timeline pattern and activity bursts (4:01)

The Second Actor: Blockchain-Enabled AI Malware

▶ Watch: The blockchain-enabled AI hacker becomes real (4:30)

The meme of the "blockchain-enabled AI hacker" became real last year, Epp noted. Just days after the first incident, and 24 hours after the React2Shell (CVE-2025-55182) vulnerability was published, Sysdig caught a second campaign. The malware sample came with:

• Five persistence and evasion mechanisms
• A local runtime environment with no external JIT dependencies
• Self-patching capability on the fly
• Multiple payload delivery mechanisms, all produced within minutes

No smoking gun confirms AI generation — but the code structure, comment style, and the sheer velocity of production strongly suggest it. Epp offered to share the files with anyone from OpenAI or Anthropic working on watermarking techniques.

What made this campaign particularly difficult to disrupt: the attackers stored their C2 infrastructure on an Ethereum smart contract. "You can't seize it. You can't block it. You can't take it down" — there's no registrar to contact, no domain to sinkhole.

The slide deck captured this as a structural property of AI-assisted attacks: speed generates artifacts that can't be removed; blockchain-based resilience creates a permanent forensic record; scale produces an incoherent, identifiable campaign signature. All three optimize for attack while simultaneously confessing to defense.

VibeHacking Defensively: The Sinkhole Response

▶ Watch: Fighting back with vibe hacking (6:02)

Sysdig's response was itself AI-assisted. They built a dedicated custom malware sinkhole and assessment environment to track the threat actor in real time — using a prompt: "Build me an automated sinkholing and malware assessment environment for this live campaign (+ CONTEXT)."

The system pulled out all the C2 addresses via RPC calls, understood the content, identified the primary C2, loaded and deobfuscated payloads, analyzed behavior, versioned the malware, and performed trend analysis on how the code was evolving. "Malware analysis is changing — it can be fast and effective if you fight back with vibe coding."

The Mental Model: Who Owns the Verifiers Wins

▶ Watch: The verifier problem framework (8:02)

The theoretical backbone of Epp's talk was what he calls the "verifier problem," derived from work by Jason Wei at OpenAI on how AI becomes effective at different tasks. The key insight: AI accelerates tasks in proportion to how cheaply the result can be verified.

Epp mapped security domains onto a spectrum of verification cost:

• Offense verifies cheaply. Did the exploit work? Did the shell pop? The result is deterministic and instant.
• Defense verifies expensively. A SIEM produces suspicious information every minute. Determining whether something actually happened — or whether a detection is real — is hard to verify in real time.

The critical asymmetry: offense does not verify whether its actions match the target environment. AI attackers don't know your GitHub repos. They don't know your account naming conventions. They don't understand how your infrastructure was deployed.

"This is where defenders have a structural advantage. We know our own environment."

Epp illustrated this with an analogy: "I'm German. If I speak slowly, some people might not hear the accent. But if I speak fast, it comes out. The AI, trained on public data, has an accent based on what it learned. And when it moves fast, that accent gets louder."

The slide deck framed it directly:

WHO OWNS THE VERIFIERS WINS THE AI RACE

Offense verifies: "Did the exploit work?" → Cheap ✓

Offense does NOT verify: "Does this match the target environment?" → Expensive ✗

Defense CAN verify: "Does this match OUR environment?" → Cheap ✓

Four Defensive Controls

▶ Watch: Four practical defensive controls (12:03)

Epp distilled the framework into four actionable controls, none of which require special vendor technology:

1. Weaponize Time.

Fresh credentials performing admin actions are suspicious. Set alerts on: new account created from unknown source + privileged action within minutes. "We've done this with DNS for years — new domain names are always suspicious. The same logic applies here." The attacker cannot change the timestamp. Your CI/CD, SSO, and credential rotation have known "birth certificates." Theirs don't.

2. Trap the Knowledge Gap.

Deploy honey tokens — fake identities and credentials that follow your company's actual naming conventions, indistinguishable from real assets. "Honey tokens are the most deterministic tool in the defender's arsenal. If you don't have them deployed today, you're leaving detections on the table." At machine speed, AI will touch them. Zero false positives. Forever.

3. Enforce Your Accent.

Build detection rules around the gaps between your real environment and what an outsider would guess. Alert when session_name ∉ naming_convention. Alert when assume_role_source ∉ known_federation_providers. Your ecosystem is organic, internal, and years in the making. Training data cannot reproduce it.

4. Validate Your Topology.

Alert when target_account ∉ org_account_list. Alert when git_clone_target ∉ org_repo_list. "The AI hallucinates infrastructure. You know what's real. One lookup. Instant." The 8-minute incident was caught partly because the attackers tried to AssumeRole into account IDs that simply didn't exist.

▶ Watch: Honey tokens in Q&A (14:03)

In Q&A, Epp confirmed that honey tokens are increasingly important precisely because of AI-driven attack speed. "The most successful vendors out there are all using honey tokens — even EDR solutions rely on them to detect enumeration. If an attacker wants to be silent, they'd need to start enumerating slowly and carefully. Honey tokens deployed broadly are becoming key to catching that."

Notable Quotes

"The faster they go, the more they confess. Let that sink in." (0:00)

"They were confessing without even knowing it." (on the claude-session role session name, 2:00)

"The attacker's AI has an accent. Speed makes it louder. Start listening." (slide, closing)

"You can't seize it. You can't block it. You can't take it down." (on blockchain-based C2, 4:30)

Key Takeaways

• AI-assisted attackers move at machine speed and leave machine-generated artifacts: hallucinated account IDs, predictable session names, sequential naming conventions, and non-existent GitHub repos.
• The verifier asymmetry is the core structural advantage for defenders: offense can cheaply verify whether an exploit worked, but cannot cheaply verify whether its actions match the specific target environment.
• Honey tokens are the highest-ROI defensive control for catching AI-speed attacks — at machine speed, the attacker will touch them.
• Blockchain-based C2 infrastructure represents a genuinely new class of problem: once deployed, it cannot be seized or sinkheld by conventional means.
• None of the four defensive controls require special technology — existing SIEM and cloud detection tools are sufficient for implementation.

Slides reference: Slides PDF available (2026-04-04-D2-S1-9-38-8-Minutes-to-Admin-We-Caught-It-in-the-.pdf). Key slides covered the 8-minute timeline visualization, the "OPTIMIZES FOR / CONFESSES" matrix, the verifier problem framework, and the four defensive controls with detection logic.