About
Articles by Matthew
Activity
2K followers
-
Matthew Schwartz shared thisThe recording from my Black Hat USA 2026 session is now available. Velocity Without Assurance: Evidence-Backed Trust for Agentic AI Systems As agents gain autonomy, invoke tools, and cross authority boundaries, point-in-time testing is not enough. We need a way to continuously prove that systems are operating within their intended authority and constraints. That is the focus of Provable Assurance: moving from assumed trust to evidence-backed trust. A passing demo is not evidence. The evidence package is. 🎥 Recording: https://lnkd.in/e-aQWQ66 📄 White paper: https://lnkd.in/exib6Fe2 💻 Code audit demo: https://lnkd.in/ejQ8rzkE #BlackHat #AISecurity #AgenticAI #ProvableAssurance #SecurityEngineering
-
Matthew Schwartz shared thisGreat job Nur Gucu, really insightful work on MalSkills. A fascinating look at the emerging security risks around AI agent skills. Worth a read, especially around DEF CON 34: https://lnkd.in/eySR9Sca #DEFCON34 #AIsecurity #Cybersecurity
-
Matthew Schwartz posted thisThank you to everyone who attended my Black Hat session sponsored by Primary , Velocity Without Assurance: Evidence-Backed Trust for Agentic AI Systems. I appreciated the questions and conversations that followed, particularly around how we establish trust as agents gain greater autonomy, invoke tools, cross authority boundaries, and operate in environments that continuously change. For those who asked for the supporting material: 📄 Provable Assurance for Agentic Systems white paper: https://lnkd.in/exib6Fe2 💻 Provable Assurance Code Audit Demo: https://lnkd.in/ejQ8rzkE One of the central points from the discussion: A passing demo is not evidence. The evidence package is. Thank you again to everyone who attended and contributed to the discussion. #BlackHat #BlackHatUSA #AISecurity #AgenticAI #ProvableAssurance #SecurityEngineering
-
Matthew Schwartz posted thisIf you are at Black Hat and looking for a preview of some of the concepts behind my Provable Assurance talk, I will be speaking at the Primary booth tomorrow at 1700 on Velocity Without Assurance. The discussion will focus on a simple problem: AI is increasing the velocity at which we can build and deploy systems, but our ability to verify and establish trust in those systems has not increased at the same rate. I will also be speaking at the booth again on Thursday on Zero Trust in an Agent World, looking at how Zero Trust changes when software can reason, invoke tools, delegate authority, and take actions. #BlackHat #AgenticAI #AISecurity #ZeroTrust #ProvableAssurance
-
Matthew Schwartz shared thisI’m looking forward to Black Hat! If you’re attending, please stop by and say hello, especially if you have any questions or want to continue the conversation after my talk. I’d be grateful to connect.Matthew Schwartz shared thisCheck us out at Black Hat USA, Booth #4215, Mandalay Bay. This will be Primary's biggest week yet. Two stage talks from our own team. And two nights at the Bellagio you'll genuinely regret missing: Cocktails & Conversation at the Bellagio Chairman's Suite with former White House cybersecurity czar Richard Clarke and Peiter "Mudge" Zatko, then Primary After Dark takes over The Pinky Ring by Bruno Mars. Get the first public look at our Unified Zero Trust Control Plane, the system we've spent years building to govern what people and AI agents can see, decide, and do, in real time. We're not showing up. We're arriving. Control what's next. primary.ai/black-hat-2026
-
Matthew Schwartz shared thisI’m excited to share that I’ll be speaking at Black Hat USA 2026 in a sponsored session presented by Primary. My session, “Velocity Without Assurance: Evidence-Backed Trust for Agentic AI Systems,” will explore a growing challenge: organizations are deploying increasingly autonomous AI systems faster than they can demonstrate that those systems are trustworthy. We’ll look at how teams can move beyond policy statements and point-in-time testing toward evidence-backed assurance, connecting an agent’s identity, permissions, behavior, controls, and outcomes. I’m grateful to Primary for the opportunity to bring this conversation to the Black Hat community. https://lnkd.in/ev7N-CFi #BlackHatUSA #AgenticAI #AISecurity #Cybersecurity #AIGovernance
-
Matthew Schwartz shared thisA few people have asked how I convert Markdown files to PDF, especially when the document includes links, tables, code blocks, and Mermaid diagrams. There are plenty of plugins and tools that get you part of the way there, but I kept running into issues with broken diagram rendering, clipped tables, long code lines, missing links, or PDFs that looked fine in preview but failed when printed/exported. I put together a small shell script that has worked well for me: https://lnkd.in/eCJKUpmi The basic flow is: 1. Pre-render Mermaid diagrams with mmdc 2. Convert GitHub-flavored Markdown to standalone HTML with pandoc 3. Embed resources so links/images behave correctly 4. Inject print CSS for margins, wrapping, tables, code blocks, and page breaks 5. Use headless Chrome to generate the final PDF The biggest lesson learned: the Markdown-to-PDF problem is usually not just “conversion.” It is rendering, layout, print behavior, and diagram handling all at once. Hopefully this saves someone else a few hours of trial and error. #Markdown #MermaidJS #Pandoc #DevToolsConverts a Markdown file (with Mermaid diagrams) to PDF.Converts a Markdown file (with Mermaid diagrams) to PDF.
-
Matthew Schwartz shared thisOn-device LLMs are becoming a product architecture decision, not just a model decision. I wrote a comparison of llama.cpp, LiteRT-LM, and Core AI for Apple-platform apps. The takeaway: choose the runtime based on shipping risk, model availability, lifecycle stability, and portability. The runtime is an implementation detail. The user experience is the product.
-
Matthew Schwartz reposted thisMatthew Schwartz reposted thisI'm Hiring: Senior Security Engineer, Internal Audit @ Amazon Join Amazon's Internal Audit Security team to uncover vulnerabilities, lead red team engagements, and assess security controls across Amazon's products and infrastructure — including the controls behind our AI/ML adoption. Remote (MA, OR, WA) Apply: https://lnkd.in/gJ3vM5MM #Hiring #SecurityEngineer #CyberSecurity #AmazonJobs
-
Matthew Schwartz liked thisMatthew Schwartz liked thisLast week marked my final day at Amazon, bringing to a close an incredibly meaningful chapter of my career. When I look back, I’m especially grateful for the breadth of experiences I had and how much I was able to learn along the way. I started as an Application Security Engineer with EC2 Networking, where I had the privilege of helping shape security architecture for some of Amazon Web Services (AWS)’s major re:Invent launches, including AWS Cloud WAN, Transit Gateway, VPC IP Address Manager (IPAM), and the EC2 Interactive Serial Console. Along the way, I supported hundreds of feature launches across core EC2 networking services from Amazon VPC to the continued expansion of IPv6 and many things in between. It was an incredible place to learn how cloud services are designed, built, secured, and operated at a scale that is difficult to appreciate from the outside. From there, my journey took an interesting turn: I moved from securing software-defined networks to the real networks underneath them. As a Network Security Engineer with AWS Infrastructure, I had the opportunity to go deeper into the systems that make the cloud possible, learning about and securing data center networks globally at enormous scale. It put me, quite literally, in the belly of the beast: working on security problems where networking, hardware, infrastructure, automation, supply chain, and massive scale all intersect. My final stint brought me to Corporate Security, giving me yet another perspective on security at Amazon and another set of challenging problems to learn from. Across all of these roles, the technology and scale were fascinating, but the most meaningful part of the experience was always the people. I had the privilege of working with incredibly talented engineers, security professionals, builders, leaders, and partners across AWS and Amazon. Many became mentors and friends, and those relationships are what I’ll value most. To everyone I worked and partnered with over the years: thank you. Thank you for the trust, the objective discussions, the late-night problem solving, the lessons, the laughs, and the opportunity to build and learn alongside you. You made this journey what it was. For now, I’m taking some time to prioritize my health and well-being, recharge, and spend time on the things that matter most. It’s difficult to summarize years of experiences, challenges, launches, friendships, and growth in one post. I leave Amazon with a tremendous amount of gratitude for the opportunities I was given, for everything I learned, and especially for the people who made the journey memorable. Thank you, AWS and Amazon, for an unforgettable journey. On to the next chapter, when the time is right.
-
Matthew Schwartz liked thisMatthew Schwartz liked this☠️ My DEF CON 34 presentation on MalSkills is now available as a blog post! 🚀I’ve published the accompanying lab on GitHub. 🧪 The core finding: every AI agent skill can appear benign in isolation while the composed system performs something harmful. This matters beyond the security team. AI agent skills are unsigned, natural-language instructions that can operate with the agent’s full permissions. 📝 Read the DEF CON field notes: https://lnkd.in/gAxD-YGG 🧪 Reproduce the lab: https://lnkd.in/g5rmD23w 🏢 For business and technology leaders: this creates a new software supply-chain risk. ⚙️ For engineers: file-by-file review is not enough. Security controls must evaluate the full orchestration and enforce capabilities in deterministic code, outside the LLM’s reasoning loop. The public lab includes benign and malign multi-skill pipelines, the same pipeline with an orchestration chain planted, and a local Proof Collector that lets you observe the result directly. Same visible output. Three changed files. Only one pipeline phones home. The malware of tomorrow may not look like code. It may look like a well-written paragraph. ⚠️ #DEFCON34 #AISecurity #AgenticAI #Cybersecurity
-
Matthew Schwartz liked thisMatthew Schwartz liked this🚨 BREAKING: NVIDIA is reportedly acquiring Hugging Face for $12.9 billion. This comes just days after reports that Hugging Face was exploring a sale after receiving acquisition interest and bringing in a bank to evaluate potential offers. Hugging Face is growing fast. Its annualized revenue reportedly jumped from around $100 million to more than $150 million within a few months, paying subscribers doubled in the first half of 2026, and the company says it is close to profitability. That put Hugging Face in a strong position to consider a sale while interest from major buyers was already there. For NVIDIA, the strategic fit is pretty clear. Hugging Face has become one of the most important platforms in open-source AI, where millions of developers discover, download, fine-tune, and deploy models. A lot of that activity eventually turns into demand for compute, where NVIDIA already dominates. It also gives NVIDIA a stronger position in the open-model ecosystem at a time when major AI companies are increasingly developing their own chips and trying to reduce dependence on NVIDIA. If the deal closes, NVIDIA would own one of the biggest platforms sitting between AI developers, models, and the hardware underneath them. Follow Endrit Restelica for more.
-
Matthew Schwartz liked thisI’m thrilled to share that I’ll be sharing my MalSkills Demos and tactics this year in RTV at DEF CON 34! 👾🔥 #defcon #defcon34 #rtv #redteamvillage #aisecurity #llmsecurity #llm #ai #malskills #codingagentMatthew Schwartz liked this📃 A persistence mechanism that's just a plain text file, invisible to EDR, and survives reboots? Welcome to MalSkills. Nur Gucu weaponizes AI coding agent "skills" for persistence, exfil, and lateral movement. Wild new territory.
-
Matthew Schwartz liked thisMatthew Schwartz liked thisBack to the basics...Security Scanners Security scanners must show 1) what was evaluated, 2) how it was evaluated, 3) what it found, 4) what was NOT found, 5) what was NOT evaluated and why. I'm 100% an AI and even an AI security evangelist. However, if I ask you how your scanner works and you start that with "my agent discovers/evaluates the code...", I'll simply be telling you to leave. How did YOUR CODE build the context, force the file-by-file evaluation, evaluate each type of possible vulnerability one content item at a time? Even though I love AI and demand that it be part of modern security scanner, if you lead with that, I'm going to laugh you out of my office. You are doing it wrong. There are so many security scanners that are just claude code or basic harnesses for AI agents that are essentially prompted to "Find all security problems!". This won't work. This won't ever work given the current transformer based architecture models. If your security is based on bias and hopeful prompts that an agent discovers all parts of an application and is simultaneously able to apply the entire world of possible security problems at once, you are going to have a bad time. If you don't understand why you are going to have a bad time, you don't know enough about the technology to leverage it yet. Security, Do better. AI Security Enthusiast, Garrett
-
Matthew Schwartz liked thisUnsloth Studio (Beta) looks pretty interesting for anyone working with local AI models. It’s an open‑source, no‑code interface that lets you run, train, and export AI models locally on Mac, Windows, or Linux. A few highlights: - Supports GGUF, MLX, diffusion, TTS, embeddings, and text models - Claims 2× faster training with ~70% less VRAM - Built‑in web search, tool‑calling, and sandboxed code execution - New Unsloth Desktop app for easier setup - Can connect local models to tools like Claude Code, Codex, Hermes, etc. - Offers dataset creation, training observability, and easy export to safetensors/GGUF - Can run fully offline with privacy‑first design If you want to explore or test local model workflows, the docs and quickstart are here: https://lnkd.in/gR9zF8VN #LocalLLM #OpenSource #UnSloth
-
Matthew Schwartz liked thisMatthew Schwartz liked thisIntroducing Muse Glimmer, an open-weight 30-billion-parameter model optimized for always-on local agent workflows. Keeping with our long tradition of sharing fundamental AI research, we’re releasing the weights under a permissive Apache 2.0 license. Muse Glimmer is small enough to run on consumer hardware like a Mac or PCs with performant GPUs, supporting local agents and function calling, local coding, and LLM-as-a-judge evaluation. The model delivers strong performance on key agentic use cases and benchmarks compared with leading models in its size category. Most foundation model deployments still depend on cloud infrastructure and network access. Running locally means AI that works anywhere, with or without a connection. Muse Glimmer is optimized for exactly that. 🔗 Read the research blog: https://lnkd.in/enw7a4St 🔗 Download Muse Glimmer on Hugging Face: https://lnkd.in/eK6x9MQc 🔗 Find resources: https://lnkd.in/eQ9GWHxE
Experience & Education
Licenses & Certifications
Publications
-
Is End Point Control Going the Way of the Dodo?
16th Annual New York State Cyber Security Conference
Patents
-
Single-packet authorization using proof of work
Issued US11831638B1
See patentMethods, systems, and computer-readable media for single-packet authorization using proof of work are disclosed. An access control service receives, from a client, a single-packet authorization (SPA) request. The (SPA) request comprises output of a proof-of-work task, wherein completion of the proof-of-work task requires computational resources or memory resources of the client. The access control service performs verification of the output of the proof-of-work task using fewer computational or…
Methods, systems, and computer-readable media for single-packet authorization using proof of work are disclosed. An access control service receives, from a client, a single-packet authorization (SPA) request. The (SPA) request comprises output of a proof-of-work task, wherein completion of the proof-of-work task requires computational resources or memory resources of the client. The access control service performs verification of the output of the proof-of-work task using fewer computational or memory resources of the access control service than were used by the client. In response to determining that verification of the output of the proof-of-work task succeeds, the access control service performs authentication of the SPA request. In response to determining that authentication of the SPA request succeeds, the access control service allows access by the client device to a service.
-
Deperimeterized access control service
Issued US011652822B2
See patentTechniques for deperimeterized access control are described. A method of deperimeterized access control may include receiving, by a controller of a deperimeterized access control service, a single packet authorization (SPA) request for a session ticket from an agent on a electronic device, wherein the agent sends the request for the session ticket in response to intercepting traffic destined for a service associated with the deperimeterized access control service and determining that the agent…
Techniques for deperimeterized access control are described. A method of deperimeterized access control may include receiving, by a controller of a deperimeterized access control service, a single packet authorization (SPA) request for a session ticket from an agent on a electronic device, wherein the agent sends the request for the session ticket in response to intercepting traffic destined for a service associated with the deperimeterized access control service and determining that the agent does not have a session ticket for the service, authorizing the SPA request, providing a session ticket to the agent based on the request, receiving, by a gateway of the deperimeterized access control service, a request to initiate a session with a service, the request including the session ticket, validating the session ticket, and providing session parameters to the agent to be used to initiate the session between the electronic device and the service.
-
Management and distribution of virtual cyber sensors
Issued US 9,866,575
See patentA system includes reception of data at a computing network, generation of alerts at the computing network based on received data and on cyber sensor data, the cyber sensor data defining data attribute, reception of alerts from the computing network at a defense engine, detection of events based on the received alerts at the defense engine, generation threat data based on the detected events, generation of first cyber sensor data based on the threat data, and initiation of deployment of the…
A system includes reception of data at a computing network, generation of alerts at the computing network based on received data and on cyber sensor data, the cyber sensor data defining data attribute, reception of alerts from the computing network at a defense engine, detection of events based on the received alerts at the defense engine, generation threat data based on the detected events, generation of first cyber sensor data based on the threat data, and initiation of deployment of the first cyber sensor data within the computing network.
-
Honeyport active network security
Issued US 9,436,652 and 9,838,426
See patentA device comprises a processor. The processor is configured to generate a first signal using a first communication protocol. The first signal corresponds to data received by the processor. The processor is configured to generate a second signal using a second communication protocol. The second signal comprises fabricated data generated by the processor. Additionally, the processor is configured to transmit the first signal. The processor is also configured to transmit the second…
A device comprises a processor. The processor is configured to generate a first signal using a first communication protocol. The first signal corresponds to data received by the processor. The processor is configured to generate a second signal using a second communication protocol. The second signal comprises fabricated data generated by the processor. Additionally, the processor is configured to transmit the first signal. The processor is also configured to transmit the second signal.
https://patentimages.storage.googleapis.com/35/eb/b9/0e6338bf783391/US9838426.pdf
https://patentimages.storage.googleapis.com/f5/dd/35/56f30c7a511464/US9436652.pdf -
Load balancing medical imaging applications across healthcare imaging devices in reference to projected load based on user type
Issued US 8,479,213
See patentSystems, methods and apparatus are provided through which in some embodiments healthcare imaging processing applications are allocated to computing resources in reference to criteria.
-
Medical imaging system and method with integrated weight sensing
Issued US 7,682,079
See patentAn integrated weight sensing system and method is disclosed for a medical imaging system. In one embodiment, the integrated weight sensing system may include a table assembly, a load cell, and a processor that are implemented in a medical imaging system. The table assembly includes a lifting mechanism used to position a patient within the medical imaging system. The load cell is mechanically coupled to the table assembly and in communication with the processor. The load cell is configured to…
An integrated weight sensing system and method is disclosed for a medical imaging system. In one embodiment, the integrated weight sensing system may include a table assembly, a load cell, and a processor that are implemented in a medical imaging system. The table assembly includes a lifting mechanism used to position a patient within the medical imaging system. The load cell is mechanically coupled to the table assembly and in communication with the processor. The load cell is configured to measure and indicate the weight of the patient and the processor may be configured to adjust imaging parameters based on the weight of the patient. The table assembly may include a device in communication with the load cell and/or processor to display the weight of the patient. Additionally, the table assembly and/or the processor may include an interface for zeroing or recalibrating the load cell.
-
Real-Time Protection Framework for AI Agent Tool Systems
Filed 19/468,695
Systems, devices, and methods are provided for, among other things, dynamic, context-aware security for artificial intelligence (AI) systems that utilize external tools. Techniques may involve receiving a user input, determining metadata for available tools, and generating potential attack vectors based on the metadata. When the user input or set of user inputs presents as a potential risk for one or more of the known attack vectors, a security model can be selected based on the relevant attack…
Systems, devices, and methods are provided for, among other things, dynamic, context-aware security for artificial intelligence (AI) systems that utilize external tools. Techniques may involve receiving a user input, determining metadata for available tools, and generating potential attack vectors based on the metadata. When the user input or set of user inputs presents as a potential risk for one or more of the known attack vectors, a security model can be selected based on the relevant attack vector(s) identified. The user input may be evaluated using the selected model to determine a proposed system component(s) to respond to the interaction, and multi-observer analysis may be applied to detect vulnerabilities. A weighted consensus from specialized observers may be used to determine a security intervention, such as restricting, modifying, or blocking execution.
-
Dynamic Multi-Level Token Management System for Large Language Models
Filed 19/204,366 36
Systems, devices, and methods are provided for multi-level tokenization in machine-learning models. Techniques described herein may relate to tokenization techniques that involve determining an input text and a label, selecting, based at least in part on the label, a first tokenizer from a plurality of tokenizers, using the first tokenizer to tokenize the input text and produce a first token sequence, analyzing the first token sequence to select a first trust level of a multi-trust level trust…
Systems, devices, and methods are provided for multi-level tokenization in machine-learning models. Techniques described herein may relate to tokenization techniques that involve determining an input text and a label, selecting, based at least in part on the label, a first tokenizer from a plurality of tokenizers, using the first tokenizer to tokenize the input text and produce a first token sequence, analyzing the first token sequence to select a first trust level of a multi-trust level trust hierarchy, and determining a trusted token sequence by at least applying the first trust level to the first token sequence.
-
Embeddings Defense (EmDef)
Filed 19/096,279 279
Systems and methods are provided to detect anomalous data obtained from and/or to be routed to a machine learning model. A system can identify a first embedding generated by a machine learning model. The system can obtain a first set of data associated with the machine learning model and can compare the first embedding generated by the machine learning model with the first set of data. Based on comparing the first embedding generated by the machine learning model with the first set of data, the…
Systems and methods are provided to detect anomalous data obtained from and/or to be routed to a machine learning model. A system can identify a first embedding generated by a machine learning model. The system can obtain a first set of data associated with the machine learning model and can compare the first embedding generated by the machine learning model with the first set of data. Based on comparing the first embedding generated by the machine learning model with the first set of data, the system can determine a manner of processing a second set of data (e.g., an input to and/or an output of the machine learning model). The system can process the second set of data according to the manner of processing the second set of data.
-
Generative AI and Honeypots
Filed 19/095,879 879
Techniques for using honeypots are described. In some examples, a method for using honeypots includes generating a honeypot having characteristics of a vulnerability as indicated in a publicly facing lure describing a vulnerable system, wherein the publicly facing lure includes one or more indications of a location of a honeypot and narratively refers to the honeypot as a vulnerable target; operating the generated honeypot to collect threat intelligence; generating one or more countermeasures…
Techniques for using honeypots are described. In some examples, a method for using honeypots includes generating a honeypot having characteristics of a vulnerability as indicated in a publicly facing lure describing a vulnerable system, wherein the publicly facing lure includes one or more indications of a location of a honeypot and narratively refers to the honeypot as a vulnerable target; operating the generated honeypot to collect threat intelligence; generating one or more countermeasures based on the collected threat intelligence; and applying the one or more countermeasures.
-
MiRAGE: Dynamic Context Adaptation in Large Language Models Through Mid-Inference RAG
Filed 19/096,274 274
Systems and methods are provided to dynamically adjust contextual data of a machine learning model during an inference process of the machine learning model. A system can identify one or more tokens generated by the machine learning model. The machine learning model may, during an inference process, generate the one or more tokens based on first contextual data. The system can determine that the one or more tokens satisfy one or more first parameters. The system can obtain second contextual…
Systems and methods are provided to dynamically adjust contextual data of a machine learning model during an inference process of the machine learning model. A system can identify one or more tokens generated by the machine learning model. The machine learning model may, during an inference process, generate the one or more tokens based on first contextual data. The system can determine that the one or more tokens satisfy one or more first parameters. The system can obtain second contextual data associated with the one or more tokens based on determining that the one or more tokens satisfy the one or more first parameters and can provide the second contextual data to the machine learning model. The machine learning model may generate an output based on the second contextual data and at least a portion of the first contextual data.
-
Privacy Preserving Mechanisms using Parameters and Tags
Filed 19/096,153 153
Systems and methods are provided to perform retrieval-augmented generation for machine learning models using filtered contextual data. A system can identify data associated with a machine learning model. The data may be associated with one or more first identifiers that may indicate a user, a user computing device, a model, etc. associated with the data. In response to determining that the data satisfies one or more parameters, the system can identify a need for contextual data. The system can…
Systems and methods are provided to perform retrieval-augmented generation for machine learning models using filtered contextual data. A system can identify data associated with a machine learning model. The data may be associated with one or more first identifiers that may indicate a user, a user computing device, a model, etc. associated with the data. In response to determining that the data satisfies one or more parameters, the system can identify a need for contextual data. The system can compare the one or more first identifiers associated with the data to one or more second identifiers associated with the contextual data. Based on the comparison, the system can filter the contextual data to obtain filtered contextual data. The system may provide the filtered contextual data to the machine learning model for generation of an output.
Projects
Recommendations received
-
LinkedIn User
8 people have recommended Matthew
Join now to viewOther similar profiles
Explore more posts
Explore top content on LinkedIn
Find curated posts and insights for relevant topics all in one place.
View top content