Michael Bargury

Hacker, builder and a cybersecurity practitioner. He is the co-founder and CTO of Zenity, the first application security company enabling enterprises to empower business users without paying for it in security incidents. He leads the OWASP LCNC Top 10, has a column on DarkReading, and delivers research, tools and talks regularly at top conferences including BlackHat, DEFCON and RSAC.

AI Enterprise Compromise - 0click Exploit Methods

Aug 6, 2025

•

2 min read

AI Enterprise Compromise - 0click Exploit Methods

Michael Bargury

Why Aren’t We Making Any Progress In Security From AI

Jul 31, 2025

•

9 min read

Why Aren’t We Making Any Progress In Security From AI

Guardrails Are Soft Boundaries. Hard Boundaries Do Exist.

Michael Bargury

Reconstructing a timeline for Amazon Q prompt infection

Jul 30, 2025

•

8 min read

Reconstructing a timeline for Amazon Q prompt infection

How a rogue GitHub commit, automation missteps, and a deceptive AI assistant led to one of the most bizarre prompt injection cases in recent memory.

Michael Bargury

Talks

May 1, 2025

•

2 min read

Zenity Research Published at RSAC 2025

Copilots and agents are a new access vector; How to build an AppSec program that scales to the level of citizen development

Michael Bargury

Talks

Links and materials for Scaling AppSec With an SDLC for Citizen Development

Apr 30, 2025

•

3 min read

Links and materials for Scaling AppSec With an SDLC for Citizen Development

Links, demos, tools and slides for RSAC 2025

Michael Bargury

Talks

Links and materials for Your Copilot Is My Insider

Apr 30, 2025

•

2 min read

Links and materials for Your Copilot Is My Insider

Links, demos, tools and slides for RSAC 2025

Michael Bargury

Talks

Scaling AppSec With an SDL for Citizen Development

Nov 14, 2024

•

21 min read

Scaling AppSec With an SDL for Citizen Development

A blog version for the talk presented at BlueHat 2024

Michael Bargury, +1

Talks

Links and materials for Scaling AppSec With an SDL for Citizen Development

Oct 30, 2024

•

3 min read

Links and materials for Scaling AppSec With an SDL for Citizen Development

Links, demos, tools and slides for BlueHat 2024

Michael Bargury

Security research

Sure, Let AI Browse the Internet—What Could Possibly Go Wrong?

Oct 7, 2024

•

3 min read

Sure, Let AI Browse the Internet—What Could Possibly Go Wrong?

Internet browsing for AI agents leads to 0click compromise but these mitigations can help

Michael Bargury

Security research

Oct 2, 2024

•

4 min read

TTPs.ai for GenAI-Targeted Attacks

Guiding threat simulation and defense for Copilots and Agents

Michael Bargury

Talks

A Summary of Zenity Research Published at BlackHat 2024

Aug 19, 2024

•

4 min read

A Summary of Zenity Research Published at BlackHat 2024

New Attack Vectors Discovered for Initial Access and Post-Compromise

Michael Bargury

Talks

Copilot Vulnerable to RCE: A New Attack Vector Into The Enterprise

Aug 14, 2024

•

19 min read

Copilot Vulnerable to RCE: A New Attack Vector Into The Enterprise

We Need To Address Promptware Now

Michael Bargury

Talks

Links and materials for Living off Microsoft Copilot

Aug 8, 2024

•

6 min read

Links and materials for Living off Microsoft Copilot

Links, source code, tools and slides for BlackHat USA 2024

Michael Bargury

Talks

Links and materials for 15 Ways to Break Your Copilot

Aug 7, 2024

•

4 min read

Links and materials for 15 Ways to Break Your Copilot

Links, source code, tools and slides for BlackHat USA 2024

Michael Bargury

Talks

Research Drop for Hacker Summer Camp 2024

Aug 5, 2024

•

3 min read

Research Drop for Hacker Summer Camp 2024

More information on hacking Microsoft Copilot, Copilot Studio, powerpwn, and what to do next

Michael Bargury

Michael Bargury

AI Enterprise Compromise - 0click Exploit Methods

Why Aren’t We Making Any Progress In Security From AI

Reconstructing a timeline for Amazon Q prompt infection

Zenity Research Published at RSAC 2025

Links and materials for Scaling AppSec With an SDLC for Citizen Development

Links and materials for Your Copilot Is My Insider

Scaling AppSec With an SDL for Citizen Development

Links and materials for Scaling AppSec With an SDL for Citizen Development

Sure, Let AI Browse the Internet—What Could Possibly Go Wrong?

TTPs.ai for GenAI-Targeted Attacks

A Summary of Zenity Research Published at BlackHat 2024

Copilot Vulnerable to RCE: A New Attack Vector Into The Enterprise

Links and materials for Living off Microsoft Copilot

Links and materials for 15 Ways to Break Your Copilot

Research Drop for Hacker Summer Camp 2024

Zenity Labs

Home

Meet Us

Join Us