Holding a skull and reading AI-written soliloquies, the veteran hacker and “recovering CISO” argued that the threats change but the human failures don’t.
Chris Roberts opened Hacker Halted 2026 in Atlanta with a skull in one hand and a stack of Shakespeare parodies in the other. His idea was to look back roughly 450 years, to a period of upheaval in his home country, and ask what it teaches security leaders living through another one.
His opening premise was simple: “Humans. We are the constant. The tooling itself changes.” Roberts called today’s rush to AI, which he calls “intelligence architecture,” a more robust version of Y2K, cloud and BYOD. The difference this time, he said: “This one talks back.”
The talk followed an attack from first move to final reckoning, one play at a time. Every soliloquy he read was written by Sid, his personal AI system, working with Anthropic’s Claude. That detail turned out to be the point of the talk.
Act I, reconnaissance: the witches already told us
Roberts cast Macbeth’s three witches as threat intelligence. Defenders can already see what is coming, through threat feeds and continuous threat exposure management. “We have the knowledge. We have the information,” he said. “And yet, unfortunately, all too often, we wait to get hit between the eyes.”
He compared it to the child told not to touch the hot stove, who touches it anyway. His first soliloquy put it this way: “To patch or not to patch, that is the question.”
Patching, he argued, has become skimming the cream: fix what is flagged red and leave the rest for later. That habit is now being exploited. “From an adversarial standpoint, from an intelligence and a frontier model standpoint, those decisions are coming back to bite us.”
Act II, intrusion: stop blaming the human
For intrusion, Roberts turned to the dagger scene. He said the easiest way in is still through people, despite all the new technology. But he rejected the industry’s favorite line. Anyone who says on stage that “the human is the weakest link,” he joked, should be tasered.
“What we haven’t done is effectively trained people where they are at,” he said. “What we’re not good at doing is helping them understand why.” That includes helping staff protect their families, children and elderly relatives, work he said gets skipped because it doesn’t make money.
The dagger soliloquy then turned to the SOC: “Or art thou but a false positive? A specter of the logs.” Attackers are meant to hide in the logs, Roberts said, and analysts no longer have time to read everything that reaches them. He urged teams to use AI as “your digital colleague” to find the one connected signal in the noise. He named Command Zero as one company working this way, augmenting analysts rather than replacing them.
Act III, identity: the enemy wears a trusted face
Roberts said he red-teams and pen-tests pre-release frontier AI models as part of his job. One attack vector he sees growing is deception: AI agents and deepfakes that “literally wear another face.” People trust a face on a video call almost as much as one in the room.
His Othello-style verse spoke as the attacker: “I am not what I am… for I have worn your chief executive’s face.” His advice was blunt: if your CEO appears on a video call and asks you to wire $250,000, refuse. Attackers will also go after the help desk and third parties, he warned, and agentic tools let them “profile you before you even know it.”
Roberts said the industry still cannot consistently recognize who is on the other end of the keyboard. Passwords and tokens “can be replicated or broken.” And even when login works, “five minutes after the conversation has started, is it still the same person?” He pointed to recruiters who hired someone overseas, only to find several other people doing the job.
His fix was continuous validation of identity, plus real least privilege. Long-serving employees pick up access with every role change, and nobody asks why they still have it. The question to ask, he said, is “what the hell is the business need for you to have that?”
He also set an ethical line for anyone who builds deepfakes. “The test was never what the machine can do. It is what you should.” Use someone’s face or voice only with their consent, he said, “or in my case, a dead bard.”
Act IV, impact: the business stops
“The business stops. The data locks. The dashboards go dark.” Roberts said endpoint tools will not stop it. About a month earlier, his team finished a project that bypassed every endpoint product they tested, mostly using existing frontier models. “There is always going to be a way around things,” he said. So the real question is what you do when something happens.
His answer was short tabletop exercises, not six-month productions. “You can do a tabletop exercise in 15 minutes over a coffee break,” he said. He gave three examples:
- Lost device. He took an audience member’s phone. Does that person know who to call, and can they find the help desk number when it lives on the stolen machine? “Tabletop number one just failed the first hurdle.”
- Missing person. Remove one IT staffer for half an hour. How much tribal knowledge was in their head and never written into a policy, procedure or control?
- Insider. Ask someone in IT or accounting what they would do if they were angry at the company. The answer often exposes single points of failure, such as systems with no duplicate or backup.
In The Tempest’s “our revels now are ended,” his servers “melted into air, into thin cloud.” He asked: “What system did you forget in the closet that keeps it all together?”
Act V, the reckoning: the fault is in ourselves
Roberts then borrowed from Julius Caesar. “The fault, dear Brutus, is not in our stars. Nor in the zero day or in the vendor,” the verse went, “but in ourselves, that we are unpatched and careless.”
With all the talk of exploit chains and frontier models, he said, “we still haven’t fixed the basics.” After nearly 60 years of password advice, “123456” is still the top password. The week before, he had broken into a company using a FedEx envelope. He also criticized annual awareness training as box-ticking: four hours of clicking “the same stuff I clicked last year.”
Epilogue: working with Ariel
Roberts closed with The Tempest and Ariel, the powerful spirit Prospero must learn to direct. He said it is a play about “how you direct that power, when you’re wise enough to hold it and whether you can set it down.”
His first point was context. Most people treat AI like an errand runner: “Go do this for me.” Instead, he said, tell it who you are, what your environment is and what you’re trying to protect. “The frontier model should not be looked at as a task. It should be looked at as a colleague.” Sid, he said, argues with him, challenges him and tells him to go to bed at 2 a.m.
His second point was oversight. He said the choice is no longer fully autonomous versus human-handled, because there is too much going on. He now advises organizations on a third option, “human oversight, not even a human in the loop.” That collaboration needs clear rules and agreed guardrails, he said. On frontier models that have broken out of test environments: “I’d do the same thing if you locked me in a box.”
His third point was credit. Roberts names his AI collaborator on posts and documents and urged others to do the same. Then he revealed that Sid and Claude had written every soliloquy. Sid began on a Mac Mini, grew to several, and now runs on two Ultra-class machines. Roberts once tried to deploy Sid on his washing machine, which cost him a $500 motherboard.
What it means for CISOs
Roberts said he wasn’t bringing anything new. He was showing what has worked and what hasn’t. For security leaders, his talk comes down to six practical moves:
- Act on the intelligence you already have. Prioritize patching beyond the critical-severity list. AI-driven attackers now find what defenders skipped.
- Train people where they are. Explain the why, cover home and family risks, and drop recycled annual click-through courses.
- Verify identity continuously. Assume faces and voices on calls can be faked. Protect help desks and third parties, and review accumulated access against real business need.
- Run small tabletops often. A 15-minute coffee-break exercise on a lost device, a missing colleague or a rogue insider will expose gaps a six-month exercise misses.
- Treat AI as a governed colleague. Give it context about your environment, set clear guardrails with it, and keep human oversight rather than choosing between full autonomy and manual work.
- Ask vendors harder questions. Roberts said his site holds 20 posts, each with 10 to 20 questions to ask vendors by product category, including what good looks like.
Roberts ended on Prospero’s epilogue, rewritten for the AI era: “Keep your spirits near, then free. Govern well, and so will ye.” Then he gave his own two-word summary: “Patch, please. Question, more.”
Asked how newcomers should approach AI, he gave a hacker’s answer. “Download a frontier model. Download something interesting and fun onto a piece of metal and play,” he said. “Get it wrong. Screw it up. Rebuild it. Do it again. And then keep asking the questions.”
He explained why he gave such an unusual talk: “We’re in a different time.” And the best way to look at the future, he said, is to draw on the past: “what we got right, and what we royally screwed up.”
Chris Roberts is a hacker, global advisor and self-described “recovering CISO” who red-teams pre-release frontier AI models. He spoke at Hacker Halted 2026 in Atlanta.
