SANS Network Security 2026 - SANS@Night: Dr. Strangepwn or: How I Learned to Stop Worrying and Love the LLM

I spent 25 years doing things the hard way. JTAG probes, logic analyzers, hex editors, late nights staring at Ghidra. When AI started creeping into security tooling, I did what any seasoned pentester would do: I crossed my arms and waited for it to prove itself. Then I let go of the wheel.

This talk is the story of how I went from skeptic to believer by building Plan R, an IoT-focused MCP server that gives AI agents direct access to real pentesting tools. We will walk through the architecture, the playbook-driven methodology that lets you teach an AI agent to hack new protocols and attack surfaces, and how iterating on playbooks turned a firmware-only tool into a multi-domain IoT pentesting framework spanning WiFi, BLE, network protocols, and beyond.

More importantly, we will walk through a real engagement where this approach uncovered vulnerabilities in a named vendor's IoT product, the messy reality of disclosing AI-discovered findings to a white box vendor, and what it taught us about the gap between what AI finds and what you can actually defend in a disclosure conversation. Part confessional, part technical demo, part cautionary tale. Attendees will leave with a practical blueprint for building their own AI pentesting agents and a clear-eyed understanding of when to let go of the wheel and when to grab it back.