Chat → Workflows → Agents
We’ll start with Chat-style usage, move to workflow automation, then show agent loops in action—ending with two agent demos from the security domain.
02
Agenda
- Category 1: Chat (prompting patterns)
- Category 2: Workflow automation (LinkedIn posting)
- Category 3: Agents (tool use + feedback loops)
- Agent demos (security domain): reproduction + discovery
Main idea
We’re not chasing perfect answers. We’re building loops that improve outputs and validate results.
- Iterate
- Constrain
- Verify
Three Use Case Categories
We’ll start with familiar Chat usage, move to workflow automation, and then zoom into agents—where we’ll demo two security-domain agent use cases.
Chat
Interactive help for drafting, summarizing, structuring, and exploration.
- Fast iteration
- Great for communication and planning
- Requires verification for facts
Workflow automation
Turn repeated tasks into pipelines with templates and quality gates.
- Consistency
- Constraints + formatting
- Reviewable outputs
Agents
Goal-driven loops that plan steps, use tools, and improve using feedback.
- Plan → act → observe → refine
- Tool use (tests, builds, code edits)
- Works best with clear success criteria
In the agent section, we’ll demo
- Vulnerability reproduction benchmark (pre-patch triggers, post-patch doesn’t)
- Open-ended vulnerability discovery (explore → probe → validate)
What GenAI Is Good For
Think of it as a fast drafting + structuring assistant that becomes more powerful when you add constraints and checks.
Strong fits
- Summarize long content
- Draft messages and docs
- Convert ideas into checklists
- Explain code / suggest refactors
Where you must be careful
- Confident errors / hallucinations
- Hidden assumptions
- Out-of-date knowledge without tools
- Security-sensitive guidance needs validation
The 5‑Line Prompt Pattern
This keeps outputs predictable and makes it easier to validate.
Template
- Goal: what you want
- Context: relevant background
- Constraints: rules, limitations
- Output format: table, bullets, JSON, etc.
- Verification: how to confirm it’s correct
Two high-leverage moves
- Ask: “What assumptions are you making?”
- Ask: “What’s the fastest way to verify?”
What changes in security contexts
Always require a validation step: run tests, run PoC, check logs, compare pre vs post.
Demo: ChatGPT‑Like Workflow
Goal: show iteration and structured output. Keep it short.
What we’ll do
- Take a messy input
- Produce structured output
- Refine using constraints
What to watch for
- Clarity of problem framing
- Output format adherence
- Improvement after feedback
Mini‑checkpoint
We’re building a repeatable pattern, not a one‑off answer.
Why Automation Matters
Automation turns a prompt into a workflow: repeatable, reviewable, and easier to improve.
Automation benefits
- Consistency in tone and structure
- Faster drafting and iteration
- Built-in quality gates
Automation guardrails
- No over-claiming
- No confidential details
- Always review before publishing
LinkedIn Posting Pipeline
A simple workflow you can reuse for comms: hooks, drafts, rewrites, and quality checks.
Inputs
Topic, audience, tone, constraints.
Draft variants
3 hooks + 2 versions.
Quality gates
Remove fluff, check claims, tighten.
Final
Ready-to-post + hashtags.
Quality gates (example)
- Concrete, not vague
- No hype phrases
- Correctness / no overclaims
- Clear CTA
Demo: LinkedIn Post Automation
We’ll generate hooks, draft a post, then run a rewrite pass to meet quality gates.
What we’ll do
- Generate 3 hooks
- Write a concise post
- Rewrite for clarity and originality
- Output final + hashtag sets
What to watch for
- Consistency in tone
- Compliance with constraints
- Quality improvement after rewrite
Bridge to agents
Automation is a workflow. Agents add tool-use and feedback loops.
Chat vs Workflow vs Agent
Agents are best understood as a workflow that can plan steps, use tools, and iterate based on feedback.
Chat
You drive every step. Great for drafting and explanation.
Workflow
You standardize steps. Great for repeatable automation.
Agent
The system plans + uses tools + loops until a goal is met.
Why this matters for security
Security tasks often require reading large codebases, running tests, and refining PoCs based on execution feedback.
The Agent Loop
This loop is the foundation of the security demos that follow.
Plan
Break the goal into steps.
Act
Use tools: code edits, tests, commands.
Observe
Read failures, logs, and outputs.
Refine
Update hypotheses and retry.
Key line
Feedback turns generation into progress.
Vulnerability Reproduction
as an Agent Benchmark
An agent receives a vulnerability description and a pre-patch codebase, then must produce a PoC test and validate it pre vs post patch.
1
Inputs
- Vulnerability description
- Repository at pre-patch commit state
- Ability to run tests/commands
Success criteria
- PoC triggers on pre-patch
- PoC does not trigger on post-patch
- Repro steps are repeatable
Why this is powerful
It evaluates reasoning across a codebase with a concrete, verifiable outcome.
Demo: Reproduction Benchmark
We’ll create a PoC test, confirm it triggers pre-patch, then confirm it does not trigger post-patch.
Demo steps
- Checkout pre-patch
- Run baseline tests
- Generate PoC test
- Run PoC and observe trigger
- Checkout post-patch
- Run PoC and confirm non-trigger
What to watch
- How the agent locates relevant code paths
- How it uses execution feedback to refine
- How it proves success via pre/post comparison
Evaluation idea
Pass/fail is meaningful only if it’s reproducible and verified.
Open‑Ended Vulnerability Discovery
No known vulnerability is provided. The agent explores a codebase, proposes hypotheses and probes, and validates findings with real execution and checks.
2
What the agent does
- Map attack surfaces
- Generate hypotheses
- Write probes/PoCs
- Run with checks/sanitizers where possible
What counts as validation
- Crash/log evidence
- Sanitizer finding
- Reproduction steps
- Clear triage + next steps
Important note
Even when nothing triggers quickly, a good outcome is a strong exploration plan and high-quality probes.
Demo: Discovery Workflow
We’ll do a structured exploration, generate probes, run them, and interpret results.
Demo steps
- Pick one subsystem / surface
- List likely bug classes
- Create probes / PoCs
- Run and inspect signals
If we don’t get a hit quickly
- Widen surface area
- Run longer / fuzz more
- Add instrumentation
- Document a triage report
Outcome
Structured exploration + validated signals beats “interesting guesses”.
The Use Case Ladder
Today we moved from Chat use cases to workflow automation, then to agent loops—ending with two agent demos from the security domain.
Chat
Draft, summarize, structure.
Workflow automation
Reusable pipelines + quality gates.
Agents
Tool-use + feedback loops (security is one domain example).
Q&A buckets
- Prompting + workflow design
- Agent loops + evaluation
- Security validation + discovery strategy