# My week at AISB London: from the foundations to questions about AI safety

Author: Ricardo Prieto

Published: 2026-09-14 · Updated: 2026-09-22

Language: English (en)

[https://www.philocyber.com/en/blogs/aisb-london-2026-experience](https://www.philocyber.com/en/blogs/aisb-london-2026-experience)

The foundations I struggled with, the conversations that made the risks more tangible and why this week changed my priorities. My experience at the AI Security Bootcamp in London.

***

I went to the AI Security Bootcamp in London to better understand the technology I was already working with. The first few days took me inside the models. Then the classes and conversations made me look outwards at what might change as these systems become more capable. That journey ended up changing much more than my technical questions: it changed my priorities too.

I heard about the bootcamp with very little time to spare. Graciela Pataro, one of my professors in UBA’s Master’s in Information Security, sent me the call for applications shortly before the deadline. I read about the programme, thought it was an enormous opportunity and applied.

From 30 August to 5 September 2026, I was in London studying AI security with people from very different backgrounds. I was already working in AI security and had years of experience in offensive security and AppSec. I brought that experience with me, along with a real desire to better understand what happens inside models.

![The GovAI office where the AI Security Bootcamp took place during a reinforcement learning session, with the Bellman equation projected and notes on the whiteboard](https://www.philocyber.com/blogs/aisb-london-2026-experience/reinforcement-learning-session.jpg)

One of the reinforcement learning sessions, taught by David Quarel (PhD student at the Australian National University). The week combined foundations, discussion and hands-on work.

Personal archive

## Arriving with experience and becoming a beginner again

The first few days focused heavily on the foundations. For me, understanding how models are trained and represented helped take away some of the abstraction that makes AI seem like magic. My security experience gave me a foothold: trust boundaries, attack surfaces, permissions and abuse cases. But following the maths required a different foundation.

Reinforcement learning was one of the parts I struggled with most. David Quarel explained it very well, but going from the idea of learning through rewards to following the equations and algorithms was difficult for me. We had to connect states, actions, rewards and what could happen after each decision. It was a lot of material in very little time, and there were parts I could not follow at the pace of the class.

The coding exercises also stretched my knowledge of ML quite a bit. I had to ask tutors, classmates and AI for help. My classmates had very different strengths: some understood models in depth; others, evaluation or practical security. Some came from academia and others were more connected to public institutions.

Learning together helped me see where I could contribute and where I needed to go back to the foundations. I left with a more precise map of what I still do not know (a difficult feeling to deal with, but one I had to sit with).

## From model internals to control

The exercises helped connect those foundations with security problems. In model internals, serialisation and tokenisation appeared as parsing boundaries. A demo with control tokens could show how a representation changes the meaning of an input, but it did not prove on its own that a real API was vulnerable. That distinction between a useful idea and the evidence needed to support a claim felt very familiar from offensive security.

For backdoors, the material proposed poisoning a sentiment analysis dataset with the trigger “James Bond” and measuring both performance on normal inputs and how often the intended behaviour appeared when the trigger was present. It was the exercise I enjoyed the most.

One measurement did not replace the other. A model responding well to normal inputs left the question of what happened when the trigger appeared unresolved. I am taking that question back into my work: when we say a model passed an evaluation, what behaviour did we test, and under what conditions?

In adversarial vision, another exercise proposed measuring an attack’s effectiveness alongside how much the image changed, using the L2 and L∞ norms. These were bounded exercises for learning how to measure, without claiming to demonstrate the general robustness of frontier models.

Monitoring and AI control added another question: how to reduce the risk of unwanted actions even if we cannot fully trust the model. The exercises compared protocols for monitoring, deferring to a trusted model and generating new responses. We had to consider both the security and the usefulness of each alternative.

## When the impacts stopped feeling so distant

In the second half of the week, the focus broadened towards the impact AI could have across different areas and the risks of much more capable systems. Questions about artificial general intelligence (AGI) and artificial superintelligence (ASI) came up. I had heard and read about those scenarios, but I lacked the context to connect them with what was already being observed and how quickly the technology is advancing.

The talks by David Williams-King and Marius Hobbhahn had the greatest personal impact on me. They discussed misalignment, scheming and the difficulties of interpreting chain of thought, the reasoning traces a model expresses. I kept thinking about what we can understand from those traces and what we need to evaluate in the model's behaviour.

Marius is CEO and co-founder of [Apollo Research](https://www.apolloresearch.ai/about), where they study, among other things, whether a model can covertly pursue misaligned goals while hiding its actions from oversight. Hearing from people working on these problems, and connecting their research with questions about future impacts, gave me points of reference I had been missing.

For me, those conversations brought enormous questions closer to problems that can be studied. Understanding the foundations better and learning about the work of people evaluating these systems helped me think about what evidence we have, what remains uncertain and why it is worth working on.

My relationship with governance also changed. A few months earlier, I had taken TAISE, from the Cloud Security Alliance. My personal feeling was that I struggled to connect some of the theory with concrete problems. I learn better when I can understand the foundations and then use them to build, test or evaluate something. In London, I began to find those connections.

Consider an agent whose monitor detects a suspicious action. The alert needs to arrive in time and be connected to a mechanism capable of stopping it. Then someone has to decide who reviews what happened, when work can resume and what happens if maintaining the pause delays a delivery. That brought technical controls, evidence, responsibilities and incentives together.

My reading of AISB is that it also aims to bring people from cyber into these questions and help them find where they can contribute. It helped me better understand the reasons for working on AI safety and made me want to get involved.

## Seeing that work up close

During the week, the UK AI Security Institute hosted the group and shared some of its research. Seeing an institution dedicated to evaluating capabilities and risks made a field that can feel abstract from a distance much more concrete. GovAI also provided its offices for part of the programme. Honestly, I would have liked more talks from them or more context. That would have been good.

![Ricardo having a fan moment in front of the UK AI Security Institute sign during the AISB group visit](https://www.philocyber.com/blogs/aisb-london-2026-experience/visit-aisi.jpg)

During the group visit to the UK AI Security Institute in London.

Personal archive

The learning did not happen only in front of a screen. Questions continued during breaks, meals and conversations with classmates. Their generosity made asking for help feel like part of the work, rather than like falling behind.

I especially want to thank Pranav Gade, who created AISB and spent the week teaching and supporting us, through both the technical talks and the conversations about impact. Pranav, you’re a legend.

Also David Quarel and Jan Michelfeit, for teaching and helping me connect complex ideas; and Rhita Ameziane, for the organisation and care that held this wonderful experience together.

I also want to thank Jannis Kirschner, Emma Liddell, Chang Shiau Huei, Fernando Smith and David Williams-King for their talks and guidance; BlueDot Impact and Constellation Institute; the UK AISI for hosting us and sharing its research; and GovAI for opening its offices and sharing such a beautiful space. And, of course, my dear Legal Framework, Ethics and Privacy (PSI) professor, Graciela Pataro, for sharing the opportunity with me just in time.

## Financial support matters

Financial support was essential for me to attend. Without it, travelling to London for a week of training would not have been a realistic option for me.

Making these opportunities accessible matters because talent and valuable questions are not concentrated in a single city, country or professional path. Financial support changes who can be in the room, learn and then carry those ideas into other communities.

## What I brought home

I came home wanting to dedicate my work to helping make AI safer and more beneficial. The week changed many of my priorities, including outside my professional life. In [this other essay, I share what that change meant for me and for PhiloCyber](https://www.philocyber.com/en/blogs/why-im-focusing-on-ai-safety).

Here, I wanted to share the journey that led me to that decision: studying the foundations, facing my own limits and listening to people researching the problems ahead of us. My experience in offensive security, AppSec and threat modelling is the foundation I want to start contributing from. My immediate focus is to strengthen my ML knowledge and find bounded questions I can research with other people.

I will continue sharing what I learn in future posts and videos. If you are working on AI safety, AI security, evaluations or control and think we could contribute and learn together, [get in touch](https://www.philocyber.com/en/contact) or contact me on [LinkedIn](https://www.linkedin.com/in/richieprieto/). The door remains open to collaborating, talking about job opportunities and receiving feedback.

## Questions people asked after I shared my experience

Before answering, a clarification: two people have already written to me after applying to AISB and not being selected. I do not work for AISB and was not part of the organising team or the team reviewing applications. I do not know why they were not selected or what criteria are used to make those decisions. Different factors may play a role, but I do not have the information to explain individual cases. If that is your situation, it is best to contact the [AISB team](https://aisb.dev/2026/dec/london/) directly. What I can share is my own experience as a participant.

### Do I need a machine learning background to benefit from AISB?

I can only answer from my own experience: my security background helped a great deal, but I also needed to study ML. The organisers shared four weeks of excellent, extensive preparatory material with us. It is worth making time for it. The requirements for each cohort are on the official website.

### What made this week different from a conference?

The continuity. An idea would appear in a class, become concrete in a coding exercise and come up again later that day or the next in a conversation about evaluation or control. Spending several days with the same group also allowed us to ask questions in greater depth, get to know one another better and learn from other people’s experiences.

## Sources you can check

- [Public AI Security Bootcamp curriculum](https://github.com/AI-Security-Bootcamp/aisb/tree/3bc387e91ddadecc7e8177cc7546168186b5406a), commit from 7 September 2026.
- [Public reading on training: SFT, DPO, RLVR and RLHF with PPO](https://github.com/AI-Security-Bootcamp/aisb/blob/3bc387e91ddadecc7e8177cc7546168186b5406a/1.0-readings/llm-training-guide.md).
- [Apollo Research: research on scheming](https://www.apolloresearch.ai/science).
- [UK AI Security Institute](https://www.aisi.gov.uk/).
- [Next AISB cohort in London](https://aisb.dev/2026/dec/london/).

![Official poster for the December 2026 AI Security Bootcamp cohort in London](https://www.philocyber.com/blogs/aisb-london-2026-experience/london-december-2026.jpg)

The next London cohort will run from 6 to 12 December 2026.

[AI Security Bootcamp (AISB). Official poster.](https://aisb.dev/2026/dec/london/)

> **Applications for London, December 2026**
>
> The cohort I wrote about took place in late August and early September. The next one will run from **6 to 12 December 2026**, and applications close on **1 October 2026 at 23:59 AoE (Anywhere on Earth)**.
>
> If the programme interests you but you are hesitating because you have not mastered the entire curriculum, go for it and apply! I also arrived with gaps I needed to work on and uncertainty. [Learn about the programme](https://aisb.dev/2026/dec/london/) and [apply here](https://airtable.com/appyq1bBRnK6s7AkM/paglvXzxYAiJclCZX/form).
>
> If you don't try, the answer is already no. Give it a shot!

Richie