Julian Totzek-Hallhuber
Author | Speaker | Lead Solutions Architect @ XBOW
Julian Totzek-Hallhuber is Lead Solutions Architect at XBOW and has spent nearly two decades on the front lines of application security. Before XBOW, he led the solution architect team at Veracode. From application development and penetration testing to web application security, Julian helps enterprises ship code that holds up under real-world attack.
He's the author of the book Mastering the Art of Application Security Testing, a regular voice on the international conference, trade fair, and webinar circuit, and a familiar name in tech PR, quoted across numerous articles and trade publications. He has also contributed to projects under www.webappsec.org. Between keynotes, you'll find him writing and sharing field notes at julz.de.
Equal parts technologist, strategist, and storyteller, Julian turns deep security expertise into clear, actionable guidance that resonates with developers, security leaders, and executives alike.
talks & Q&A
GenAI Is a Junior Dev With Root Access
Description:
Generative AI has become the fastest coder on the team. It never sleeps, never complains – and it ships code at a speed we’ve never seen before. But there’s a catch: GenAI writes code the way a junior developer would… with root access and no security instincts.
In this talk, we’ll break down real data from the 2025 GenAI Code Security Report, which evaluated over 100 large language models across 80 security-critical coding tasks in Java, JavaScript, C#, and Python. The results are eye-opening: 45% of AI-generated code introduced a known security vulnerability, and that number hasn’t meaningfully improved – even as models get larger and »smarter«.
We’ll explore:
- Why AI-generated code often looks correct but quietly fails security fundamentals
- Which vulnerabilities GenAI struggles with the most (and why XSS and log injection are especially bad)
- Why bigger models don’t mean safer code
- Why GenAI can’t reliably reason about data flow, trust boundaries, or user-controlled input
- A real-world cautionary tale: »Vibe coding« introduced complex business logic flaws that led to miscalculations and workflow errors, showing how AI can unintentionally amplify mistakes
Most importantly, we’ll discuss what this means for real-world development teams using AI copilots today – and how to safely integrate GenAI into your workflow without letting it ship tomorrow’s security incidents.
If you’re using AI to write code, this talk will help you understand when to trust it, when to verify it, and why »it compiled« is no longer good enough.
