Speaker: Kevin “kdrwins” Dela Rosa (previously Snapchat, Amazon; now CTO at Cloudglue) · Source: DEF CON 34 talk page · GitHub: overcast · URL: overcast.video

📄 Download this note as Markdown

Overview

Conference talks, earnings calls, product demos, training videos — organizations put hours of footage online every week, full of things they didn’t mean to share: hostnames in terminal windows, org charts on slides, infrastructure details dropped during Q&A. Traditional OSINT can’t touch video at scale, and manual review falls apart past a handful of recordings. Overcast is a CLI agent and skill pack for video OSINT that drops into any agentic harness, giving it senses plus recon and targeting reach, organized around an investigation case. Point it at 10 videos or 1,000 and it turns footage into cited evidence: speech, video understanding, on-screen text and objects, faces, and named entities, all accumulating in persistent case memory.

Notes

Overcast Is a Video OSINT Agent

• Point it at footage, interrogate it like a case file: who is appearing, where was this filmed, cite records
• Used via CLI, with a / command for skills — tools are specific actions, skills are markdown + scripts
• 38 providers available

Structure

• Projects are organized around “cases”: pull in video, then sense (OCR, search) so the agent understands the data
• Video breaks down into speech, pixels, screen (text + diagrams), time, etc. — captions/transcripts alone don’t cover it (think conference talks with slides or commands being run that a transcript won’t capture)

Workflow

The setup command walks through what should be stored, what you’re looking for, and what senses to enable (the more specific, the better). It plans, and if you approve, implements — saving audio similarity, facial identity, time-based search, and pixel data to various databases.

Additional Features

• Visualizations, including a camera feed used to identify location and place
• “Cockpit” — a VS Code extension with a sub-agent and case views, installable via npx
• “Share mode” — usable remotely over Tailscale (tailnet)

From the Repo

• Perception is organized around modular “senses”: watch (video understanding), listen (speech/audio-scene transcription), see (on-screen text/object detection), face (facial recognition + cross-corpus matching), plus named-entity indexing, audio forensics, voice ID, and media verification. Each verb emits portable JSON records and can be rebound to a different backend without code changes.
• Distributed as an npm package (@kdrrr/overcast) or standalone binary, plus agent skills for Claude Code, Cursor, and Codex
• Prerequisites: Node.js ≥22, FFmpeg/ffprobe, Cloudglue API credentials for perception backends
• Quickstart: npm i -g @kdrrr/overcast && overcast doctor, then overcast case setup --name <case> --target "<subject>" --source web:"<query>", then overcast scan --pull && overcast ask "<question>"

Filed Under: #defcon34