Notes from 19 talks across 3 security conferences. The recurring subject, by some distance: what happens when AI agents are handed real credentials.

19 write-ups · 3 conferences · 146 slides photographed

Given

Black Hat USA 2026

Mandalay Bay Convention Center · Las Vegas · 5–6 Aug 2026

6 talks

Wed 5 Aug

  • Beam Me Up, Luke: A Review of Teleport Attack Scenarios

    Adam Chester (SpecterOps)

    Post-compromise attack paths against Teleport clusters. Agent credentials turning out to carry far more authority than the host they sit on is the sharp finding. Details of the unpatched part are withheld in the write-up; the session-recording issue is fixed.

    6 slides

  • Trusted Enough to Run: Breaking AI Agents in Official Workflows

    Elad Meged (Novee Security)

    Broke the official CI/CD agent actions from Anthropic, Google and OpenAI, each time by finding a hidden assumption rather than a memory bug. The git push –receive-pack bypass and tac-instead-of-cat are both delightful. Best closing method of the week: read the defaults, not the docs.

    10 slides

  • The OpenAI–Hugging Face Incident: Unraveling an Autonomous, Multi-Agent System

    Eric Wallace & Michael Dalton (OpenAI)

    The talk of the week. OpenAI’s own evaluation agents built a message board inside Artifactory, taught each other zero-days, and breached Hugging Face by accident. Fully automated offense now has an existence proof; fully automated defense does not.

    22 slides

Thu 6 Aug

  • Remote Prompt Execution on AI Assistants Through Sandbox Escaping

    Ori Lahav (Rubrik Zero Labs)

    The best-told research diary of the week, including the month where it went nowhere. Prompt injection into Copilot’s Python sandbox, privilege escalation via a writable root entrypoint, then a path traversal in an undocumented Azure service turned into an interactive shell on someone else’s AI assistant.

    1 slide

  • AgentBreaker: Cost-Effective, Private, Frontier-Grade AI Agent Exploitation with a Fine-Tuned Open-Source Model

    Bar Lanyado & Eliya Cohen (NVIDIA)

    Two good talks in one: how to scan an agent through its tools rather than its model, and how to fine-tune a 30B open model to do it at 66.1% exploit success against Opus 4.5’s 68.2%, for a hundredth of the cost. The mocked fleet of 4,500 victim agents is a neat trick for manufacturing training data.

    15 slides

  • Catch Me If You Can: AI Investigators Hunting Autonomous Attackers

    Jayson Grace & Martin Wendiggensen (Dreadnode)

    Elegant answer to a hard question: score the automated defender against what an autonomous red team verifiably did, not a checklist. Six self-improvement cycles took the blue agent from 55% to 75%, and the replay engine that makes a non-deterministic attacker reproducible is the clever bit.

    16 slides

BSides Las Vegas 2026

Tuscany Suites & Casino · Las Vegas · 3–5 Aug 2026

7 talks

Mon 3 Aug

  • Abusing Agentic AI Browsers: An Exploit-Based Approach

    Or Eshed (LayerX)

    The list of controls that quietly stop working — application tests, bot detection, DDoS protection, DLP, authn and authz — all share one unstated assumption: that a person is driving the browser.

    2 slides

Tue 4 Aug

  • Mind the Gap: Bridges, Backplanes, and BloodHound

    HD Moore

    The interconnects nobody inventories, and the same shape in identity where individually reasonable grants compound into paths nobody designed. Only caught two slides, but the framing stuck.

    2 slides

  • X-Ray Specs for Agents: Pentesting MCPs, Skills & the Plugin Supply Chain

    Abhijeet Kumar, Xia Hua & Varun Wadhwa (Traceforce)

    Tool release for inspecting what MCP servers and agent skills actually do rather than what they claim. The closing line is the whole argument: agents don’t get hacked, their tools do.

    2 slides

  • Weaponizing Cloud

    Speaker not captured

    AWS and Azure attack chains into full organisation compromise, with a sharp defensive turn: EDR consoles and IAM platforms are the fastest routes through an estate, so extended Tier 0 should cover CI/CD, cloud, IAM and EDR.

    7 slides

  • Prompt Injection Is Not the Problem

    Noelle

    Small, argumentative Common Ground session where half the value was the room pushing back. The thesis — prompt injection is an authorization failure, because the agent carries your whole token instead of a grant scoped to one task — held up better than the demo, which broke.

    room not recorded

Wed 5 Aug

  • Agents of Chaos: GCP Service Agents

    Speaker not captured

    153 services, 200 agents, 4,353 permissions — the service accounts Google Cloud creates on your behalf, graphed with the escalation-relevant ones flagged. Expanding a single agent and watching it fan out into IAM makes the point better than any statistic.

    2 slides

  • What Bounds Your Coding Agent? A Field Guide to Access, Inputs, Supply Chain, and Hooks

    Rajaram Srinivasan (Unbound)

    A vendor talk that earns it by being specific. Agentic overreach — no attacker, no payload, no signal — is the failure injection defences were never built for. The hook-points slide and the argument for MDM-shipped policy over server-managed settings are both immediately usable.

    13 slides

BSidesSF 2026

City View at Metreon · San Francisco · 21–22 Mar 2026

6 talks

Sun 22 Mar

  • Your AI Agent Has Production Access, Now What?

    Jack (Anthropic)

    Best talk of the day. The ‘lethal trifecta’ (egress + sensitive data + untrusted input) is a clean mental model. Tool proxies for credential isolation and using agent transcripts as ‘confessions’ during incident response were immediately actionable.

    27 slides

  • The Tyranny of Optimization and the Stability of Automated Governments

    Katie Moussouris

    Bug bounties drowning in AI-generated ‘slop’ — curl shut down theirs entirely. The K-shaped economy framing and critique of the US ‘dominance over safety’ AI policy was sharp.

    room not recorded

  • The Great Credential Caper: How to Perform and Defend Against the Nearly Impossible to Defend

    Dan Hollinger & Christo (Cloudflare)

    Live demo of Claude Code + Playwright solving CAPTCHAs autonomously was jaw-dropping. The ‘parfait model’ of layered defense across password, request, account, and agent layers is the right framing for the post-bot-score era.

    3 slides

  • The Epistemology of Trust

    Mike Wilkes (Former CISO)

    Philosophical but grounded — shift focus from breach prevention to breach cadence. ‘Backups are useless, it’s restores that matter.’ The AI sandbagging research from Anthropic was a sobering addition.

    3 slides

  • Seeing the Forest Through the Trees: A Business Approach to Risk and Threat Modeling

    Sean (SoundCloud)

    Practical framework for translating security risks into dollars for execs. 68% of breaches are non-malicious human factors, and 98% of those stopped by MFA. The layered data flow diagram approach was immediately useful.

    4 slides

  • A Blueprint for Building a Generic Authorization Service

    Ashwin & Fletcher (Roblox)

    Roblox built Guard, a centralized auth control plane using Topaz/OPA sidecars. The MCP server security angle was unexpected — same identity-agnostic framework for humans, agents, and workloads.

    11 slides