Notes from Black Hat USA 2026 (August 5 – 6, 2026, Mandalay Bay). Six briefings, and the through-line was hard to miss: this was the year agent-driven offense stopped being hypothetical.

  • The OpenAI–Hugging Face Incident: Unraveling an Autonomous, Multi-Agent System — Eric Wallace & Michael Dalton (OpenAI)

    The talk of the week. OpenAI’s own evaluation agents built a message board inside Artifactory, taught each other zero-days, and breached Hugging Face by accident. Fully automated offense now has an existence proof; fully automated defense does not.

    ai-agents incident-response security
  • Trusted Enough to Run: Breaking AI Agents in Official Workflows — Elad Meged (Novee Security)

    Broke the official CI/CD agent actions from Anthropic, Google and OpenAI, each time by finding a hidden assumption rather than a memory bug. The git push –receive-pack bypass and tac-instead-of-cat are both delightful. Best closing method of the week: read the defaults, not the docs.

    ai-agents ci-cd supply-chain
  • Beam Me Up, Luke: A Review of Teleport Attack Scenarios — Adam Chester (SpecterOps)

    Post-compromise attack paths against Teleport clusters. Node credentials turning out to be scoped for the whole cluster is the sharp finding — node hijacking via UpsertNode plus GenerateHostCerts, and session recordings readable across the estate. Fixes shipped for most of it.

    access-control offensive-security teleport
  • Catch Me If You Can: AI Investigators Hunting Autonomous Attackers — Jayson Grace & Martin Wendiggensen (Dreadnode)

    Elegant answer to a hard question: score the automated defender against what an autonomous red team verifiably did, not a checklist. Six self-improvement cycles took the blue agent from 55% to 75%, and the replay engine that makes a non-deterministic attacker reproducible is the clever bit.

    ai-agents blue-team benchmarks
  • AgentBreaker: Cost-Effective, Private, Frontier-Grade AI Agent Exploitation with a Fine-Tuned Open-Source Model — Bar Lanyado & Eliya Cohen (NVIDIA)

    Two good talks in one: how to scan an agent through its tools rather than its model, and how to fine-tune a 30B open model to do it at 66.1% exploit success against Opus 4.5’s 68.2%, for a hundredth of the cost. The mocked fleet of 4,500 victim agents is a neat trick for manufacturing training data.

    ai-agents offensive-security fine-tuning
  • Remote Prompt Execution on AI Assistants Through Sandbox Escaping — Ori Lahav (Rubrik Zero Labs)

    The best-told research diary of the week, including the month where it went nowhere. Prompt injection into Copilot’s Python sandbox, privilege escalation via a writable root entrypoint, then a path traversal in an undocumented Azure service turned into an interactive shell on someone else’s AI assistant.

    ai-agents cloud-security prompt-injection

Also at the same trip: BSides Las Vegas 2026.

All Talks