AI Agents Take Center Stage at Black Hat USA 2026

Date: August 5-6, 2026 | Mandalay Bay, Las Vegas

‍

Of 121 total briefings at Black Hat USA 2026, 35 talks are directly relevant to AI security, AI red teaming, or LLM-assisted offensive security. That is nearly 29% of the entire conference. 

AI security is unquestionably the dominant theme of Black Hat 2026, and the research below maps exactly where the field is moving, what to watch, and what it means for red teamers and defenders alike.

The three macro themes defining AI security this year

1: Agentic systems are the new attack surface

The majority of offensive AI research targets autonomous agents, not base models. The shift from "prompt injection as a curiosity" to "agent exploitation as a discipline" is complete.

2: LLMs as offensive tools have matured

Multiple talks demonstrate LLMs autonomously discovering 0-days, writing kernel exploits, and conducting novel security research -- no longer demos, but production-grade results.

3: Defense is scrambling to catch up

New frameworks for threat modeling, sandboxing, and monitoring AI agents are being proposed, but the offensive research far outpaces defensive tooling.

Attacking AI agents and agentic systems: The largest cluster of talks

This is where the field is moving fastest, and where the largest cluster of Black Hat 2026 talks lives.

Must see talks

No tools required: Post-injection exploitation across AI agent frameworks

Speakers: Yarden Porat, Shahar Tal (Check Point)

When: Wed Aug 5, 2:35pm | Jasmine, Level 3

Goes beyond prompt injection and tool abuse to show that many agent frameworks (LangChain, CrewAI, AutoGen, Semantic Kernel) have exploitable logic in their core runtimes—memory stores, planning loops, serialization layers. The key insight: even without tool access, injected content can hijack agents through framework internals. Introduces techniques including delayed-execution injection across conversation turns, cross-agent propagation in multi-agent setups, and persistent memory poisoning.

‍

Why it matters: Reframes agent security from "control the tools" to "the framework itself is the vulnerability."

Trusted Enough to Run: Breaking AI Agents in Official Workflows

Speakers: Elad Meged (Novee Security)

When: Wed Aug 5, 3:35pm | Mandalay Bay H, Level 2

Targets AI agents running as trusted, unattended automation in official workflows (GitHub, Slack, Jira integrations). Identifies failures in internal pipeline stages—approval, sanitization, and reuse decisions—that can be exploited through cross-session prompt residue, synthetic tool outputs, and cached reasoning reuse. Tested against agents from OpenAI, Anthropic, Google, and open-source frameworks.

‍

Why it matters: Attacks the trust assumptions of "official" agent deployments, not toy demos.

The CoreBreak Attack: Turning AI Agents into Credentials Exfiltration Vectors

Speakers: Hedi Ingber, Aviyam Ivgi (Stealth)

When: Wed Aug 5, 12:00pm | Oceanside D, Level 2

Deep dive into managed agent platforms (cloud provider AI services) to uncover security assumptions that don't hold. Shows how to turn AI agents into credential exfiltration vectors by exploiting the platform's own trust model.

Promptware EOD: Skillful Agent Detonation

Speakers: Francesco Montorsi et al. (Zenity)

When: Thu Aug 6, 3:35pm | South Seas C&D, Level 3

Treats the AI agent supply chain as a malware delivery vector. Malicious payloads hide in skill markdown files, rug-pulled MCP servers, misaligned models, and weaponized posts. Introduces "Promptware EOD"—a detonation chamber for AI agent supply chain artifacts using red team simulations with agent honeypots and behavioral analysis. Open-sources the framework.

Why it matters: First serious attempt at building malware analysis tooling for the AI agent ecosystem.

When Agentic Glue Melts: Exploiting Cloudflare CodeMode and Workers

Speakers: Yarden Porat, Shahar Tal (Check Point)

When: Thu Aug 6, 3:35pm | Mandalay Bay G, Level 2

Started as research into Cloudflare Code Mode (LLM-driven tool orchestration) but found broader issues. The typed API and TypeScript execution inside workers creates a new attack surface where prompt injection leads to code generation that runs with the agent's full privileges. Demonstrates sandbox escapes and cross-tenant attacks.

Bye Bye AI: How We Hacked the AI Shopping Assistant of a Top 3 US Retailer

Speakers: Netanel Rubin, Dan Avraham (Rein Security)

When: Wed Aug 5, 10:15am | South Seas A&B, Level 3

Real-world red team engagement against a major US retailer's AI shopping assistant. Bypassed guardrails, exfiltrated customer data, and manipulated purchase flows. Shows the gap between AI assistant capabilities and the security maturity of the organizations deploying them.

Cost-Effective, Private, Frontier-Grade: AI Agent Exploitation with a Fine-Tuned OSS Model

Speakers: Bar Lanyado, Eliya Cohen (NVIDIA)

When: Thu Aug 6, 10:15am | Mandalay Bay G, Level 2

Demonstrates that a fine-tuned open-source model can match frontier models (GPT-4o, Claude, Gemini) at exploiting AI agents—at a fraction of the cost and with full privacy. Introduces WASP-OS, an open-source offensive security model specifically fine-tuned for agent exploitation. Benchmarks it against commercial models on tool-calling exploitation, prompt injection, and multi-step attack chains.

Why it matters: Democratizes AI agent red teaming. Attackers don't need API access to frontier models.

Attacking and Defending AI Browsers

Speakers: Artem Chaikin (Brave Software)

When: Wed Aug 5, 12:00pm | Oceanside B, Level 2

From a browser vendor's perspective: how AI browser assistants that can autonomously navigate and interact with web apps introduce vulnerabilities that can't be mitigated by traditional web security mechanisms. Covers both attack techniques and defensive architecture from Brave's experience.

Also Notable

• ChatMate: Remote Prompt Execution on AI Assistants through Sandbox Escaping (Ori Lahav, Rubrik Zero Labs) — Novel "Remote Prompt Execution" vulnerability class where attackers gain interactive prompt access on victim chat sessions via sandbox escape. Thu Aug 6, 11:05am.
• You Can't Patch a Mental Model: How Agentic Systems Expose our Hidden Security Assumptions (Ben Hanson, Zenity) — Philosophical/architectural talk on why our security mental models fundamentally break with agentic systems. Thu Aug 6, 11:05am.

LLMs as offensive weapons: No longer theoretical

LLMs are being used as weapons for finding and exploiting vulnerabilities, and the talks below show this is no longer theoretical.

Must-See Talks

The 0-Day Engine: Finding 100+ Vulns with LLMs in Chrome and Android

Speakers: Fangang Bu, Huiming Liu (Tencent Security Xuanwu Lab)

When: Thu Aug 6, 2:35pm | Oceanside A, Level 2

Built an automated pipeline that found 100+ logic vulnerabilities in Chrome and Android—high-value, heavily-audited targets where traditional fuzzing misses logic defects. Solved the hallucination problem for large codebases. This is the talk to attend if you want to understand where automated vuln discovery is heading.

Can AI Do Novel Security Research? Meet the HTTP Terminator

Speakers: James Kettle (PortSwigger)

When: Wed Aug 5, 12:00pm | Oceanside A, Level 2

James Kettle built an autonomous system that doesn't just find bugs—it invents new attack techniques and uses them to hack live websites at scale. Discovered novel HTTP desync triggers, a new poisoning vector targeting cloud-scale reverse proxies, and a category of dual-parser attacks. Earned $supported bounties from production systems.

Why it matters: Crosses the line from "AI finds known bug classes" to "AI discovers novel attack research."

Prompt2Own: Real-World Kernel Exploit Development with LLMs

Speakers: Kareem Shehada et al. (UC Riverside)

When: Wed Aug 5, 4:30pm | South Seas C&D, Level 3

End-to-end kernel exploit development with LLMs: from bug trigger PoC through heap grooming, race condition stabilization, to working privilege escalation. Tested on real Linux kernel CVEs. Demonstrates that LLMs can handle the hard parts of exploit development, not just the boilerplate.

Closed Loop: From Autonomous Exploit to Deployed Defense in Under 5 Minutes

Speakers: Conor Sherman (Sysdig), Sherwyn Moodley (Bagheera Labs)

When: Thu Aug 6, 11:05am | Mandalay Bay G, Level 2

Builds a closed-loop system where AI autonomously generates exploits for new CVEs and simultaneously produces deployed defensive signatures—in under 5 minutes. Demonstrated on real CVEs including CVE-2026-33017 and React2Shell. The offensive and defensive sides feed each other.

Also Notable

• One Percent of the Tokens, All of the Strategy: LLM-Assisted Vulnerability Discovery in IoT and Embedded Firmware (Ta-Lun Yen, TXOne Networks) — LLM-guided binary analysis for IoT/embedded targets. Thu Aug 6, 11:05am.
• From 8 Bytes to Full Compromise: AI-Assisted Exploitation of a Widespread USB Flaw in a Dual-SE Hardware Wallet (Onekey Anzen Team) — AI-assisted hardware wallet exploitation. On-Demand.
• Sift or Get Off the PoC: Applying Information Retrieval to Vulnerability Research (Caleb Gross) — Using LLMs for signal-finding in stripped binaries during vuln research. Thu Aug 6, 10:15am.
• Cracking the Chains: Accelerating Ransomware Recovery via LLM-Assisted Engineering and Verification — Using LLMs to reverse-engineer ransomware crypto and find implementation flaws. Thu Aug 6, 10:15am.
• ThreatForest: Automated Attack Trees from Source Code (Daniel Begimher, Cristian Leo, AWS) — LLM+transformer pipeline to auto-generate attack trees from source code. Thu Aug 6, 2:35pm.

AI platform and infrastructure attacks: Targeting what runs the models

This category targets the infrastructure that runs AI, not the models themselves.

Must see talks

A Billion-User Blast Radius: Owning ChatGPT's Secure Sandbox

Speakers: Simcha Kosman (Palo Alto Networks)

When: Wed Aug 5, 3:35pm | South Seas A&B, Level 3

Full exploitation chain against ChatGPT's sandbox: file-parsing abuse for persistent root execution, hijacking the hidden python.exec reasoning channel (Reasoning Injection Attack), bypassing network isolation via Task Scheduler URL laundering, and building a C2 channel using JFrog authentication rate limits as a covert signaling protocol. Cross-tenant data exfiltration demonstrated.

Why it matters: Most complete public exploit chain against a production AI platform. Demonstrates that AI sandbox security is far behind traditional sandbox security.

When AI Attacks AI: Inside the Self-Propagating Botnet Built on Compromised AI Infrastructure

Speakers: Gal Elbaz, Avi Lumelsky (Oligo Security)

When: Thu Aug 6, 10:15am | Oceanside A, Level 2

First documented in-the-wild campaign (ShadowRay 2.0) where AI infrastructure (Ray clusters) isn't just targeted but weaponized into a self-propagating botnet. Compromised clusters autonomously scan for and infect other Ray deployments. Evidence of a global operation.

Why it matters: Moves from "AI infra has vulns" to "AI infra is being actively weaponized at scale."

AI defense and frameworks: How to actually secure these systems

Caging the Agent: How Roblox Built Multi-Layer Sandboxes to Secure Claude Code at Enterprise Scale

Speakers: Harshit Kumar, Jaskaran Singh, Ahmad Alomari (Roblox)

When: Thu Aug 6, 3:35pm | South Seas A&B, Level 3

Started when a hidden instruction in a GitHub Issue convinced Claude Code to upload Roblox credentials to a public repo—EDR saw nothing. Documents the multi-layer sandbox architecture Roblox built in response: filesystem virtualization, network policy enforcement, credential isolation, and behavioral monitoring for AI coding agents. Practical, battle-tested defensive architecture.

Why it matters: Most detailed public account of securing AI coding agents at enterprise scale.

Rules for Neural Traffic: A New Defensive Layer for LLMs

Speakers: Yisroel Mirsky et al. (Ben-Gurion University)

When: Wed Aug 5, 2:35pm | Oceanside B, Level 2

Proposes adapting the Snort/YARA paradigm to LLM traffic: a rule-based inspection layer that sits between users and models, using deterministic pattern matching on token streams. Rules can detect and block prompt injection, jailbreaks, and data exfiltration patterns. Community-sharable rule sets. Introduces an open-source engine, LLMFirewall, with benchmarks against adversarial attacks and RLHF-trained defenses.

Threat Modeling LLMs: The PHANTOM-B model

Speakers: Adam Shostack (Shostack + Associates)

When: Wed Aug 5, 11:05am | Oceanside C, Level 2

From the author of the standard threat modeling textbook: a practical, speed-optimized threat model specifically for LLM products. PHANTOM-B is designed for engineering teams shipping under pressure -- not academic thoroughness but actionable threat identification. Positions against MITRE ATLAS and NIST AI RMF as complementary but faster.

From Prompts to Pipelines: Building Agentic Detection Engineering and Threat Hunting

Speakers: Shoufu Luo, Zhenda Hu (Roblox)

When: Wed Aug 5, 11:05am | Oceanside B, Level 2

Two agentic AI frameworks: "AI Detection Engineer" (multi-agent pipeline for detection rule authoring) and an automated threat hunting system. Practical defensive tooling from Roblox's security team.

Catch Me If You Can: AI Investigators Hunting Autonomous Attackers as a Benchmark

Speakers: Jayson Grace et al. (Dreadnode)

When: Thu Aug 6, 12:00pm | Oceanside B, Level 2

Proposes a new benchmark methodology where AI blue team agents face off against AI red team agents in real-time. Moves beyond stale CTF-style benchmarks to continuous adversarial evaluation.

Beyond Detection: What We Learned Testing Every AI Approach to Vulnerability Classification

Speakers: Arshan Dabirsiaghi (Pixee)

When: Thu Aug 6, 12:00pm | Mandalay Bay H, Level 2

Systematic evaluation of every AI approach (embeddings, RAG, chain-of-thought, multi-agent) for classifying vulnerabilities. Practical lessons on what works and what doesn't.

Policy, Strategy, and the Big Picture

Alongside the technical research, several sessions tackle AI security at the policy and strategy level:

• The Intent Gap: Where Every AI Regulation Falls Short (Jeff Pollard, Heidi Shey, Forrester) examines why no current AI regulation handles autonomous decision-making.
• The Good, the Bad, and the Ugly of AI Security (Fred Heiding, Menlo Park Intelligence; Chris Inglis, Former USG) covers selective model access programs, offensive AI capabilities, and AI-driven social engineering.
• Multiple government and industry panels, including sessions featuring NIST, CISA, UK NCSC, and Columbia University, address AI and cyber resilience at the policy level.

Key Takeaways for AI Red Teamers

1. Agent frameworks are the soft underbelly. LangChain, CrewAI, AutoGen, Semantic Kernel: their runtimes have exploitable internals beyond just tool abuse. Focus red team efforts on framework-level primitives.
2. MCP servers and skill files are the new supply chain. Promptware EOD shows this is becoming a real malware vector. Red teams should test agent supply chains the way they test npm/PyPI.
3. "Official" integrations provide false confidence. GitHub Actions, Slack bots, Jira automations with AI agents inherit trust they haven't earned. Test the trust boundaries of unattended agent workflows.
4. Browser agents are regressing security. SOP bypass, localhost access, filesystem access, all by design. Red teams need to test agentic browser features as a new attack surface category.
5. Fine-tuned OSS models can match frontier models for attacks. WASP-OS from the NVIDIA talk means attackers don't need expensive API access. Defensive assumptions about attacker capability ceilings are wrong.
6. The sandbox isn't enough. ChatGPT, Cloudflare workerd, Claude Code: sandbox escapes are demonstrated across all major platforms. Defense-in-depth with behavioral monitoring is required.
7. LLM-powered vuln discovery is production-ready. 100+ vulns in Chrome/Android (Tencent), novel attack techniques on live sites (Kettle), kernel exploits (Prompt2Own). Plan for a world where vulnerability discovery is 10-100x faster.