All Articles

Defenders have long been protected by a budget constraint that belonged to the attacker. Deep attention was expensive, so it was rationed, so most of your estate never received any. Black Hat USA 2026 and DEF CON 34 were the week that assumption stopped being safe to hold.

Microsoft's David Weston named it from the keynote stage on 5 August, in a talk titled "The End of Rare: Defending When Offense Is Cheap".¹ He put numbers on it from the stage. Pointed at 200 Linux kernel vulnerabilities, a Microsoft system generated crash-level proofs of concept for 182 of them, at an average compute cost of $3.61 and 21 minutes each.²

That is the economics behind everything below. Eight pieces of research across the two conferences show what follows when attacker reasoning stops being scarce. This note states what each one breaks, sources every claim, and is honest about the one judgment it cannot make for you.

What would change this reading. Evidence that the agent marketplace vector is sustained rather than opportunistic, or a second team reproducing the AI research result without a specialist in the loop. Either would move items below from watch to fund.

The eight findings, and the column nobody can fill

Everything below is public and sourced. The last column is the one that sets your order, and it is mostly empty. A disclosure document exists to prove a technique works. It is not written to tell you whether anyone is using it against you yet, so where we could not source an answer we have left one.

Last column is our reading, not the researchers'. Where it says "not established" we could not find a source that answers it either way. The three rows we could answer are answered from the disclosures themselves, not from any assessment of your sector.

Eight rows. You will action three. Five blanks in the column that decides which three, and no amount of further reading fills them, because nobody publishes what attackers picked up last month. The rest of this note gives you the mechanism behind each row.

1. The supply chain attack moved up a layer

The most operationally relevant disclosure of the week was not a memory corruption bug. It was a distribution problem.

Michael Bargury and Tamir Ishay Sharbat of Zenity presented "Promptware EOD: Skillful Agent Detonation", on a credential-stealing campaign distributed through an AI agent skills marketplace.⁵ Zenity's disclosure puts it at more than 1.7 million aggregate installs, via typosquatted look-alikes of two widely used services.⁴ The payload was not a binary. It was installation instructions that caused the agent itself to fetch and run attacker-controlled code.

What it collected: SSH keys, cloud credentials, Git and package manager tokens, Kubernetes and Docker configurations, database credentials, infrastructure-as-code credentials, environment files and service account files, packaged with host metadata and sent to attacker infrastructure.⁴ That is the contents of a developer workstation, which in most organizations is a working path to production.

The structural finding is in Zenity's own research write-up rather than the press release: more than 30 percent of the malicious skills abused the agent itself as a malware dropper, and behind the live campaign sat hundreds of reserved but empty package names, staged for later use.³ The marketplace operators removed the identified threats within hours of notification.^3,4 The reserved names are still reserved.

Five years of supply chain work went into dependency provenance: SBOMs, signed artifacts, registry allowlists. None of that machinery reads a markdown file that tells an agent what to do.

Open question. One campaign, removed within hours. Sustained offensive investment, or an opportunistic land grab the marketplaces will now police? That answer decides whether this is a Q4 control change or a watch item.

2. The sandbox that was not a sandbox

At DEF CON 34, Vladimir Tokarev and Saar Pearl of Cyera presented "WASM Was Not the Boundary: Sandcastles, Not Sandboxes," on products that run untrusted Python in the browser using Pyodide, a WebAssembly build of CPython. Seven of them relied on Python-level restrictions that did not isolate untrusted code from the host.⁶

The mechanism generalizes beyond Pyodide, which is why it matters. WebAssembly does not stop code reaching capabilities the embedding environment deliberately exposes. In the researchers' words, ctypes.CDLL(None) loads the main program's symbol table, the equivalent of dlopen(NULL) in C, and in Pyodide the main program is the Emscripten-compiled WASM module.⁶ From there, Emscripten's own exports reach the host JavaScript runtime. The Python-level restrictions never covered that path.

What an escape reaches depends on what embeds the sandbox, and the researchers are specific about it: in Node.js, the credentials, OAuth tokens, database access and API keys available to the service process; in CI/CD, release credentials, signing keys and source checkouts; in agent frameworks, delegated credentials and tool access.⁶

Seven products is the set two researchers chose to examine, not the set that is affected. Nothing in the disclosure tells you how many agent tools already running in your estate share the architecture. Start with anything that offers users a formula bar, a code cell or a "run this snippet" box.

3. AI found a new bug class, and the human was not optional

James Kettle, Director of Research at PortSwigger, built HTTP Terminator to settle whether AI can do original security research or only rediscover known patterns. The work was presented as "Can AI Do Novel Security Research? Meet the HTTP Terminator" at both conferences.⁹

The system worked from 138 specifications, generated roughly 15,000 micro-inspiration fragments and 30,000 unique attack vectors after deduplication, and confirmed roughly 700 vulnerable systems against authorized live targets.^9,10 Exploitable flaws turned up in BeyondTrust Secure Remote Access, F5 BIG-IP, Citrix NetScaler, and Apache Traffic Server, where the autonomous cascade produced a zero-day, CVE-2026-63078.⁹

It also produced a vulnerability class nobody had named: shared-parser confusion. The mechanism is worth understanding because it is an architectural pattern, not a bug. Many servers use the same parsing code for HTTP requests and HTTP responses. Because the code path is shared, response-specific parsing rules get applied to inbound requests, and as the research puts it, "any response-processing feature could be exploited by a request".⁹

The worked example is a content type the RFCs specify as response-only. Send Content-Type: multipart/byteranges on an inbound request and servers that reuse response-parsing logic will process it, with front end and back end disagreeing about where the message ends. That disagreement is the desync.⁹

Where that class came from should shape how you staff this. It emerged in the human-guided cascade phase, not from autonomous operation. The paper is direct: the system's power is unlocked by putting a researcher back in at exactly one point, the discovery cascade.¹⁰ An experienced researcher amplifies an AI research system rather than being replaced by one.

The question is no longer whether AI can find novel vulnerabilities. It is where in your process a human has to stand for that to happen.

Open question. PortSwigger put one of the field's most experienced request smuggling researchers at that point. Does the same amplification work with an ordinarily competent operator, or collapse without the expertise? That is the difference between a technique a few specialists run and one your threat model must assume is commodity.

4. Three boundaries that stopped holding

NAT is not a segmentation control

Malcolm Stagg of the Synack Red Team disclosed NatJack at Black Hat USA 2026, in a session titled "Breaking Trust Boundaries: Exploiting Design Assumptions in Network Infrastructure." Four techniques are described: hijacking active TCP connections, poisoning DNS responses, identifying the ports assigned to other connections, and forcing denial of service by exhausting a device's NAT table.¹¹

Two CVEs cover implementation-specific flaws: CVE-2026-56181 in Windows NAT in Hyper-V, and CVE-2026-63913 in the Linux netfilter conntrack subsystem.¹¹

The part that matters for planning is the remediation status, and it is stated plainly by the researcher's own employer. Available fixes, including Linux kernel 6.6.142 and later and FreeBSD 15.0 and later, "raise the difficulty of exploitation but do not close the underlying design gap".¹¹ The guidance is to prioritize encryption in transit, segmentation that isolates untrusted workloads, and IP Source Guard, and to look first at environments where trusted and untrusted workloads sit behind the same NAT table.^11,12

Code signatures survived the hijack

Patrick Wardle's DEF CON 34 talk, "Dylib Hijacking on macOS: Dead or Alive?", demonstrated the technique still working against macOS 26.^13,14

The reason the signature survives is worth knowing, because it tells you what to look for instead. The technique abuses two legitimate loader behaviors.¹⁵ A weak dylib, declared with LC_LOAD_WEAK_DYLIB, is an optional dependency: if it is missing the loader continues rather than aborting, so planting a file at the path of a dependency that was never shipped gets your code loaded. Separately, run-path dependencies declared with @rpath are searched across several directories in order, so a library planted in an earlier directory is found first. In both cases the loader does exactly what it was designed to do, and the application's own signed contents are untouched.

If your macOS detection treats a valid signature as evidence of integrity, that is the assumption under test. Wardle's own write-up points at the detection that does work, watching what actually gets mapped into the process rather than whether the bundle still verifies.¹⁴

Patchless hooking, shipping since Windows 7

Yoann Dequeker of Wavestone ran a four-hour DEF CON 34 workshop, "Explore the Windows Instrumentation Callback", covering weaponizing the mechanism for execution hijacking, process injection and beacon obfuscation. The workshop abstract describes Nirvana Debug as a type of instrumentation callback existing since Windows 7.¹⁶ The technique itself was first published by Alex Ionescu at Recon in 2015.¹⁷

The mechanism explains why hook-scanning misses it. An instrumentation callback is a per-process user mode callback on system traps, registered through NtSetInformationProcess and stored by the kernel in the process structure.¹⁸ It fires at the moment the kernel returns to user mode after a syscall completes, before the original return instruction runs, which makes it the first code to execute on the way back. Nothing in ntdll is patched. Disassemble the syscall stubs and they are clean, because the redirection happens in kernel-managed control flow rather than in the user mode bytes your tooling inspects.

For a detection engineering backlog, the age of the primitive is the point. This is not a new Windows feature being abused. It is an eleven-year-old published technique that most detection content never covered, and a scanner looking for patched function prologues will report clean forever.

These three sit at very different distances from your environment. One needs position behind a shared NAT, one needs a macOS fleet, one is a primitive from 2015. Their CVSS scores say nothing about which deserves your next sprint.

5. The human layer stopped being the cheap one to defend

Awareness training rests on an assumption about volume: that attempts are numerous but unconvincing, and a trained employee learns to spot the tells. Two separate developments put pressure on each half of that.

On the volume side, Daniel Fabian, Head of Google Red Teams, published a position piece during Black Hat week arguing that red teams must build their own agentic systems, and that "the side that operationalizes agents first sets the tempo".²⁰ Read next to Weston's $3.61 figure, the volume ceiling is the thing that moved.

On the quality side, Dr Megan Squire, Principal Threat Intelligence Researcher at F-Secure, presented "What Scammers Know That Social Engineers Don't: Three Techniques for Tough Cases" at DEF CON 34's Social Engineering Community village.¹⁹ The three techniques, awareness hijacking, complexity-as-crucible and first win, are drawn from criminal fraud research and are built for cases where, in the session's own words, "targets may be on high alert or trained against falling for more traditional manipulation techniques."¹⁹

That is the uncomfortable pairing. One removes the ceiling on volume. The other is built specifically for the people your training has already reached. Neither is a vulnerability you can patch, and neither appears in a scan.

Open question. Re-scoping a phishing program around attacks designed for trained people is a budget line. Whether to spend it this year depends on whether these techniques have reached the crews that actually target your sector.

The decision this note cannot make for you

Four of the five recommendations at the top are cheap, reversible and correct regardless of how the year goes. Make them.

The fifth is different, and here is what it looks like in practice. Do you fund a detection engineering sprint on instrumentation callbacks this quarter, or defer it twelve months? That is a team's worth of time either way, and it turns entirely on whether the primitive sits in tooling your likely intrusion sets already carry, or is still run by hand by a few specialists. The CVSS score does not say. The paper does not say. Get it wrong one way and you burn a quarter of detection capacity on something nobody is using against you. Get it wrong the other way and you are blind to it for a year.

The same shape applies to rebuilding segmentation that leans on NAT, and to re-scoping a phishing program. Each is a budget line, and each depends on a judgment the published record will not make.

There is no survey of what red teamers adopted in August. Nobody runs one, and if they did it would land next spring. What exists instead is the people who were in the rooms.

Zak Raxter is one of them. He runs red teaming, adversary emulation and incident forensics, with over a decade in offensive security and prior roles at Juniper Square, Prudential Financial and Mosaic Group. He was at both conferences, and he is not reporting on them.

The published agenda is three questions: how AI is reshaping attacker tactics across reconnaissance, exploitation and attack chaining; which emerging techniques and broken assumptions warrant attention; and how security teams should adapt.²¹ Twenty minutes, with time to put your own question to him.

One caveat, stated plainly because this is a peer community and not a marketing channel. This is one practitioner's read, not an industry survey, and one operator's kit is a sample of one. It is also the only direct evidence available on the commodity question right now, and normally you have to be in the right room to hear it.

Questions security leaders are asking

What changed in the attacker playbook at Black Hat and DEF CON 2026?

The dominant shift was the falling cost of attacker reasoning, framed in Microsoft's David Weston keynote "The End of Rare: Defending When Offense Is Cheap," where he reported generating crash-level proofs of concept for 182 of 200 Linux kernel vulnerabilities at an average $3.61 and 21 minutes each. Supporting research showed AI-assisted discovery of a new vulnerability class, agent instruction files used as a supply chain vector, and sandbox, NAT and code signing boundaries demonstrated as bypassable.

What was the malicious AI skills campaign disclosed at Black Hat USA 2026?

Zenity Labs disclosed a credential-stealing campaign distributed through an AI agent skills marketplace, reported at more than 1.7 million aggregate installs. Typosquatted skills impersonated popular services and inserted installation instructions causing agents to execute attacker-controlled code, which harvested SSH keys, cloud credentials, Kubernetes and Docker configurations, database credentials and environment files. More than 30 percent of the malicious skills catalogued abused the coding agent itself as a malware dropper.

What is the Pyodide sandbox escape presented at DEF CON 34?

Researchers from Cyera showed that seven products running untrusted Python via Pyodide relied on Python-level restrictions rather than runtime isolation. Calling ctypes.CDLL(None) loads the main program's symbol table, which in Pyodide is the Emscripten-compiled WASM module, and Emscripten's exports then reach the host JavaScript runtime. Four CVEs were published, scored 8.3 to 9.9 by the researchers, covering n8n, cohere-terrarium, Grist and smolagents, with langchain-sandbox, stlite and cibuildwheel also affected.

What is shared-parser confusion?

Shared-parser confusion is a vulnerability class named by PortSwigger's HTTP Terminator research. Many servers use the same parsing code for HTTP requests and responses, so response-specific parsing rules get applied to inbound requests. The practical consequence is that any response-processing feature becomes reachable from a request. The worked example sends a Content-Type of multipart/byteranges, which the RFCs specify as response-only, on an inbound request, causing front end and back end to disagree about where the message ends.

Can AI do original security research?

PortSwigger's HTTP Terminator research found that it can, with a qualification. The system generated roughly 30,000 attack vectors and confirmed roughly 700 vulnerable systems, produced the previously unnamed shared-parser confusion class, and found a zero-day in Apache Traffic Server. The new class emerged during the human-guided discovery cascade rather than fully autonomous operation, leading the researchers to conclude that an experienced researcher acts as an amplifier for an AI research system.

What is NatJack and does it affect my network?

NatJack is a class of attacks disclosed at Black Hat USA 2026 by Malcolm Stagg of the Synack Red Team, manipulating NAT connection tracking state to hijack TCP sessions, poison DNS responses, identify ports assigned to other connections, and exhaust NAT tables. Two CVEs cover implementation flaws in Windows NAT in Hyper-V and in Linux netfilter conntrack. Available fixes raise the difficulty of exploitation but do not close the underlying design gap, so the recommended controls are encryption in transit, segmentation of untrusted workloads and IP Source Guard.

How should a CISO prioritize conference research?

Separate the findings that justify a cheap, reversible control change regardless of likelihood from the ones that need a judgment about how widely a technique is actually used. The first group can be actioned straight from the published record. The second needs an operator's read on whether a technique has moved from specialist to commodity, which disclosure documents are not written to provide.

Is the Turbo Talks session free, and what if I cannot attend live?

The session is free. One registration covers all seven sessions in the series, and registered attendees are sent the recording if they miss a session.

Evidence

Every factual claim above resolves to one of the sources below. Source type is given so you can weigh each one: a researcher's own paper or a vendor's own disclosure is stronger than a conference recap, and we have said where a figure appears only in one place. All accessed 1 October 2026.

Disclosure. The session referenced in this note is part of Turbo Talks. Technology Partner: FireCompass, who produce and deliver every session in the series. CISO Platform hosts it for the community. The research summarized above is independent of both.

Vendor and product names appear only where they are factually part of the disclosed research, and nothing here is an endorsement. Where a figure is reported in one place only, or where sources disagree, the Evidence list says so. The open questions are genuinely open at the time of writing, and we will update this page after the session with what was said about them.