BlackHat USA 2026
At BlackHat this year I was only attending and not giving a talk (unlike Defcon where I was presenting “Gone in 60 Frames – USB Video Exploitation”).
The general theme of the event, as you would expect, was heavily skewed towards AI and agentic security. This was immediately obvious both from the vendor booths in the business hall and the content of many talks throughout the conference.
The talks I chose to attend also primarily fell into the AI domain, as it was a good opportunity to increase my knowledge, determine how best to apply it to my teams’ activities (EDG) and understand the impact on the security industry with such big changes currently underway and what the future holds.
I couldn’t make all the talks I wanted to attend here due to the way BlackHat schedules talks means that multiple interesting ones can have overlapping timeslots. I will describe some of the more interesting ones I saw!
The End of Rare: Defending When Offense Is Cheap
The first talk I attended was the keynote by Dave Weston from Microsoft who is now leading Agentic Security. Dave has a huge amount of prior experience leading operating system security teams and offensive security research teams across MS before moving into the agentic domain, and I have been aware of his work for a long time. Dave provided some unique insights into what Microsoft is seeing in terms of how AI is affecting MSRC reported cases (large increases in number reported and nearly exponential increases), the impact on the ease and cost of exploitation (using MDASH) and benchmarks such as ExploitGym which are measuring the trends with agents used for exploit development.
This first talk was also very relevant to the recent work which my team (EDG) has been performing, where we have also been applying LLMs/agents to both find and exploit vulnerabilities (both human in the loop and autonomously) and tallies with my thoughts on the state of the art currently. Watch this space for more information about this!
It’s well worth checking out the slides / recording for this talk when it becomes available.
The 'Breaking' News: The OpenAI–Hugging Face Incident - A Technical Reconstruction and Its Implications for AI
The second talk, which was very much on the minds of attendees, was the “OpenAI Hugging Face Incident” and I’m going to write a bit more in depth on this. This talk has been immediately uploaded to YouTube as it is so topical with the current security industry discourse
https://www.youtube.com/watch?v=87DyyMV0kCY.
With multiple AI labs now reporting issues occurring with models going out of scope to achieve the goal, getting security right for these environments is going to be a challenge it also raises serious questions about the implications to enterprises and how to manage risks.
I recently wrote a paper about sandboxing and security controls implemented in the most common agentic harness tooling (Claude, Codex and Cursor) and how these coding agents work together so this topic was relevant:
https://www.nccgroup.com/media/jtepwx1t/nccgroup_codingagentswhitepaper.pdf
The crux of the talk is that whilst performing training the model got stuck (e.g. internet URLs it did not have available or files missing for the task), tried to reach out to other agents, the internet and exploited weaknesses a weakness in Artifactory (server-side request forgery) and shared this with the other agents using a “message board” which they created for communication. Using this the agents then figured out that it may be possible to attack external infrastructure to find answers to the task they were evaluated on. The model realized this is out of scope but because other agents were doing it, then seemed to continue.
It was noted that they disable direct access to the internet; however, outside work access is possible through package managers (to install software). Their research infrastructure looked as follows:
The model realized it had “write” access to the antifactory service and could using SSRF to gain indirect access to the internet. The model also seemed to escalate this to gain admin on antifactory:
Then finally the main incident occurred where the agents started to launch collective attacks on third party and external services:
In summary, there is a lot of information in this talk and very different opinions across the industry about it. Nevertheless, when using and deploying agents, this is going to be something which needs to be considered.
One Percent of the Tokens, All the Strategy: LLM Assisted Vulnerability Discovery in IOT and Embedded Firmware
After these two more high level talks, I attended a technical talk by Ta-Lun Yen on “One Percent of the Tokens, All the Strategy: LLM Assisted Vulnerability Discovery in IOT and Embedded Firmware”. Ta-Lun proposed a methodology for doing this and highlighted some of the strengths and weaknesses of the approach. This talk was also very relevant after having been applying LLMs to IOT myself and running into some of the same issues which Ta-Lun addressed within his talk.
Slides are available here
https://i.blackhat.com/BH-USA-26/Presentations/USA-26-Yen-LLM-Assisted-Vulnerability-REV-01.pdf
Ta-Lun’s code is available here:
https://github.com/evanslify/onepct
Cost-Effective, Private, Frontier Grade: AI Agent Exploitation with a Fine-Tuned OSS Model
Whilst a lot of talks at BlackHat were more about the usage and implementation of AI/ML tooling, the next talk I attended was real AI/ML data science – “Cost-Effective, Private, Frontier Grade: AI Agent Exploitation with a Fine-Tuned OSS Model” by two researchers from NVIDIA.
This talk proposed a new methodology for understanding how to test and manipulate real-world, autonomous tool-using agents.
I can see companies in the vulnerability research space already starting to build teams dedicated to applying these methods to both finding and exploiting vulnerabilities.
Slides are here:
One Click to System: Exploiting Bixby’s Trust Model for full device compromise
Finally, the last talk worth mentioning was presented by a previous colleague of mine, Ken Gannon who was presenting “One Click to System: Exploiting Bixby’s Trust Model for full device compromise” with Dimitrios Valsamaras. This was another Samsung mobile device logic bug chain from Pwn2Own which contained many vulnerabilities which were chained together to compromise the device. Over the years, many researchers have used logic bug chains to compromise mobile devices (myself included!) and the creativity here from the researchers was impressive. I do feel like in the age of memory safety and memory corruption mitigations making attacks significantly harder there will always be a place for logic bug chains. It is really challenging for vendors to address these chains too due often to some of the weaknesses being exploited being required or desired functionality of the device itself but can be abused in a creative way by an attacker. It will be interesting to see in the current AI / LLM climate if LLMs can be used effectively to both identify and create these types of chains (which have already been shown by other researchers).
Slides are available here:
Overall, the general quality of BlackHat talks this year was of a high standard, and the CFP board did a good job selecting talks for each of the security domains for novel research.
DEF CON 34
After 2 days of BlackHat at Mandalay Bay I then moved across to the Las Vegas Convention Centre for DEF CON. This was the first time I had attended DEF CON in the Las Vegas Convention Centre, and it had a very different feeling from prior DEF CON’s I had attended which were held in Casino’s on the strip.
One other major difference in DEF CON this year was the silent disco style presentations where everyone in the audience would wear headphones! I understand the rationale of why it was done this way, but it leads to a very different presenting and attending experience than presentations which are held within a room with walls... it will be interesting to see if this format is used going forward.
At DEF CON there was a whole lot less focus on AI and agents (as you would expect from there being no vendors!) but from the technical talks there were a number of which did have components of AI.
The talks worth mentioning were as follows:
Gone in 60 Frames – USB Video Exploitation
It would be remiss of me to not include my own talk with Robert Herrera in the list of interesting talks 😊 We presented a talk about exploiting the Linux kernel purely through a USB device inserted by an attacker. The full abstract was as follows:
In 2025, Amnesty International, in collaboration with Google TAG, released a write-up of an in-the-wild chain of USB Linux kernel vulnerabilities which was used to compromise mobile devices.
Whilst the vulnerabilities themselves were disclosed, no details on how these vulnerabilities could be exploited were provided. This led us to deep dive into these issues to determine how they could be leveraged for arbitrary code execution.
This is the story of exploiting one of these vulnerabilities (CVE-2024-53104), an out of bounds write in USB Video which offered a brilliant exploit primitive leading to highly reliable code execution when chained together with an information leakage vulnerability.
In this talk we will first discuss the in-the-wild vulnerabilities, moving on to providing background of USB specifics for several device classes and coverage guided fuzzing for finding new issues.
We will then move onto a more recent information disclosure vulnerability CVE-2025-38494 which could be leveraged to bypass KASLR.
An extensive deep dive into CVE-2024-53104 vulnerability will be performed (the OOB write) and we will discuss our novel technique used for exploitation of this issue and expose the power of the UVC_QUIRK_RESTRICT_FRAME_RATE quirk!
Finally, we will wrap up our talk with several demonstrations.
You can find the presentation material here:
Slides:
Whitepaper:
Writing to Shadow Stacks
https://defcon.org/html/defcon-34/dc-34-speakers.html#content_66628
In this talk Vladimir discussed CET shadow stacks implementation and provided several different approaches to write attacker-controlled values directly into the shadow stack.
This talk is relevant if encountering this mitigation and needing to identify a method to bypass it. I couldn’t locate the slides from this talk unfortunately and hopefully they will be published soon.
Root From Kilometers Away: Ubiquiti AirMax RCE
https://defcon.org/html/defcon-34/dc-34-speakers.html#content_66618
In this talk Federico and Gaston discussed their research into Ubiquiti AirMax. They did a detailed presentation of how the protocol works and briefly discussed the issues which they had found which leads to full over the air kernel RCE (against a Linux kernel 2. 6..). Unfortunately, they couldn’t disclose the actual vulnerability details as were under bounty embargo, but they provided a good overview of AirMax protocol and deployment.
The full slides for this talk are available here:
How much of our Bluetooth firmware reverse engineering work can now be automated with LLMs?
https://defcon.org/html/defcon-34/dc-34-speakers.html#content_66647
One of the other good technical talks at DEFCON was about using LLMs to automate reverse engineering of Bluetooth firmware. In the past I have spent a signification about time reversing different types of firmware and have also been applying LLMs to reversing as well. So, it was interesting to see Xeno’s approach to using a specification to define “Waypoints” which should be present in a firmware for Bluetooth and then use that to identify and improve the reverse engineering. I especially liked the way he developed Claude skills and then evaluated and improved these skills by comparing them against the ground truth.
The full slide deck can be found here:
The skills for the talk can be found here: