Black Hat USA

Everyone's asking whether attackers are actually going after AI systems yet. We stopped guessing and went looking. We built a global network of AI honeypots, hundreds of decoy AI servers and agents spread across clouds providers and regions, and watched who showed up. What we caught: attackers stealing compute to run their own AI workloads on our bill, turning AI tools' own features into weapons to forge server-side requests, attempts to run code and steal secrets, and even pointing autonomous hacking agents and "jailbroken" personas at our exposed AI decoy backends to attack 3rd parties, and more. This research shows real attacks, prompts, and techniques that threat actors used, and what it means for anyone deploying AI.

Coding agents slash delivery times for development teams and boost output quality, but only if operated securely. Running on user endpoints, coding agents can leak local files, invoke insecure tools, or adopt unauthorized skills. Without any hard code, threat actors can hijack coding agents and invoke risky activity directly inside an organizations production database. In this talk, see how coding agents can easily chain privilege escalation to accomplish nefarious goals, and how to prevent them from going rogue.

Agentic security isn't hard because it's new. It's hard because it breaks the assumptions our security models are built on. We keep trying to secure agents when what's actually needed is to govern agency, and those are fundamentally different problems. This talk exposes eight hidden assumptions baked into modern security architectures, ones that adaptive, goal-driven systems expose ruthlessly, and offers security leaders a systems-based lens to spot controls that are structurally incapable of working, reason about risk through the four dynamics that shape all systems (control, decision-making, flow, feedback), and build controls that constrain causes instead of chasing behavior.

Agentic browsers represent a new manifestation of AI risk. With persistent access and long horizon goals, the threat vectors for Claude in Chrome are innumerous and frequently changing. In this talk, see how Claude in Chrome is built, broken, and requires hard boundaries built in code, not training

Agentic browsers are tearing down decades of web security to enable AI autonomy: breaking Same-Origin Policy, granting raw localhost and filesystem access, and running scripts on any site, with model alignment as the only real defense. We introduce PleaseFix, a new ClickFix-style vulnerability class that targets agents instead of humans, and Intent Collision, a universal technique to exploit it, then chain them into full 0-click attacks on flagship agentic browsers achieving account takeover, data theft, persistent implants, and remote code execution. We also break down which defenses actually held, and why code-enforced boundaries beat model training every time. Walk away with concrete hardening steps you can apply today, no vendor patch required.