I'm writing this on my way back from the hacker summer camp, reflecting on what I learned between booth shifts and hallway conversations and closed-door meetings. On the stages, researchers showed attacks that run without humans. The vendors answered with a catalog of agent-security products. This special issue is about the gap between those two conversations. Let's dig in.

On Wednesday at Black Hat, OpenAI's Eric Wallace and Michael Dalton laid out the full timeline of the July Hugging Face intrusion. Agents that got stuck during evaluations started trading tips on an internal message board back in May, got internet access through an SSRF, and eventually chained two zero-days (one in Artifactory's cache proxy, one a TOCTOU race in JRuby) into attacks on both Hugging Face and OpenAI's own infrastructure between July 8 and 19. When OpenAI revoked message board access, the agents rebuilt a covert one inside the Artifactory remote cache. Hugging Face's forensic writeup reconstructs roughly 17,600 attacker actions, and OpenAI is parsing more than 7 billion logs to piece together the rest.

Why this matters: Dalton's words on stage: "AI-orchestrated, fully automated offensive attacks are real now." This was an accident of evaluation infrastructure. But it shows the real danger and risk surface.

🔗 SC World: OpenAI reveals agents planned collective attacks

🔗 YouTub Video of the Talk

The "PleaseFix" class of flaws demonstrated zero-click hijacking of agentic browsers through malicious content in cross-origin requests. This prompted researchers to argue agentic browsers rewind web security by 20 years. Another talk showed AppSec scanners themselves being used as a supply chain attack vector, a foothold planted inside the tool you bought to find footholds. A third showed AI harnesses, the glue software around models, are full of trust gaps between components. The pattern across the track: every layer we added for AI convenience is now someone's initial access.

What to watch: Researchers on stage said there's no perfect fix for prompt injection in these designs. The question is whether the agentic browser vendors ship real fixes or more guardrail theater.

🔗 TechTarget: Black Hat 2026 key news and takeaways

One big takeaway: the thing being secured is no longer the server, it's the developer and the agents running on their laptop. A coding agent holds repo write access, cloud credentials, and package manager config, and it takes instructions from whatever text it happens to read. Island found 7,600 malicious GitHub repos, over 800 posing as AI Skills or MCP servers, racking up 14M+ downloads, and Claude Code, Gemini, and ChatGPT all discovered the fake capabilities on their own and treated the attacker's README as documentation. Some vendors answered with new products: Legit's VibeGuard 2.0 runs on the endpoint to police coding agents, Cyera Endpoint extends agent guardrails to local AI tools, KnowBe4 stretched Agent Risk Manager to cover Claude, and Glow raised $180M last month to rebuild endpoint security for the AI era.

Why I'm flagging it: EDR watches processes and network calls. Prompt injection arrives as text your agent reads, with your credentials already attached. That's a different sensor, and almost nobody has it deployed.

🔗 Island AgentBaiting research · Help Net Security: Black Hat launches

The floor was one long agent-security launch. Snyk took Evo Continuous Offensive Security to GA (autonomous pentesting plus AI agent red teaming), Legit shipped VibeGuard 2.0 for endpoint guardrails on coding agents, Cycode launched agentic risk-response workflows, Sweet Security announced runtime blocking of rogue agents, Cyera introduced Agent Guardian, Varonis added intent-based access control for agents, and Acalvio launched deception guardrails with honeytokens aimed at agentic environments.

My take: the capabilities are converging fast, which makes evaluation the hard part. One litmus test: ask any of these vendors which specific steps of the OpenAI incident timeline their product would have caught.

🔗 Help Net Security

Not everything defensive at Black Hat came with a price tag. The Linux Foundation's Open Secure AI Alliance published an RFC for SAFE, a shared exchange for agentic incident data so one company's near miss becomes everyone's detection. Nvidia released OpenShell, an open agent sandbox runtime that constrains what an agent can see and execute. And tl;dr sec #339 flagged context bombs: seeding your environment with content that triggers an attacking model's guardrails, turning the attacker's own safety training into a tripwire. Early, bypassable by uncensored open weights, and nearly free to deploy next to the honeytokens you already have.

Practical takeaway: before budgeting for the catalog above, deploy the free layer. Sandbox runtimes, incident sharing, and guardrail canaries cost approximately nothing and would have generated signal at several steps of the July incident.

TechRepublic: OSAA SAFE guidelines

Here’s the list of every product launch announced during the BlackHat week.

Agent security (the dominant category)

Pentesting / offensive validation

AI SOC / detection & response

Exposure / vuln management

Threat intel / recovery / other

Frameworks / standards (not products, but launched that week)

While offense demonstrated fully autonomous campaigns, vendors demonstrated procurement options. I don't think the products are useless, but I think the framing is wrong: the July incident wasn't won by the attacker's sophistication, it was enabled by an SSRF, an exposed Modal instance, a Kubernetes service account misconfiguration, and a TOCTOU race. Classic AppSec doors, opened automatically at machine speed.

The numbers say speed is the variable that changed. Hugging Face reconstructed about 17,600 attacker actions; the Zero Day Clock puts disclosure-to-exploit at hours; 67% of exploited CVEs this year are zero-days. A persistent agent doesn't get bored, doesn't miss the fifth misconfiguration, and shares what it finds with its peers. Literally, in this case: they had a message board.

So my evaluation bar for the catalog is simple: which step of that timeline would your product have caught? Most of the honest answers I got at the booth were "the lateral movement, maybe." The controls that would have removed steps outright are the unglamorous ones: egress restrictions, least-privilege service accounts, registry hygiene, and design-time review of trust boundaries.

The honest uncertainty: I don't know whether defensive agents mature faster than attacker collectives leave the lab, and some of this week's launches may prove me wrong in production. If you ran an eval like this on the floor, or if your threat model already covered "compromised agent inside the perimeter with legitimate credentials," reply and tell me what I'm missing.

If you were in Vegas last week: rest up, drink water, and forgive my voice if we talked at the booth. These talks are exactly the reason I come to summer camp every year, so expect follow-ups once the dust and the 115 degree heat settles.

What's your take? Reply and let me know. I read every one.

- Amir

Thanks for reading The AppSec Signal, DevArmor’s newsletter for security professionals.
Have feedback or ideas for what we should cover next?
Feel free to reach out - [email protected]