Black Hat USA 2026 reveals that the frameworks orchestrating autonomous agents are inherently vulnerable, shifting the security focus from individual prompts to the core runtimes of the agentic stack.
The most architecturally significant finding at this year’s Black Hat conference comes from Check Point Research, whose briefing, No Tools Required, identifies that the framework itself is the primary vulnerability. Researchers Yarden Porat and Shahar Tal demonstrated exploitable logic within the core runtimes of LangChain, CrewAI, AutoGen, and Semantic Kernel. By targeting memory stores, planning loops, and serialization layers, attackers can execute delayed-injection attacks across conversation turns or propagate threats in multi-agent environments. This confirms the shift in focus from the tools agents use to the orchestration logic that serves as the glue for the entire stack.
This infrastructure-level research aligns with the themes established in our preview piece, which framed agent exploitation as a maturing, distinct discipline. With 35 of 121 Black Hat briefings now dedicated to AI security, it is evident that agentic systems have become the new, primary attack surface.
The conference briefings are systematically dismantling the agent stack across four distinct layers: framework runtimes, cloud platforms, compute clusters, and exploitation tooling. Each layer presents a unique vector that is currently being weaponized.
At the compute layer, Oligo Security’s briefing, When AI Attacks AI, details the ShadowRay 2.0 campaign. Presenters Gal Elbaz and Avi Lumelsky highlight how Ray clusters are being weaponized into self-propagating botnets. While Ray maintainers dispute the classification of CVE-2023-48022, characterizing it as a design feature for controlled environments, the reality is that over 200,000 servers remain exposed to a campaign active since September 2024, demonstrating the global scale of infrastructure-level compromise.
Moving to the cloud platform layer, Check Point’s second briefing, When Agentic Glue Melts, examines vulnerabilities in Cloudflare CodeMode and Workers. Here, the LLM-driven tool orchestration layer is the target. Prompt injection is being used to trigger code generation that executes with the agent’s full privileges, leading to sandbox escapes and cross-tenant attacks.
The cost of these attacks is also collapsing. The NVIDIA briefing on WASP-OS, presented by Bar Lanyado and Eliya Cohen, introduces a fine-tuned 30B open-source model capable of achieving a 56% exploit success rate against AI agents, matching frontier models like GPT-4o and Claude at 70-125x lower cost with full privacy. While the benchmark methodology for these results has not been independently verified, the implications are profound: attackers no longer need expensive API access to frontier models to conduct sophisticated agent exploitation.
As Heath’s recent analysis suggests, we are witnessing a turning point where AI agent security moves from a niche concern to a mainstream discipline. The industry is beginning to respond with infrastructure-level defenses. We have already seen this in the rise of MCP gateways, which are crystallizing as a necessary layer for identity and governance in an environment where machine identities now outnumber humans 109 to 1.
The current trajectory of the agent economy is defined by a critical imbalance. The rapid, decentralized deployment of agentic systems is consistently outpacing the development of foundational security, creating a massive, compounding security debt that the current infrastructure is not yet equipped to manage.