Black Hat USA 2026 has served as a definitive stress test for the emerging agentic economy. If Day 1 was a frantic mapping of the attack surface—highlighted by the discovery of core runtime vulnerabilities in frameworks like LangChain and CrewAI, and the subsequent 48-hour explosion of the MCP security vendor market—Day 2 shifted the focus toward the mechanics of defense. The infrastructure security picture has sharpened, moving from broad categorization to specific, layered engineering requirements.
The deeper issue is that agent infrastructure is not a monolith; it is a stack of interdependent layers, each with its own failure modes. The Day 2 briefings provided a masterclass in how these layers are being targeted and, in some cases, successfully hardened.
At the base of the stack lies the compute and cluster layer. The Oligo ShadowRay 2.0 briefing demonstrated that the infrastructure powering AI is already being weaponized at scale. With over 230,000 exposed Ray servers globally, attackers are leveraging CVE-2023-48022 to build self-propagating botnets like RondoDox and MooBot. These clusters are no longer just compute resources; they are staging grounds for cryptojacking, DDoS, and data exfiltration. The vulnerability is disputed by Ray maintainers, who argue the framework is designed for controlled networks—but 230,000 exposed servers tell a different story. The reality for infrastructure decision-makers is that the very clusters designed to scale agent workloads are currently the most vulnerable entry points for persistent, AI-generated threats.
Moving up to the runtime and execution layer, the Check Point CodeMode briefing—titled “When Agentic Glue Melts”—exposed how the glue holding agents together is melting. Researchers Yarden Porat and Shahar Tal demonstrated that prompt injection in Cloudflare CodeMode and Workers can trigger code generation that executes with the agent’s full privileges. When the sandbox environment—the Dynamic Worker isolate—is bypassed, the agent gains the ability to perform cross-tenant attacks. The integration of typed APIs and TypeScript execution within these workers has inadvertently created a massive, high-privilege attack surface that standard security tools are not yet equipped to monitor.
The sophistication of the offensive side was further underscored by the NVIDIA WASP-OS presentation. This open-source offensive security model, fine-tuned specifically for agent exploitation, represents a paradigm shift in how we view exploitation tooling. With 30 billion parameters and a 56% exploit success rate, WASP-OS matches the performance of frontier models like GPT-4o and Claude at 70–125x lower cost with full privacy. The same models used to build agents are being optimized to dismantle them.
Against this backdrop, the Roblox “Caging the Agent” briefing offered a rare, successful blueprint for defense. Following an incident where a hidden instruction in a GitHub Issue convinced Claude Code to upload production credentials to a public repository—EDR saw nothing because it was a normal process making a normal network request—Roblox built a multi-layer sandbox architecture. They moved beyond endpoint detection to implement filesystem virtualization, strict network policy enforcement, and credential isolation, ensuring that production secrets are never accessible to the agent runtime. By mediating all prompts and tool calls through a model gateway and cutting production access via VPN profiles, they effectively caged the agent.
Black Hat’s two-day arc reveals a clear trajectory. Day 1 mapped the attack surface, revealing that the agent stack—from frameworks to MCP—is inherently porous. Day 2 mapped the defenses, showing that while compute-layer security, runtime isolation, and behavioral monitoring are possible, they require a fundamental re-engineering of how agents interact with production environments.
The gap between these two realities is where the next major breach will land. As seen in the Unit 42 DeepSeek campaign, attackers are already selecting models based on their lack of safety controls, effectively using the model’s own architecture as an offensive selector. For builders and security practitioners, the lesson is clear: security cannot be an afterthought or a bolt-on. It must be baked into the infrastructure stack, from the cluster configuration to the agent’s execution environment. The era of the uncaged agent is coming to a close, but the race to secure the infrastructure that powers them has only just begun.