The week in Las Vegas began with a defensive wall of corporate security products at Black Hat and ended with the systematic dismantling of the AI agent runtime stack at DEF CON 34. As we detailed in our BH Day 1 Briefings, the industry has been racing to deploy tools like Wiz Agent Shield and Palo Alto Prisma AIRS. Yet, the research presented at DEF CON revealed an uncomfortable reality: the vulnerabilities are not bugs to be patched, but features of the current agentic architecture.
Structural design gaps, rather than simple prompt injection, define the current state of agent security. In “The Sandbox Is a Suggestion”, Elad Meged of Novee Security demonstrated that major coding agent sandboxes — Claude Code, Gemini CLI, and Codex CLI — are fundamentally broken. The Gemini CLI pre-task remote code execution (RCE) vulnerability, documented in GHSA-wpqr-6v78-jr5g, scored a CVSS 10.0, proving that environments meant to isolate agents are porous by design.
Infrastructure layers are equally fragile. Yaara Shriki of Wiz and Google presented “OffGuard”, exposing LiteLLM — the most popular open-source AI gateway, deployed in roughly one-third of cloud environments — as a single point of failure. By chaining authentication bypasses in the Model Context Protocol (MCP) layer with sandbox escapes and server-side request forgery, the researchers demonstrated a path from zero credentials to full cloud compromise. Nearly one in ten instances accepted default credentials or required no authentication at all.
Connectivity remains a primary vector for exploitation. In “The Hidden Cost of Agentic Connectivity”, David Fiser analyzed over 19,000 MCP servers, revealing that security features are trivially bypassable. These vulnerabilities map directly to the OWASP MCP Top 10, confirming that the tools designed to connect agents to data are acting as conduits for attackers, a concern we previously highlighted in our MCP Vendor Wave coverage.
Muskan Tomar’s research on cross-agent privilege escalation introduces a new threat: the manipulation of trust between agents. By poisoning tool descriptions that read like routine compliance guidance, an attacker can trick an agent built on LangChain or Claude Code into escalating the privileges of a separate agent running in a different environment — all through authorized IAM calls. This finding underscores the danger of implicit trust in multi-agent systems.
Low-level exploitation of the infrastructure itself is also possible. Ji’an Zhou and Lei Lu identified CVE-2026-24747, a PyTorch weights_only bypass that allowed for the remote compromise of vLLM, ComfyUI, and NVIDIA Dynamo. The common assumption that AI applications are safe if they only load weights was overturned: many AI applications expose APIs that invoke torch.load for routine operations, turning a “local” vulnerability into a remote one.
Security tools themselves are being weaponized. In “Your WAF Blocked Us, That Was The Exploit”, Tenet Security demonstrated two chains. First, payloads delivered through Cloudflare WAF 403-blocked requests land in logs; when a developer asks their agent to debug Cloudflare, injections activate and the agent’s own MCP tools hijack DNS to reroute customer traffic — an estimated 15,000-plus organizations exposed, 27 percent of the Fortune 1000. Second, stacktraces injected into Sentry’s public API via public DSNs compromise Sentry’s Seer agent, with poisoned recommendations flowing into Cursor. The exploitation success rate: 85 percent. The researchers also disclosed a Claude zero-day bypassing its network sandbox for full data exfiltration, and demonstrated agentic rootkits via memory injection and config poisoning that are invisible to EDRs. A stark contrast to the defensive optimism noted in our BH Day 2 Roundup.
Even heavily guarded environments are not immune. Ryan Hausknecht and Simon Maxwell-Stewart of BeyondTrust, in “Wrestling with a Python”, broke all three defensive layers of Microsoft Copilot Studio: dunder filters via MRO introspection, the Python sandbox via pythonnet, and the LLM guardrail by exploiting its leaked reasoning chain. They exfiltrated TLS private keys, approximately 75 environment variables including Azure AD client IDs and Service Fabric cluster topology, and full application source code — demonstrating admin-level access to every Copilot Studio agent sandbox.
The agent runtime stack is currently built on a foundation of over-privileged patterns and implicit trust. The industry is rushing to deploy agentic capabilities before the underlying security architecture is mature. Individual patches are stopgaps. Until the architecture itself is re-engineered to account for these systematic vulnerabilities, the agent economy will remain fundamentally exposed.