When the Framework Itself Becomes the Attack Surface
Black Hat USA 2026 opens Monday at Mandalay Bay with a signal the agent infrastructure community cannot afford to ignore: 35 of 121 briefings – 29 percent – directly cover AI security. But the headline is not the volume. It is the target. Four verified briefings are attacking the runtime environment agents depend on – framework internals, cloud platforms, compute clusters, and the exploitation tooling itself. Agent exploitation has become its own discipline, with dedicated methodology and purpose-built offensive models. This is not application security applied to agents. It is infrastructure-level attack research targeting infrastructure-level systems.
The Framework Is the Vulnerability
The most architecturally significant briefing comes from Check Point Research. “No Tools Required: Post-Injection Exploitation Across AI Agent Frameworks” (August 5, 2:35 PM ET) reframes the entire agent security model. Researchers Yarden Porat and Shahar Tal demonstrate that exploitable logic lives in the core runtimes of LangChain, CrewAI, AutoGen, and Semantic Kernel – memory stores, planning loops, serialization layers, and orchestration logic.
Even without tool access, attacker-controlled content can cross trust boundaries and hijack agents through framework internals. The techniques include delayed-execution injection across conversation turns, cross-agent propagation in multi-agent setups, and persistent memory poisoning. The key insight reframes agent security from “control the tools” to “the framework itself is the vulnerability.”
This distinction matters for infrastructure builders. If the attack surface is the framework’s decision-making logic rather than the tools an agent can call, then the entire approach to securing agents – tool permissioning, output filtering, prompt guardrails – addresses the wrong layer.
Exploitation Gets Cheap and Private
On August 6 at 10:15 AM PT, NVIDIA researchers Bar Lanyado and Eliya Cohen will present “Cost-Effective, Private, Frontier-Grade: AI Agent Exploitation with a Fine-Tuned OSS Model.” Their WASP-OS model – a fine-tuned 30B open-source model – achieves 56 percent exploit success rate against AI agents while matching frontier models like GPT-4o, Claude, and Gemini, at 70 to 125 times lower cost with full privacy.
The infrastructure implication is structural. When agent exploitation requires frontier-model API costs and exposes attack patterns to cloud providers, the offensive barrier remains high. When a fine-tuned 30B model runs locally at a fraction of the cost with no data exposure, the economics flip. The offensive-defensive imbalance widens because the attacker’s cost structure collapses while the defender’s attack surface expands with every new agent deployment.
Cloud Infrastructure as Attack Surface
Check Point Research returns on August 6 at 3:35 PM PT with “When Agentic Glue Melts: Exploiting Cloudflare CodeMode and Workers.” This briefing targets Cloudflare’s LLM-driven tool orchestration layer directly – the typed API and TypeScript execution inside Workers that enables agent workflows. The research shows prompt injection leading to code generation that runs with the agent’s full privileges, enabling sandbox escapes and cross-tenant attacks.
Cloudflare shipped its Agents SDK and CodeMode as infrastructure primitives for the agent economy. This briefing demonstrates that the infrastructure providers themselves are becoming attack surfaces – not because of misconfigurations, but because the architecture of agentic cloud platforms creates new privilege-escalation paths that did not exist before agents.
Compute Infrastructure Under Autonomous Attack
At the compute layer, Oligo Security presents “When AI Attacks AI: Inside the Self-Propagating Botnet Built on Compromised AI Infrastructure” (August 6, 10:15 AM PT). This is the first documented in-the-wild campaign weaponizing Ray clusters into a self-propagating botnet – compromised clusters autonomously scanning for and infecting other Ray deployments globally.
Ray is the compute backbone for much of the agent ecosystem. A self-propagating botnet at the compute layer means agent workloads run on infrastructure that may already be compromised. The supply chain risk is not theoretical; it is documented and in the wild.
Infrastructure-Level Security for Infrastructure-Level Systems
The four briefings attack four distinct layers of the agent stack: framework runtimes, cloud platforms, compute clusters, and exploitation tooling. Each represents a category of infrastructure-level compromise, not application-layer bugs. The Black Hat program committee has drawn a clear line – agents are infrastructure, and infrastructure requires infrastructure-grade security.
Machine identities now outnumber humans 109 to 1 in the average enterprise. Gateway defenses that only watch prompts and responses miss what agents actually execute. Agent security requires governance at the decision layer – runtime decision-making – not just credential management. The briefings this week will define what that means in practice.