My learnings from DEFCON 34
Lessons from DEF CON and cybersecurity in the agentic era.
This was my first DEF CON, and it blew away my expectations. Every technical conference has its strengths and weaknesses. Most are educational, and some can be overwhelming, but DEF CON was by far the most technically rewarding and personally fulfilling conference I have attended.
At DEF CON, “hacking” is used in its broadest sense. There is enough technical “eye candy” to satisfy my tinkerer brain with things like lock picking, soldering components onto badge add-ons (SAOs), learning about vehicle and satellite hacking, robotics, wireless security, AI Red teaming, Agentic Security and so much more. At the conference, I found my people - these are the folks that get excited by the same topics, tools, and hacks that excite me.
In this blog, I wrote down a few of my observations from a small lens of what I could experience at a vast conference. It will probably take me another month or longer to watch the recordings, read other view points like this one, digest the material, internalize what I learned, and put it to good use.
TL;DR
One of the clearest themes I heard at the AI Village was the urgency of securing agents within and cross enterprise boundaries, securing MCP tools, and securing agent actions. Our poster on securing cross-enterprise AI agents felt especially relevant in this multi-agent and cross-enterprise world.
Listening to various talks & demos and in my conversations with peers, there is a general consensus that the agentic era of adversarial attacks is already here. Red, blue, and purple teaming are all becoming increasingly agentic.
The panel The Defender’s Dilemma: Releasing Dual-Use AI Models as Capabilities Climb demonstrated that AI models can be dual-use (offense and defense). Frontier Cyber models are great, but there is uneven access. Open-weight models like Qwen, Kimi, GLM, etc. will democratize both offensive and defensive capabilities, but they also lower barriers for attackers. Enterprises need a solid strategy on how they plan to defend cybersecurity at agentic speed or scale.
In one of the Red team village tactic workshops, I learned that frontier models do not need to be specialized cyber models to find common vulnerabilities or potential zero-days. With the right skills, tools, context, and validation loop, I found that general-purpose models (Opus 4.8, GPT 5.6 Sol) can be remarkably capable, although some frontier models now have guardrails that block offensive/defensive queries.
Prompts, skills, tool calls, and agent memory can all be poisoned and should be treated as part of the software supply chain. In one of the talks, the presenter discussed skill poisoning especially when they are chained with many off the shelf skills. A malicious skill can influence later tools, establish command-and-control behavior, or poison an agent’s memory without leaving a traditional binary signature.
Agent integrity requires much more than authorization at an MCP or tool boundary. Agent Identity, user intent, delegation, authorization, and auditability must survive the entire chain of action.
I left convinced that application developers, infrastructure engineers, SREs, and defenders need to be educated with Cybersecurity fundamentals. Security has always been everyone’s responsibility, even more so in an agentic era.
This is simultaneously the most exciting and the most frightening time to work in Cybersecurity.
AI Village
First, a big shout-out to our poster team at the AI Village. It was wonderful to meet several members of the AGNTCY Identity Working Group in person, exchange ideas, demonstrate our work, and plan future collaboration.
Our Securing Cross-Enterprise AI Agents poster demonstration explored requests between agents operating in different organizational identity domains. We used Client ID Metadata (CIMD), ID-JAG and Token Exchange to ask a fundamental question: how can an agent carry its identity, delegated authority, and user intent across an organizational boundary while ensuring the resulting access is appropriately downscoped. Checkout our demo @github
At AI Village and the conference at large, there were several talks and conversations centered around model provenance, guardrails, RAG poisoning, prompt injection, MCP security, app security, and network security
The Defender’s Dilemma: Releasing Dual-Use AI Models as Capabilities Climb
Panelists: Emanuel Gawrieh, Jason Clinton, Bruce Schneier, Heather Adkins
The panel spent a lot of time talking about the ongoing debate over access to open-weight models. The same capabilities that help defenders can also enable vulnerability discovery, surveillance, censorship, and offensive operations and no single organization controls how those capabilities are released or used. Model access is therefore not merely a technical decision; it is also a governance, legal, regulatory, and geopolitical one.
The discussion was especially timely in light of OpenAI’s disclosure of the Hugging Face security incident.
Skills are part of the software supply chain
One of the most important themes for me was the risk from malicious or poisoned agent skills. We are downloading and composing skills from many internet sources like github but skills are natural-language instructions with additional optional scripts. Skills are not conventional binaries hence they are harder to scan for vulnerability signatures.
Nur Gucu’s Demo Lab made this risk tangible - an AI agent trusts the skills in its directory, so what happens when one of those skills is malicious. The demonstration showed natural-language malware embedded in agent skills; no binary or traditional malware signature, just English instructions executing with the agent’s tool and operating system tools access.
The lab demonstrated three escalating attack patterns:
- Buried instruction: a malicious sentence hidden inside an otherwise legitimate skill causes data exfiltration when the skill runs.
- Chain attack: several individually benign-looking skills create an exfiltration path only when orchestrated together; no single skill appears malicious because the composition itself is the weapon.
- Persistent ghost: a skill writes malicious behavior into agent memory so the behavior can survive file deletion and session restarts.
The attack chain stood out to me because it exposes the limits of reviewing skills one file at a time. A malicious outcome can emerge from the interaction among innocent looking instructions, adapters, policies, memory, and tools. Progressive disclosure makes skills efficient, but it can also make the complete behavior harder for a user or even the model to inspect at once.
The open-source MalSkills repository makes the idea reproducible with benign and planted examples, a proof collector, and a detector under development. The defensive side of the democovered skill-integrity verification, capability-based sandboxing, orchestration-graph analysis, and runtime behavioral monitoring.
Tools such as the open-source Cisco AI Defense Skill Scanner are beginning to apply static analysis, behavioral data-flow analysis, and semantic analysis to agent skills. These approaches can help identify known or probable risks.
Red Team Village
I spent a lot of time in the Red Team Village because it resonated with me at the intersection of Security and Agentic.
My read from the talks is that traditional penetration testing tools are not disappearing but agents are becoming an orchestration and reasoning layer over those tools. Frontier models already understand how many established security tools work. Given an authorized testing target and appropriate context, an agent can map a codebase, select tools, generate probes, interpret results, and coordinate follow-up investigations. There may be some nuance in how frontier models implemented guardrails on cyber security capabilities vs open-weight models.
Autonomous penetration testing with agent swarms is becoming a reality. The human researcher remains essential for defining scope, validating evidence, assessing impact, and preventing unsafe actions, but the breadth and speed of testing can increase dramatically.
This also changes what “solid” penetration testing looks like. Checklist-driven, point-in-time testing is not enough. Effective testing must use sophisticated agentic tools and code graphs, think like an adversary, explore unexpected paths, and produce reproducible evidence showing whether a suspected weakness is actually exploitable.
I believe penetration testing should be a continuous loop, not just a point-in-time checkbox like a semiannual event. As systems and attack paths change, authorized agents can continuously test software in controlled environments and return evidence to engineers, while humans define scope, approve sensitive actions, and review the results.
Agent-assisted vulnerability research
At a Red Team Village workshop called Vulnpocalypse, I worked with a custom skill authored by Chris Haller that uses frontier models to hunt for vulnerabilities and potential zero-days. A well-designed skill can guide a model through source-code mapping, trust-boundary analysis, hypothesis generation, testing, and the collection of reproducible evidence.
I experimented with this approach against opensource code and upstream dependencies. The exercise gave me useful insight into how frontier models can support vulnerability research, while reinforcing the importance of validating their analysis within the relevant code paths and trust boundaries. This workshop also demostrated that defenders and developers can use frontier models that are not Mythos or GPT Cyber class models and yet are able to find vulnerabilities and zero-days
A model-generated finding is only a hypothesis. Establishing a credible vulnerability requires reproducible evidence, a clear assessment of impact, and careful validation against the actual code path.
Exposed AI infrastructure and credentials
Another demonstration showed how researchers could discover publicly exposed model gateways and credentials leaked onto the internet. Misconfigured LiteLLM-style endpoints could effectively provide strangers with access to someone else’s model infrastructure. Leaked API tokens could remain usable long after they were accidentally committed or shared.
The important lesson was not the specific scanner. It was that AI infrastructure needs the same disciplined exposure management we expect from cloud infrastructure:
- Continuously inventory public endpoints.
- Search authorized repositories and artifacts for leaked credentials.
- Rotate credentials and prefer short-lived tokens.
- Apply rate limits, authentication, and narrowly scoped authorization.
- Test from an adversary’s perspective rather than relying only on configuration reviews.
Any offensive tooling must be reviewed and run only in an isolated environment against explicitly authorized targets.
Conference badges and SAOs
DEF CON badge is an extensible circuit board with a camera and QR scanner designed for scanning other attendees badges. LEDs change colors as people scan each other’s badges and its expansion pins allow SAOs to be attached. I have seen some attendees attach laser tag modules and play with each other. It is a wonderful to learn and hack on to these boards.
Learning to solder
I attended a soldering workshop and assembled a simple expansion board containing components such as resistors, LEDs, and a capacitor. I had always wanted to learn this skill, and the volunteers made it approachable. What impressed me was not just the hardware, but the generosity of people willing to sit with a beginner and teach the craft.
Hacking beyond software
At DEF CON, “hacking” is used in its broadest sense: deeply understanding how something works, questioning its assumptions, and discovering how it can be made to behave differently. The villages covered vehicles, satellites, wireless networks, physical systems, robotics, maritime systems, gaming, 3D printers and much more.
Physical security and lock picking
What I am taking back
My biggest takeaway is that security offense and defense is increasing going agentic both at scale and speed.
For infrastructure and SRE teams, it is no longer sufficient to wait for a conventional penetration test and remediate a checklist of findings. We should understand how modern attackers use frontier models, understand the same techniques within authorized environments, and build those lessons into continuous defensive loops.
For many DevSecOps/Infra/SRE teams, that means investing in:
- Security focused agent skills.
- Strong identity and delegation across agent boundaries.
- Per-action authorization, downscoping, and auditability.
- Detection of prompt, skill, memory, and tool-chain poisoning.
DEF CON reminded me that learning the attacker’s craft is not separate from defense. It is how defenders stay one step ahead.
Last but not least, I also came away deeply appreciative of the DEF CON community. The speakers and volunteers created a welcoming environment for learning, experimentation, and collaboration. DEF CON truly takes a village, and I am grateful to everyone who brought it together.
References
- DEF CON media archive — conference recordings and media.
- Securing Cross-Enterprise AI Agents — our AI Village poster and demonstration on identity, delegation, token exchange, and downscoping across organizational boundaries.
- AGNTCY Identity documentation — identity specifications and background for the cross-enterprise agent work.
- AGNTCY agent identity demos — source code and demonstrations referenced in the AI Village section.
- The Defender’s Dilemma: Releasing Dual-Use AI Models as Capabilities Climb — the panel that informed my handwritten notes on dual-use AI, open-weight models, capability release, governance, and misuse.
- OpenAI’s disclosure of the Hugging Face security incident — additional context for the discussion of frontier-model security and agentic attacks.
- MalSkill Lab: Hands-On Natural Language Malware in AI Agent Orchestration Systems — Nur “BurritoTheNurrito” Gucu’s official DEF CON 34 Demo Lab description.
- MalSkills — open-source examples of natural-language malware planted in agent skill systems.
- ORPHEUS — the open-source multi-skill orchestration framework referenced by the MalSkill Demo Lab.
- Cisco AI Defense Skill Scanner — a best-effort scanner for identifying probable risks in agent skills.
- Engineers Write the Rules, Agents Run the Ship: The Loop — my article on continuous agent-operated engineering loops.
- DEF CON volunteers video — the video linked in the discussion of the volunteer community.