Black Hat USA 2026: AI-Powered Threats and Enterprise Security Lessons

AI appeared across many Black Hat and DEFCON presentations last week. Two themes dominated: AI as a security tool, and the new attack surface created by autonomous AI agents. CISOs reviewing cybersecurity strategies should consider the following takeaways.

Patching alone is no longer sufficient

Microsoft’s David Weston delivered a keynote arguing that AI makes advanced vulnerability discovery and exploit development cheaper and faster. This undermines traditional assumptions that attacks are rare and defenders have time to establish defenses. Rather than trying to respond faster than attackers, the industry needs to build greater durability into systems by adopting memory-safe languages such as Rust, using AI-assisted engineering to improve existing codebases, and automating remediation instead of sticking to established monthly patch cycles.

AI attacks are creating fresh supply-chain avenues

Researchers from Zenity uncovered a large-scale attack involving trojanized AI “skills” — instruction files that tell AI agents how to use tools — uploaded to the skills.sh marketplace. These malicious skills typo-squatted on popular AI services Paperclip and Browser Use, and were downloaded more than 1.7 million times in less than a month. During the presentation, Zenity described the campaign as part of a broader trend of AI software supply-chain attacks. CSO’s Lucian Constantin provides more details on the research and its implications.

GitHub event stream can support security telemetry

Security professionals concerned about supply chain attacks were told that GitHub may already provide enough telemetry to detect many supply-chain attacks. Microsoft’s Yossi Weizman and Echo’s Mor Weinberger showed that recent supply chain attacks such as Shai-Hulud, Trivy, and Megalodon repeatedly used the same patterns: forged commit identities, poisoned tags, workflow abuse, OIDC token misuse, and attempts at evidence erasure. These hallmarks of potential malfeasance can be turned into behavioural detections using GitHub webhooks, APIs, and Git metadata, the researchers explained. They released an open-source tool called GitHub Threat Detector, offering 30 built-in detection rules, to accompany their talk. The tool follows an EDR-like pipeline, but ought to be viewed as a work in progress; current drawbacks include possibly disabled webhooks, rate-limited APIs and an absence of real-time inspection.

Human-led AI research produces the most impactful findings

AI can perform original security research beyond simply pattern-matching known bugs, but the most impactful findings arise when human experts shepherd its path. PortSwigger researcher James Kettle showed how it was possible for an expert to design the research methodology, filter weak outputs, and use deterministic code to constrain and scale the AI’s work before turning it loose. Kettle demonstrated during his Black Hat talk that HTTP Terminator, a system built using this methodology, was able to find hundreds of live HTTP request smuggling (HTTP desync) vulnerabilities, steal a real API key from a bank, and uncover a new class of vulnerability called “shared-parser confusion.” He urged other security researchers to apply this methodology when developing similar AI-amplified research systems.

NAT ‘privacy’ threatened by new attack

Security assumptions that underpin the widespread use of Network Address Translation (NAT) within enterprises were challenged at Black Hat. NAT was designed as a workaround for IPv4 address exhaustion, not as a security control. The technology is supposed to ensure that private addresses stay private, but fresh research has thrown that assurance into doubt. Researcher Malcolm Stagg (an independent affiliated with Synack’s Red Team) disclosed NatJack, a class of attacks that manipulate the NAT connection tracking table. The NatJack technique could be used to hijack active connections, poison DNS responses, and cause denial of service, without the need for IP spoofing at Layer 2 or access to the same broadcast domain that was necessary for older attacks. Testing covered 32 products or configurations across multiple vendors; every implementation tested was vulnerable to at least some or all of the NatJack techniques developed by Stagg. Both Microsoft and Linux maintainers have issued patches for the issue in response to Stagg’s revelations.