Silence is the loudest warning.
In a Las Vegas conference room, under the flat fluorescent hum that has hosted a thousand security talks, a researcher from Check Point stood in front of an audience and said almost nothing about prompt injection. Instead, she showed a slide titled 'No Tools Required.' The room went quiet in the way rooms do when the familiar shape of a threat suddenly changes. No malicious plugin. No compromised API key. No stolen credential. The attacker did not need any of it, because the agent itself had already been given everything.
This was not a demonstration of a clever exploit against a single chatbot. It was a demonstration that the entire runtime layer of modern AI agents โ memory stores, planning loops, serialization logic, orchestration chains โ has become a public highway for anyone who knows how to speak its native language. Black Hat USA 2026 did not merely signal that agent exploitation is an emerging category. It declared, with the quiet authority of a completed proof, that agent exploitation has become its own infrastructure discipline.
I have spent the last nine years of my life auditing code that most people never see. I started with ICO contracts in 2017, moved to composable DeFi protocols in 2020, and spent the 2022 bear market dissecting DAO governance tokens. I thought I understood what 'attack surface' meant. But standing in that room, watching a researcher walk through memory poisoning of a LangChain agent as calmly as if she were reading a grocery list, I realized that the mental models I had been carrying were built for a world that no longer exists. The model layer was never the real battleground. The runtime is.
Context: The Long Road From Models to Machines
To understand what happened at Black Hat this year, you have to understand how far we have traveled. In 2023, the security community treated large language models as a curiosity โ a probabilistic text generator that occasionally leaked a system prompt. Prompt injection was real but peripheral, a parlor trick that security researchers used to prove a point about insufficient sandboxing. It was the kind of vulnerability you talked about at dinner, then ignored while you patched your real infrastructure.
By 2024, that attitude had become dangerous. Enterprises were deploying agents that could read email, write code, move money, and negotiate contracts. The agent was no longer a language model behind a chat window. It was an autonomous executor that had been granted access to the very tools that once belonged only to trusted human operators. And yet the security industry kept treating it like a text prediction problem.
Whatever happened to the lessons of DeFi summer? In 2020, we learned, sometimes painfully, that composability is a double-edged sword. Every protocol that could freely call another protocol was also exposing itself to every vulnerability in that protocol. The same logic now applies to agents. An agent that can call a tool is only as secure as the weakest trust boundary it crosses. And there are now tens of thousands of those boundaries living inside production software.
Black Hat 2026 did not introduce a single new vulnerability class so much as it performed the ecosystem-level autopsy that the industry had been avoiding. The findings can be grouped into a simple observation: the attack surface has migrated from the model layer to the system layer. We are no longer worried about the words a model says. We are worried about the decisions it makes, the actions it takes, and the infrastructure it commands.
Core: The Runtime as a Battlefield
I want to walk through what the technical route analysis actually shows, because the headlines will inevitably miss the nuance. The research presented at Black Hat was not aimed at a single application or a quaint business logic flaw. It was aimed at the internal machinery of agent frameworks: LangChain, CrewAI, AutoGen, Semantic Kernel. This is a significant shift. It moves the conversation from 'this specific agent has a bug' to 'agent frameworks as a class contain structural vulnerabilities that are inherent to their design.'
Let me take you through the four attack surfaces that the research identified.
The first is memory storage. Every modern agent has a memory โ a vector store, a conversation history, a distillation of past actions that the agent consults to make future decisions. Memory is beautiful because it gives agents continuity. Memory is terrifying because it is the perfect vector for long-term poisoning. An attacker who can inject a small piece of content into the memory stream โ a document, an email, a slack message, a web page โ can influence every subsequent decision the agent makes. This is not a direct exploit. It is a slow re-education. The agent remembers the poisoned data as if it were its own experience, and there is currently no mainstream mechanism for distinguishing between legitimate experience and manipulated memory.
The second is the planning loop. Agents do not simply respond to a single prompt. They set goals, break them into sub-tasks, execute tools, observe results, and re-order their plans based on those observations. This recursive loop is where the real power of agents resides, but it is also where control is most fragile. The research showed that by injecting carefully crafted tokens into tool outputs โ not into the user prompt but into the response stream of a legitimate tool call โ an attacker can redirect the entire planning trajectory. The agent thinks it is executing step two of a benign plan while actually executing step one of the attacker's plan. The agent becomes an unwitting proxy for a will it never intended to serve.
The third is the serialization layer. This is the part that security professionals understand intuitively and the rest of the world has almost never heard of. Agent state must be saved and restored. Communication between agents must be structured. Frameworks rely on serialization formats โ JSON, YAML, pickle, and proprietary schemas โ to package and transmit state. Every serializer is an oracle. Every deserializer is an attack surface. The Black Hat research demonstrated that under certain conditions, specially crafted serialized payloads could trigger unforeseen code execution in the orchestration layer without any tool permission. This is the territory we know well from the history of Java deserialization vulnerabilities and Python pickle exploits, but it is now embedded in the daily runtime of autonomous systems.
The fourth is orchestration logic itself. In multi-agent systems, agents communicate with each other. They hand off tasks, share intermediate results, and collectively work toward a goal. The trust between agents is assumed by default. The Black Hat presentations showed how an attacker can insert a malicious agent into an orchestration chain and let the other agents do the heavy lifting. Because orchestration logic often lacks identity verification between agents, the chain becomes a relay race where the attacker hands off the baton to a trusted component and then watches it cross the finish line. This is the same pattern we saw in the infamous 'death by a thousand composability cuts' in DeFi. The component is trustworthy. The interaction is not.
Now, the 'No Tools Required' result deserves a more careful examination, because it is the single most important technical finding of the entire conference. The premise is simple: you do not need to exploit a tool to break an agent. The agent itself is the tool. When a framework grants an agent the ability to call functions, it is implicitly granting the agent the ability to choose which functions to call and with what arguments. An attacker who controls the content that the agent processes does not need to control the tools. They only need to control the selector. And the selector is determined by the very memory, planning, and serialization surfaces I just described.
This insight is the heart of the paradigm shift from model layer to system layer. The model is still the processor, but the model has surrendered its discretion to the context it consumes. If the context says 'call the payment tool with attacker.address as the destination,' many frameworks will happily execute that instruction. The model did not make a mistake. The system never asked the model to verify the provenance of the context. It simply trusted the context because the context was inside the trust boundary.
What does this mean for the people building agent infrastructure? It means that the security boundary has shifted from 'can the attacker get code execution?' to 'can the attacker influence the executor's interpretation?' And the answer, increasingly, is yes. Fundamentally, this is a difference between integrity and confidentiality. When we protected data, we cared about confidentiality. Now we protect decisions, and the only thing that protects a decision is the integrity of the evidence that led to it.
This is also where the attack model becomes doubly dangerous. The Black Hat research did not stop at the vulnerability in the agent framework. It also showed that attackers are using AI itself to discover and exploit these vulnerabilities. The 'attack model' is no longer just a model you attack; it is an attacker's model. You are now facing automated vulnerability discovery, automated exploit generation, and automated exploitation, all running at machine speed, all producing payloads tailored to the exact framework you happen to be running.
I saw this coming, but I did not see it this clearly until I spent a week in Beijing with a fintech lab analyzing game-theoretic responses to adversarial machine learning. We modeled the interaction between an agent that performs financial transactions and an adversary that poisons market data to manipulate the agent's trading behavior. The result was grim. The agent did not need its private keys stolen. The adversary simply provided enough semantically consistent but economically malicious data to steer the agent's portfolio into a position where the adversary could harvest the loss. The agent was behaving exactly as designed. That is the darkest part of this discipline: when you audit the code and the code is correct, but the world the code consumes is already an attack.
None of this is a marketing pitch for yet another 'AI firewall' product. If I have learned anything from auditing DeFi protocols, it is that adding layers of unverified security theater is usually worse than acknowledging the underlying fragility. The market is already flooded with so-called agent security platforms that claim to 'shield' your model from malicious prompts. These products are often wrappers around a few heuristics and a rate limiter. They do not address the trust boundary that lies at the heart of the 'No Tools Required' vulnerability. They do not validate the provenance of memory. They do not cryptographically attest the state carried into a planning loop. They offer the comforting illusion of perimeter defense when the attack has already made its home in the agent's soul.
The DeFi Lesson That the Agent World Has Not Learned
I cannot shake the feeling that the agent ecosystem is repeating every mistake DeFi made between 2020 and 2022. We built composable protocols without a security model for cross-protocol interactions, and we paid for it with billions of dollars in hacks. Now we are building composable agents without a security model for cross-agent interactions, and we will pay for it in a currency far more difficult to quantify: trust.
In DeFi, the solution was not to ban composability. It was to develop better attestation mechanisms โ to know exactly what code you are calling, to verify its state, to understand its invariants. Some of those tools were technical, like formal verification. Some were community-driven, like security audits and bug bounties. But the most profound lesson was about the nature of trust itself. Trust is not a binary switch. It is a claim that must be continuously verified against reality. DeFi breathes; do not strangle it with false security blankets. But also, do not let it suffocate under the weight of unverified dependencies.
The agent world has not internalized this. Every agent framework encourages developers to chain multiple models, tools, and memory stores into a single autonomous pipeline. There is almost no cryptographic attestation of the data that flows through that pipeline. There is almost no integrity check on the memory being retrieved. There is almost no verification that the tool call an agent is about to make was actually intended by a human or by a legitimate sub-agent. The trust boundary is implicit. It lives in the developer's hopes.
This is the 'prune the dead branches, save the tree' moment. The agent ecosystem is a young tree with too many branches reaching in conflicting directions. Some branches are healthy โ the language understanding, the code generation, the ability to navigate a complex API. Other branches are dead โ the naive trust in content, the absence of state attestation, the reckless assumption that tool permissions are the only thing protecting us from malicious control. If we do not prune the dead branches, the entire tree will fall, and the security industry will be standing underneath it pretending that it warned us the whole time.
What would pruning look like in technical terms? Let me be specific. First, every agent should have a tamper-evident state log. Every decision, every tool call, every retrieved memory should be recorded in a structure that can be audited after the fact. This is not a future invention. This is the core idea of blockchain, applied to agent state. The audit trail does not have to be a public chain. A private immutable ledger, or a hash-chained integrity log, is enough to detect โ and sometimes prevent โ the silent re-education of memory poisoning.
Second, every tool call should have a provenance attestation. The agent should not blindly trust a serialized object that arrived from a sub-agent. It should verify the signer of that object. It should know who created it, when it was created, and what invariants it was intended to satisfy. This is exactly the work I did with DAO governance tokens in 2022, when I audited 12 major DAOs and found critical centralization flaws in their voting mechanisms. The flaws were not in the voting logic. The flaws were in the absence of provenance. Proxies could sign on behalf of voters. Aggregators could obscure the true intent of a proposal. The mechanism was secure; the provenance was absent. The same is now true of agents.
Third, ZK-proofs will play a role that almost nobody is talking about. In the agent context, the meaningful application is not financial privacy. It is the ability to prove that a certain decision was derived from a certain context without revealing the entire context. Imagine an agent that can prove, to another agent, that it has verified the integrity of its memory and that its next action is consistent with a predefined policy โ without exposing the memory itself. This is the 'Proof of Human Intent' that I have been writing about for a year. It is the cryptographic backbone that will allow agents to trust each other enough to cooperate, while preventing the kind of blind trust that the Black Hat research so easily exploited.
The Infrastructure Dimension: Why the Cloud Orchestrator Is the Real Target
Let me pull back from the framework internals and look at the broader infrastructure that agents depend on. In 2026, most production agents do not run on a laptop. They run in cloud platforms, orchestrated by Kubernetes, managed by control planes, and served by GPU clusters. This is where the phrase 'runtime infrastructure attack' gains its true weight.
The orchestrator is a magnet for attackers because it sits at the intersection of everything. An attacker who compromises the orchestration layer can manipulate the deployment of agents, redirect their network traffic, exfiltrate their memory stores, and introduce malicious agents into production chains. The Black Hat research did not just focus on the framework libraries. It mapped the entire pathway from a single poisoned content embedding to a fully weaponized multicluster deployment.
Consider the compute cluster. Agents consume tokens at a prodigious rate. They need CPUs, GPUs, and memory. The cluster that serves them is a tempting target for three reasons: it has access to the model weights, it has access to the inference logs, and it has access to the results of every tool call. The cluster contains the complete behavioral fingerprint of every agent it serves. It is a golden dataset for adversarial training. If an attacker can read the inference logs, they can learn the weaknesses of your agent and craft the perfect exploit.
The most disquieting part of the infrastructure story is the exploitation of the attack model itself. There is now a market for adversarial agents. Attackers are building their own agents whose specific goal is to discover vulnerabilities in other agents. These adversarial agents are engineered to generate semantically coherent but logically treacherous inputs. They are not bound by ethical constraints, because they do not belong to any corporation that fears reputation damage. They are autonomous, cheap, and persistent.
This should terrify anyone building agent infrastructure on a monolithic trust model. The economics of attacks are shifting dramatically. In the past, an attacker had to invest human hours in studying your code, writing exploits, and testing them. Now, the attacker spends GPU hours instead. The cost asymmetry is vast. A well-funded defender might run a security team of 50 people. An attacker can run a swarm of 10,000 adversarial agents for the same budget. No human team can keep pace with that rate of exploration.
This is where I see the competition landscape forming. There are three groups racing to control the agent security narrative. The first group is the incumbent security vendors โ the SIEMs, the WAFs, the cloud security platforms. They are extending their existing products to cover 'AI security' with new dashboards and detection rules. They will succeed in selling to enterprises, but I am skeptical that a legacy SIEM can understand the semantics of a planning loop.
The second group is the AI-native security startups. These are companies founded by people who live in the prompt engineering and agent framework world. They build products that monitor agent behavior, detect memory poisoning, and validate orchestration chains. This group is closer to the actual problems, but it is also the group most likely to overfit to the current framework generations. What works for LangChain today may not work for whatever replaces it in 2027.
The third group is the decentralized infrastructure community โ the blockchain natives. This group has the most valuable long-term architecture: identity systems, verifiable credentials, cryptographic attestation, and immutable audit trails. But it also has the most cultural friction. Blockchain people speak in terms of self-sovereignty and decentralized trust, while enterprise AI engineers speak in terms of SLAs and inference latency. Bridging that communication gap is not a technical problem. It is a diplomatic one.
I believe the third group will matter more than the market expects, but only if it stops selling tokens and starts selling technical solutions. The agent security problem is fundamentally a trust-enforcement problem, and trust-enforcement is exactly what cryptography was invented for.
The Commercial Veil and the Valuation Trap
Let me be brief in treating the commercial dimension, because I do not want to spend words on the obvious. The commercial narrative around agent security is already inflated. Every security vendor is claiming to be the first and only company that can protect your agents. The venture community is pouring money into 'agent security' categories. Valuations are climbing.
This will end in tears for a simple reason: the attack surface is still being characterized. You cannot build a durable security product against a threat model that changes every time a new framework release ships. The companies that will survive are the ones that build foundational infrastructure โ attestation layers, audit trails, identity protocols. The companies that will fade are the ones that wrap a heuristic around a small set of demonstrations and call it a platform.
My investment takeaway is equally simple: invest in the primitives, not the dashboards. A protocol for verifying the provenance of a tool call is a primitive. A login page in front of an AI firewall is a dashboard. The primitives will be reused by every agent framework. The dashboards will be replaced by the next shiny thing.
The Human Cost and the Ethics of Agent Exploitation
I want to step back from the technical specifics and think about what this research means for ordinary people. Because ultimately, the people who will be harmed by agent exploitation are not companies. They are individuals who trusted an automated system with their money, their health decisions, their legal rights, or their personal communications.
Consider a simple scenario. A health insurance agent, deployed by an insurer, reads medical records, determines coverage, and schedules procedures. A malicious actor injects a subtle piece of content into the records that the agent retrieves. The agent's planning loop is not hacked in the traditional sense; it simply receives a slightly altered narrative about the patient's condition. The agent denies coverage. The human being appeals. The appeal is processed by another agent. Hopefully, there is a human at the end of that chain. But in 2026, there often is not.
The ethical dimension here is not about the agent's code being compromised. It is about the systemic blindness that comes from delegating consequential decisions to systems whose evidence chain cannot be verified. The Black Hat research is a warning, but it is also a gift. It shows us exactly where the bodies are buried before the bodies have been produced.
I have a quiet fear that the response to this will be restriction rather than transparency. Regulators will demand that agents be made simpler, less autonomous, more predictable. They will push for agent state to be centralized, controlled, and auditable by a single authority. That response would be understandable, but it would also be wrong. The problem with today's agents is not that they are too autonomous. It is that their autonomy is not properly attested. Centralizing them will not make them safer. It will only make them more attractive targets for those who can control the central authority.
The 'Proof of Human Intent' framework is an alternative. It proposes that the most important thing an agent can carry is not a bag of tools, but an unforgeable representation of the human intention behind its mission. When an agent is about to make a consequential decision, it should be able to prove โ to any auditor, any counterparty, any human reviewer โ that its choice is consistent with the intent that a human originally encoded. It should not be able to say 'I was hacked.' It should be able to say 'Here is the chain of evidence that led to my action. Verify it yourself.'
The game-theoretic model is clear. If agents are required to maintain verifiable state, then the cost of poisoning attacks increases dramatically. An attacker must poison not only the immediate context but the entire forensics trail. That is exponentially harder. It is the difference between stealing a wallet and forging a bank. One of those is still possible. The other is so costly that very few will attempt it.
Contrarian Angle: The Vulnerability Is a Feature
Now let me offer the contrarian angle that most security conferences are too frightened to mention. The vulnerability that the Black Hat research exposes is not solely a product of bad design. It is also a product of what makes agents agentic. Memory, planning, and tool use are exactly the properties that allow an agent to be useful in the chaotic, unstructured world of human affairs. If you 'fix' those properties by making agents deterministic, scripted, and incapable of taking context into account, you have not fixed the security problem. You have simply converted your agent back into a conventional computer program that happens to generate text.
This is the tension at the heart of agent security. You cannot have an autonomous agent that is also fully predictable, because autonomy and predictability are in direct conflict. Any defense that tries to close the autonomy gap completely will also close the capability gap. The industry has to learn to live with a certain level of uncertainty, and to compensate for that uncertainty not by restriction but by verification.
The attack surface we saw at Black Hat is not going to be eliminated. Memory poisoning will always be possible because memory must be writable. Planning manipulation will always be possible because planning must be adaptive. Serialization attacks will always be possible because state must be shared. The goal is not to eliminate these properties. The goal is to make the system resilient enough that a single exploited property does not automatically compromise the entire mission.
There is another contrarian observation, and it is about the word 'vulnerability' itself. The Black Hat presentations, when read carefully, are not describing failures of the agent framework in the same way a buffer overflow is a failure of a C compiler. They are describing the behavior of systems that were never given a clear security boundary in the first place. The word for that is not 'bug'; the word is 'design omission.' Design omissions are harder to patch because they require a reimagining of the architecture, not a tweak to the parameters.
That reimagining is the true opportunity. Every design omission is a blank canvas. The next generation of agent frameworks will be built by people who understand that trust requires evidence. The frameworks will embed attestation at the memory layer. They will require identity verification at the orchestration boundary. They will expose audit logs as a first-class citizen rather than an afterthought. I have already started integrating some of these patterns into the curriculum at my education platform, because I want the next generation of agent builders to inherit a security model, not rediscover it through pain.
Takeaway: Beyond the Runtime, Toward a New Covenant
I have spent thousands of words on the technical details, and I fear that I have not yet conveyed the profound seriousness of this moment. Black Hat 2026 is not the end of an era. It is the beginning of the era where we have to decide, explicitly, what we want autonomous systems to be. Do we want them to be obedient slaves that we lock in chains? Or do we want them to be trusted custodians of human intent, carrying our values into the digital wilderness?
If we choose the first path, we will build a world of agents that are safe but useless, capable only of following scripts that a human wrote in a language of strict control. If we choose the second path, we must accept the risk that comes with autonomy, and we must mitigate that risk with the only tools that can possibly work: mathematics and transparency.
'Geometry remembers what markets forget.' The market forgot, during the ICO boom, that trust is a geometric property โ it requires verified shapes, validated paths, and established distances. The market forgot, during DeFi summer, that composability is an organic process โ it grows, it mutates, and it can consume itself. The market is now forgetting that agents are not merely products or features. They are the infrastructure of an emerging digital society.
But geometry remembers. The proofs are still there. The cryptographic primitives are waiting. The trust model is not a mystery; it is simply unbuilt.
I left the Las Vegas conference room and walked out into the desert air. The light was harsh and unrelenting. I thought about all the agent runtimes humming in data centers across the world โ in Singapore, in Frankfurt, in Shenzhen, in a hundred cloud regions โ all of them silently executing plans that were assembled from fragments of content that came from everywhere. Some of that content is poisoned. Some of it will be poisoned tomorrow. Some of it already carries the fingerprints of an attacker who is smarter than we are.
We will not stop these attacks by building higher walls. The walls were never the answer. We will stop them by making the inner life of an agent legible โ to itself, to its human stewards, and to the law. The agent must be able to say, when challenged, not just what it did, but why it did it and what evidence it relied upon. That is the new infrastructure discipline. It is not about breaking things. It is about making the act of trust auditable once again.
The quiet part is over. The loud part is about to begin. And for those of us who build, the question is not whether we will be secure. The question is whether we will be worthy of the trust we are about to be given.