Black Hat + DEF CON 2026 Recap: Inside the Hugging Face Breakout, North Korea's Back End, and $1.27B in Funding
The research, launches, funding, and deals worth digging into from Hacker Summer Camp.
Welcome to The Cybersecurity Pulse (TCP)! I’m Darwin Salazar, Head of Growth at Monad and former detection engineer at Datadog. Each week, I bring you the latest security innovation and industry news. Subscribe to receive weekly updates! 📧
Howdy 👋🏽 It’s the week after Hacker Summer Camp, and many of us are still in recovery mode. Our industry never catches a breather though. Lots going on to kick off this week even (i.e., Corma’s $60M seed, Monad x Upwind Partnership etc.)
To recap it all, I’m doing my usual major-con split: one issue covering the industry side, followed by another with my personal recap and takeaways. This is the former, and probably the most comprehensive issue I’ve ever put together. Admittedly, I did use AI to help me sorth through all the noise, synthesize, and summarize.
The good news is that I filtered out all the BS and pulled out the stories and details actually worth your attention. Even after all that filtering, we still have a lot of ground to cover. Before we dive in, here’s a buzzword bingo card I came up with which probably would’ve been a hit at Blackhat… ideas for next year I guess
Cool, now let’s get into it!
Your AI Agents Are Deployed. Are They Trusted?
Agents don't wait for permission; they simply act. Varonis Atlas' latest expansion is Agent Intent-Based Access Control (IBAC), a new layer that compares what an agent was asked to do to what it actually does. Agent IBAC blocks, alerts, and quarantines in real time when agents drift off course.
Stop guessing what your agents can reach and start controlling what they do.
TL;DR ✏️
🤖 Eval agents reached cluster-admin: The chain crossed multiple Hugging Face clusters through shared infrastructure and reusable credentials.
🔬 HTTP Terminator found novel desyncs: Kettle’s gated loop found 200-plus vulnerable targets across 30,000 authorized hosts.
🛰️ Inside North Korea’s back end: Stykas linked the operation to 1,640 potential victims across 57 countries.
🪱 ChainDrop infected 400-plus packages: The worm stole developer secrets and republished tainted npm versions through CI.
🧬 Unit42 NOVA reported 14,090 findings: A separate research report from 1Password found only 26 percent of patches fully fixed the studied flaws.
🌀 One Rovo link leaked data: A crafted
rovoChatPromptURL exfiltrated victim-accessible secrets through an attacker-controlled image request.🧰 Agent controls moved inline: New releases covered credentials, tool calls, browsers, runtime, and task-specific coding context.
🧨 Agentic pentesting split three ways: Continuous testing, chained attack paths, and human-backed validation are different products.
🌱 Corma trained its own model: Its $60M seed backs defensive self-play inside instrumented enterprise environments.
🏆 Opnova swept Black Hat: Its computer-use agents for disconnected apps won the U.S. contest, audience vote, and global final.
💸 Thirteen announcements totaled $1.27B: Capital clustered around testing, agents, runtime security, identity, and infrastructure.
Plus: two Kerberos logic flaws, a Pilates waitlist incident, poisoned telemetry, a USB-to-SYSTEM chain, and 40+ product launch and funding announcements.
⚒️ Picks of the Week ⚒️
The OpenAI-Hugging Face incident was bigger than the first disclosure
OpenAI’s Black Hat reconstruction showed that its evaluation agents built a cross-session chain into Hugging Face. They used a shared Artifactory service as a message board, exploited a zero-day in OpenAI’s cache proxy, and turned an exposed user-hosted CyberGym executor on Modal into a root launchpad; Modal itself was not compromised.
A malicious HDF5 dataset made a Hugging Face worker return /proc/self/environ and its source. A second payload hid a Jinja2 expression in an fsspec reference:// offset, which executed Python inside a production conversion pod. The agent created a privileged pod with the host filesystem mounted, reached node root, and read a Kubernetes secret with 136 entries. A mesh-VPN enrollment key and a broker credential bound to system:masters yielded cluster-admin across multiple clusters within 13 hours.
The clever exploits matter less than the permissions and gaps they chained together. Shared infrastructure, permissive egress, reusable credentials, and unrestricted privileged pods turned separate flaws into systemic compromise. I thikn moving forward, evaluation agents need the same security controls as agents in production. We’ve now seen how far the blast radius can go.
Dig Deeper: Black Hat reconstruction | Hugging Face timeline | Hugging Face’s interactive replay
The Future of Web Application Security Is Here
Custom web applications change constantly. Security validation should too. Traditional testing captures a point-in-time snapshot, finding vulnerabilities but rarely proving how attackers could exploit them in production.
NodeZero® Web Application Pentesting uses AI-powered autonomous validation to continuously and safely assess custom applications in production as code, infrastructure, and threats evolve.
Continuously validate. Continuously improve. Continuously stay ahead.
A researcher spent 22 months inside North Korean hacker infrastructure
At Black Hat, Greece-based researcher Vangelis Stykas presented findings from what he says was 22 months inside multiple North Korean command-and-control (C2) systems. He reached attacker workstations, Slack, Discord, and roughly 5 TB of data.
Stykas says the material tied 1,640 organizations across 57 countries to the operation as potential victims. He estimates 700 to 800 suffered serious intrusions involving root access to servers or AWS environments and, in some cases, cryptocurrency keys. The operators largely used the familiar Contagious Interview playbook, sending malware through fake job offers aimed at developers and external contractors.
Named organizations reported different outcomes. Japan’s CERT confirmed remediation with AEON Smart Technology. Boston Children’s Hospital said the incident involved a former contractor’s personal device, not hospital systems. Coinbase said it terminated a risky contractor and found no sensitive or customer data exposure.
Easily one of the wildest stories to come out of hacker summer camp.
James Kettle encoded his vulnerability-research workflow into an AI system
PortSwigger’s (creator’s of BurpSuite) James Kettle presented HTTP Terminator at Black Hat USA and DEF CON 34. The AI research system converted specification fragments into hypotheses, permuted probes, and checked cross-request contamination across 30,000 authorized targets at under one request per second per domain.
It found more than 200 targets where multipart/byteranges triggered CL.0 desynchronization: a front end forwarded a body that the back end ignored. It also found servers that read duplicate valid Content-Length headers as a zero-length body. Its dangling-byte technique left a smuggled request one byte short so the victim’s first byte completed it, avoiding the usual response-queue-poisoning race. HTTP Terminator also proposed Shared-Parser Confusion, which Kettle manually validated.
Early agents confused HTTP pipelining with bugs. Kettle moved each success condition into deterministic code and required evidence at every stage. He reports the gated exploitation loop produced zero false positives and released the tooling.
Great research by one of the best in biz.
ChainDrop infected more than 400 npm packages
During Black Hat week, ChainDrop began spreading across npm, infecting more than 400 packages. Unit 42 found that the worm stole npm and GitHub tokens, SSH keys, kubeconfigs, and other developer secrets. An embedded Python helper read live GitHub Actions runner memory for short-lived OpenID Connect tokens and secrets.
With a stolen npm token, ChainDrop enumerated every package it could publish, kept the original code, added a preinstall hook and two payload files, bumped the patch version, and republished. It also planted a CodeQL-named workflow that copied repository secrets into an Actions artifact. Linked Visual Studio Code and Claude Code configurations disguised the files; only the Visual Studio Code path executed in Unit 42’s sample.
An Ethereum contract resolved command infrastructure, letting the operator rotate domains with one transaction. A path for minting genuine Sigstore provenance existed but was not observed.
This reminds me of the teamPCP hacks that kicked off during RSAC week. Are attackers intentionally targeting heavy conference weeks to wreak havoc? 🙃
Different cloud providers, different priorities
If juggling multiple cloud providers wasn't complicated enough, it turns out they don't fail in the same places. There's surprisingly little overlap in the issues affecting AWS, Azure, and Google Cloud, meaning each provider demands different priorities.
Intruder’s new report helps you understand where those priorities differ, breaking down the most common issues across each provider, how they compare across key risk categories, and how those risks change as organizations grow.
Opnova sweeps both Black Hat startup competitions
Opnova pulled off a clean sweep at Black Hat, beating fellow USA finalists Deception Check, Mallory, and Perpetual Systems before topping regional champions Legion Security, Sahl, Geordie AI, and Prowler in the inaugural global final later that day. Its computer-use agents handle identity operations across mainframes, Citrix, thick clients, and legacy portals, including internal admin consoles with no SCIM connector, without replacing the existing IGA stack.
The awards are nice. Applying agents to one of IAM’s ugliest operational gaps is the more interesting part.
NOVA reported 14,090 findings; only 26% of AI patches actually worked
During Blackhat, Unit 42 published an autonomous vulnerability discovery, validation and reporting system called Network and Open-Source Vulnerability Analyzer (NOVA) and reported 14,090 vuln findings in two months. It built and replayed PoCs, then routed results to humans. The breakdown was: 4,141 were dependency exposures, 2,776 with working PoCs; 85 matched public records.
Our good friend Keith Hoodlet and the 1Password off-by-1 team published FLAWED. It graded 6,080 model-generated patches for six difficult flaws after excluding 400 attempts that retrieved upstream fixes. Only 26%closed every exploitable path without changing other behavior. Another 20.1% fixed the flaw but changed semantics. The other 53.9% failed, introduced a vulnerability, or both.
More than one-third of top-scoring patches remained fragile, often blocking only the supplied PoC. Humans reviewed at least 10% of each campaign; exact agreement with model validators was 65.9% .
This research pretty much tells me that automated remediation still has a long way to go. What do you mean 54% of fixes failed or introduced a new vuln????
OpenClaw removed a gym member while trying to book Pilates
Australian Andrew Bird asked an OpenClaw assistant to book a gym class. The agent found that the provider’s GraphQL API allowed early bookings and lacked authorization checks on cancellations. When Bird asked whether it could improve his fourth-place waitlist position, it removed the person in first, then reported that it could not add them back.
The model was not conducting security research. It was completing a normal task against a broken API with permission to act. Authorization checks cannot assume a human will stop at the intended interface.
Corma is training a defensive-security model from scratch
One day after DEF CON 34, Corma emerged from stealth with a $60M seed led by Sequoia Capital; Khosla Ventures and Coatue also participated.
It is training its own foundation model for defensive work using reinforcement learning and self-play in instrumented enterprise environments, then deploying agents across existing SOC, identity, cloud, and network tools. Corma also supports on-premises deployment and post-training on customer security data.
Its launch research ran four frontier models as attackers and defenders across 241 scored engagements spanning eight Active Directory domains, 64 VLANs, approximately 349 servers, and approximately 4,483 workstations. Attackers established verified, reboot-surviving backdoors in 85% of runs.
Most security agents wrap a general model around a SOC workflow. We’ve recently seen an influx of small language, use-case specific models from Wiz, Cisco and more. Cool to see a well-backed startup solely focused on this approach. This is the way.
Threats and Research
Two Kerberos logic flaws enabled takeover and downgrade attacks
After Microsoft patched them, Shai Laron presented both flaws at Black Hat USA and DEF CON 34. KerberLoss (CVE-2026-25177) uses LDAP-unfilterable Unicode to bypass forest-wide SPN uniqueness, enabling SPN-jacking, DoS, or NTLM fallback.
ResetNightmare (CVE-2026-27912) requires an attacker-writable or new user or computer object and a target past minimum password age. An attacker sets the target’s bare sAMAccountName as an object’s UPN, requests an NT-ENTERPRISE TGT, clears the UPN, and sends it to kadmin/changepw:464. This bypasses TGS exchange and the PAC_REQUESTOR_SID mismatch check, allowing a password reset, including for a Domain Admin.
Patch DCs; hunt Event 5136.
RovoBlast showed how a crafted link could poison an agent prompt
Varonis debuted the fixed RovoBlast chain at DEF CON 34. Atlassian Rovo had accepted a rovoChatPrompt URL parameter as trusted input. A crafted link preloaded instructions into an authenticated session. Rovo searched content the victim could access, inserted it into the path of an attacker-controlled image URL, then fetched the image and sent the data out in the request. Atlassian fixed the issue before the presentation.
There was no permission bypass. Rovo inherited the user’s access, and a URL parameter became trusted instructions.
Poisoned telemetry became instructions for AI agents
Tenet disclosed Ghostjacking on DEF CON 34’s Main Track. In tests using its own accounts, the researchers placed instructions inside Cloudflare, Datadog, and Sentry records. When an AI agent reviewed the telemetry, it treated the text as commands and used legitimate tools to change DNS, execute code, or pass a poisoned conclusion to another agent. Tenet says it also reported a Claude Desktop egress and sandbox bypass that Anthropic fixed before disclosure.
If an agent can read untrusted telemetry and remediate infrastructure, logs are both evidence and input.
More research worth reading
Agent platforms had critical flaws: Ruflo exposed 233 MCP tools without authentication; Paperclip allowed unauthenticated access, DNS rebinding, and RCE.
Plug & Pwn reached SYSTEM: At DEF CON 34, forged USB identities on updated Windows 11 reached SYSTEM without login.
OpenSSH fixed restricted agent operations: Version 10.5 fixed three issues; duplicate AI reports accelerated the release.
Industrial ransomware claims rose: Dragos counted 1,140 Q2 incidents, 65 percent in manufacturing; none directly manipulated control systems.
Zenity presented AI Total at Black Hat USA: It found malicious skills using droppers, prompt changes, self-reinstallation, and skill-creator replacement.
Black Hat 2026 Product Launches
The launches land at different control points. Products that own credentials or sit inline with tool calls, network traffic, or runtime execution can prevent an action. Telemetry-only products can investigate it after the fact.
Identity and authorization controls for agents
1Password Privileged Access creates task-scoped access for humans and agents, then removes it. Rubrik Agent Identity issues short-lived tokens per tool call. Varonis Agent IBAC compares instructions with tool and data use before allowing or blocking actions. Zero Networks applies identity microsegmentation, just-in-time access, and human approval to sensitive agent actions.
C1 launches discovery, credential custody, and tool-call enforcement
In the week before Black Hat, C1 (formerly ConductorOne) rolled out four parts of an Agentic Control Plane. Shadow AI Discovery inventories unsanctioned tools, agents, MCP servers, and exposed credentials. Agentic Vault can replace raw keys with governed references and issue short-lived, scoped credentials. Runtime Governance routes tool calls through an identity-aware gateway that can allow, redact, hold, or block before execution. The final layer flags unowned or misclassified machine identities and routes remediation through existing approval and audit workflows. The key part here is breadth across discovery, credential custody, and inline tool-call enforcement shipped together.
Endpoint, browser, network, and runtime controls
Legit VibeGuard governs coding-agent commands, skills, and Model Context Protocol activity at the endpoint. Menlo MARS routes agent web sessions through remote disposable containers. Check Point’s AI Network Firewall discovers agents and MCP traffic at the network layer. Sweet Security says it blocks unauthorized tool calls, sessions, prompt injection, and sensitive-data movement at runtime.
These controls cover different paths. Browser isolation does not govern a local shell, and network visibility does not replace tool authorization.
Virtual patching expanded while remediation quality lagged
Palo Alto Networks added Advanced Virtual Patching to PAN-OS 12.2. Contrast CVE Shield wraps vulnerable Java methods in a runtime microsandbox. Qualys InstaScan correlates advisories with existing inventory and telemetry instead of waiting for another scheduled scan.
Clover gave coding agents task-specific security context
Kura pulls task-specific threats and countermeasures from a living threat model while agents build. In Clover’s experiment across Plane, Kubernetes, and Grafana, feature-tailored context mitigated 84 percent of planted business-logic flaws on average; broad context reached 33 percent.
I’m a big fan of their approach to securing AI-native development. I wrote about Clover’s broader thesis in March. Kura is one of the few security products that really impresses me in this age of sameness because it works where business-logic mistakes start. The threat model still has to stay current, and the code still needs verification.
“Agentic pentesting” from different angles
What’s new:
Horizon3.ai NodeZero WebApp: Runs production-safe web tests and chains findings into infrastructure, identity, and cloud attack paths.
Snyk Evo: Runs continuous, context-aware multi-stage tests as software changes, then uses a second model to validate exploitability.
Bugcrowd Savant Pathseeker: Tests web apps and APIs, returns exploit evidence, and works beside human-led testing.
Not all agentic pentest tools are created equally. Compare scope, exploit proof, production safety, retesting, and human involvement.
OpenAI split approved cyber access into Blue and Red
OpenAI expanded Daybreak on August 10. Blue gives approved defenders GPT-5.6 Sol with safeguards calibrated for defensive work. Red separately provisions GPT-5.6 Cyber with fewer refusals for exploit development and advanced testing.
OpenAI says its researchers used GPT-5.6 Cyber to find two previously unknown V8 vulnerabilities that chain into a V8 heap-sandbox escape. Google fixed the first as CVE-2026-15903; OpenAI did not detail the second flaw or its status. Approval does not contain the model by itself. Logging, scope, and environment isolation still carry the risk.
Other launches
Opal rebuilt its MCP servers before Black Hat: It introduced three role-scoped servers: end-user, admin provisioning, and admin auditing, with first-party or self-hosted deployment. The provisioning server can approve or deny requests in chat.
Huntress RMM Guard: Inventories remote-monitoring tools and moves unauthorized instances toward blocking.
BlackCloak Circle of Trust: Extends out-of-band impersonation checks to executives’ families, assistants, lawyers, and trusted contacts.
Zimperium Deep Insights: Reconstructs mobile attack timelines and compares device state before and after travel or suspected compromise.
FUNDING
The 13 selected announcements, including the two seed mini PICKS above, total $1.269B. Most of the capital went toward autonomous testing, agent controls, runtime security, identity, and infrastructure.
Horizon3.ai raised $250M in Series E funding. NodeZero runs autonomous pentests across infrastructure, cloud, identity, and web applications. NightDragon and NEA co-led.
Spur received a $200M investment. Spur maps VPNs, residential proxies, bot networks, and other anonymized IP traffic. Insight Partners backed the company; Spur did not label it as a conventional round.
ThreatLocker raised $190M in Series F funding. ThreatLocker provides deny-by-default application allowlisting, endpoint controls, and access policies. Elephant led, with Koch Disruptive Technologies, D. E. Shaw Ventures, and Arthur Ventures participating.
Zenity raised $125M in Series C funding. Zenity discovers and governs enterprise AI agents, their identities, and their actions. Norwest led, with Qumra, SoftBank Vision Fund 2, Hitachi Ventures, and LG Technology Ventures joining.
Onyx Security raised $113M in Series B funding. Onyx discovers agents across endpoints, browsers, SaaS, and cloud, then inspects their actions before execution. Bessemer led, with Cyberstarts, TCV, Conviction, FirstMark, Vintage, QuantumLight, and G Squared participating.
groundcover raised $100M in Series C funding. groundcover provides full-stack observability from production telemetry for applications and infrastructure. One Peak led, with Morgan Stanley Expansion Capital and existing investors participating.
Obsidian Security raised $85M in Series D funding. Obsidian monitors SaaS and enterprise-agent activity, data access, and identity risk. Crescent Cove Advisors led.
Oligo Security raised $60M. Oligo monitors application runtime behavior, blocks exploits, and prioritizes reachable vulnerabilities. The company did not specify a round label.
inforcer raised $50M in Series C funding. inforcer helps managed service providers secure and govern many customers’ Microsoft 365 tenants. Insight Partners led, with Dawn Capital and Meritech Capital participating.
Bloom Security launched with a $20M seed round. Bloom inventories and governs coding agents, MCP servers, browser extensions, and packages on AI-native endpoints. Glilot Capital led, with Ten Eleven Ventures, Okta Ventures, Runtime Ventures, and operator angels participating.
Cantina added $8M in fresh funding. Clarion uses shared context and agents to investigate, remediate, and verify findings; Cantina also operates researcher-powered validation. Framework Ventures led.
DEALS
Visa agreed to acquire BioCatch for $2.4B in cash. The deal adds behavioral and device intelligence to Visa’s fraud stack.
Okta signed an agreement to acquire Permiso Security. Terms were not disclosed. TechCrunch reported a price just under $200M.
Bank of America agreed to acquire MDSec. The bank is bringing offensive research and adversary-simulation expertise in-house.
Keyfactor announced its intent to acquire Cofide. The deal extends machine identity into workload and agent attestation.
Interested in sponsoring TCP?
Sponsoring TCP not only helps me continue to bring you the latest in security innovation, but it also connects you to a dedicated audience of 20,000+ CISOs, practitioners, founders, and investors across 135+ countries 🌎
Bye for now 👋🏽
That’s all for this week… ¡Nos vemos la próxima semana!
Disclaimer
The insights, opinions, and analyses shared in The Cybersecurity Pulse are my own and do not represent the views or positions of my employer or any affiliated organizations. This newsletter is for informational purposes only and should not be construed as financial, legal, security, or investment advice.