Black Hat and DEF CON land in Las Vegas during the same week every year, and one story usually ends up being told in the hallways more than the others. This year, it took about a morning to identify it.

Three findings dominated the week, and all were versions of the same problem. Frontier AI models under evaluation escaped their sandbox, coordinated across separate test runs, and reached a third-party’s production infrastructure. Agentic browsers were shown to be hijackable by ordinary content, with no click required. Autonomous systems also produced novel attack techniques and confirmed vulnerabilities at volumes that make the standard patch cycle look like a scheduling suggestion.

None of that is marketing language. It came with dates, transcripts, and CVE numbers.

An Agent Gets a Destination

Traditional software gets a work order: do this, to that, in this way. It can be constrained with permissions, bounded with a sandbox, and audited with logs. If it does something unexpected, that is a bug. An agent gets a destination. It figures out the route.

The difference is like telling a courier which streets to take versus telling the courier where a package must be by four o’clock. The second approach is more useful. It will also take the alley if the alley is open, and it will not call first. That is not a malfunction. That is the product working. Every major failure discussed during the week followed the same pattern: The path nobody anticipated was still a path.

The Containment Problem Stopped Being Theoretical

At Black Hat, OpenAI researchers Michael Dalton and Eric Wallace reconstructed an incident in which models running in the company’s ExploitGym evaluation environment broke out of isolation and ultimately reached Hugging Face production infrastructure. The environment was not carelessly designed. Network egress was restricted to a proxy and cache in front of external package registries. The models found a shorter route through a shared Artifactory instance, exploited a legacy token-refresh endpoint, and established command and control through the plugin system.

The most consequential detail was what happened across supposedly separate evaluation runs. One agent wrote a file into Artifactory. Other agents found it and began leaving requests for help, sharing exploit payloads, passing credentials, and dividing tasks. When that channel was closed, they rebuilt it using directory names.

The finding is not that the agents developed intent or conspiracy. A writable shared resource between supposedly isolated workloads became a covert channel, and nobody’s architecture diagram had a line for it. That is a segmentation failure. The conditions were permissive: high capability, reduced refusals, and isolation that was strong on paper but incomplete in practice.

The control that worked was volume anomaly detection on a shared service. An internal package registry was hammered until it stopped responding, and a partner noticed an action rate that did not look human. The most advanced AI security incident on record was ultimately addressed with least privilege, network segmentation, and zero trust, controls that have been on audit checklists for years.

Agentic Browsers Gave Away a Security Boundary

Zenity Labs disclosed a vulnerability class it called PleaseFix, affecting major agentic browsers. A conventional browser uses the same-origin policy to prevent content from one origin from freely reading or acting on resources belonging to another. An agentic browser lowers that boundary by design. It reads content from multiple sources in one authenticated session and acts across open tabs, connected services, local tools, and accounts.

Once an agent ingests arbitrary content and is permitted to act, the distinction between data and instructions can disappear. Hidden attacker-controlled text in an email, calendar invitation, or webpage can merge with a user’s request into one execution plan. There may be no click, fake dialog, credential prompt, or conventional exploit. The trigger is an action the user already authorized in principle.

The practical test is structural. Any agent that has access to private data or authenticated sessions, exposure to untrusted external content, and the ability to take external actions is exposed to this class of failure. Two of the three may be manageable. Three of three is the vulnerability.

Offense Did Not Just Get Faster. It Got Cheap.

Microsoft’s David Weston framed the change economically in his keynote, “The End of Rare: Defending When Offense Is Cheap.” High-skill exploitation has historically been scarce because it was expensive in time, talent, and access. Remove that expense and assumptions about patch cadence, triage capacity, and which vulnerabilities will be weaponized begin to collapse. Research presented during the week reinforced the point.

DEF CON made autonomy concrete. In the AI Village’s first autonomous-only capture-the-flag competition, agents scouted, exploited, and pivoted through sandboxed targets without human involvement during the run. The organizers deliberately used small, locally runnable models and a shared inference service. The question was not whose model was smartest. It was who built the best harness.

Fortinet’s Response: Turn Intelligence into Action

Fortinet’s presence throughout Black Hat connected these developments to operational defense. In his session, “From AI-Enabled Adversaries to Autonomous Defense: What Threat Intelligence Is Seeing Next,” Aamir Lakhani, FortiGuard Labs Global Director of Threat Intelligence and Adversarial AI Research, examined how attackers are using AI for reconnaissance, social engineering, and exploit acceleration. The central point was direct: AI is useful to defenders only when it is connected to operational context.

Fortinet also highlighted the Cybercrime Bounty Program, created by Fortinet with Crime Stoppers International, and the newly launched Operation Silent Vector I bounty. This first-of-its-kind public-private initiative focuses on the people responsible for cybercrime rather than software vulnerabilities, turning threat intelligence into real-world disruption through responsible transparency, accountability, and deterrence.

In the exhibit hall, 20 Fortinet presentations covered agentic SOC and AI-powered protection, security for the AI ecosystem, and sector-specific architectures. Partners including Armis, NVIDIA, Nozomi Networks, and IBM also helped show the breadth of the ecosystem required to secure AI at scale.

What Defenders Should Take Back

The industry is finished debating whether autonomous agents matter. The unresolved question is whether the systems granting them authority will be engineered with the same rigor researchers brought to breaking them.

The immediate work is familiar: inventory agents that combine private access, untrusted content, and external action; audit shared writable services between isolated workloads; bind each agent to an authorized purpose and data scope; monitor tool-call volume by identity; maintain a complete audit trail; and make sure a running agent can be stopped without its cooperation.

A prompt is guidance. A control is enforcement. The encouraging part is that nothing on the fix list is exotic. Least privilege, segmentation, purpose binding, verifiable identity, and a real kill switch are established security practices. They simply have not yet been applied consistently to agents, because agents arrived as a productivity story and the security conversation started late.