Black Hat USA 2026 gave Check Point Research four chances to show the room something it hadn’t seen before. Across two days, our researchers pulled apart a decade-old Windows driver, a malware format most tools can’t touch, the plumbing underneath today’s AI agent frameworks, and the sandbox meant to contain them, and found the same pattern waiting in each: attackers moving into the layers we trust by default.

Here’s a look at what they presented.

BTR Reforged: The Driver Nobody Had Looked At

Jiří Vinopal opened the day with a talk that started from an uncomfortable premise. Somewhere inside Windows Defender sits a kernel driver built to clean up malware that survives a normal removal. It runs in Ring 0, takes encrypted instructions from disk, and deletes itself when the job is done. Despite sitting on every Windows machine for over a decade, nobody had ever published an analysis of how it actually works.

Jiří took it apart from raw binary, with no documentation and no symbols to lean on, across eighteen signed builds spanning Windows 7 through a fully updated Windows 11 25H2. Every single build carried the same hard coded encryption key. Once he learned to speak the driver’s language, he could hand it his own instructions instead of Defender’s.

The talk walked through what that capability actually unlocks: a full set of Ring 0 file and registry operations, a boot phase window where the filesystem comes alive before Defender’s own protection does, and a live demo showing the entire Defender stack deleted from a fully patched, fully protected machine. Since the driver is doing exactly what Microsoft built it to do, there’s no CVE attached and no patch coming. Jiří released his tool, BTR_CLI, open source at the end of the session, along with detection guidance built on behavior rather than signatures.

The line that summed it up best: the defensive technology became the offensive capability.

No Tools Required: Post-Injection Exploitation Across AI Agent Frameworks
Shahar Tal and Yarden Porat followed with a talk that pushed back on how the industry has been framing prompt injection. Treating it purely as a model behavior problem, or purely as tool misuse, misses where the real damage happens. It happens when content an attacker controls crosses into a framework’s own internal plumbing, its serialization, its caching, its file parsers, none of which were built to handle hostile input.

Shahar and Yarden audited the frameworks much of the industry is actually building agents on: LangChain, Google’s ADK, Microsoft Agent Framework, and CrewAI. Across the four, they found 12 CVEs. The part that stuck with the room was how little the attacker has to do. In several cases, nobody calls the dangerous function directly. A poisoned document lands in the agent’s memory, and the framework’s own save and reload behavior fires the payload on its own.

Their closing point landed hard: most of these bugs are ones the security community already knows how to fix. The challenge is recognizing them once they’ve moved into a new part of the stack.

Breaking the Seal: Cracking Open Compiled V8 Bytecode Malware

Aleksandra “Hasherezade” Doniec closed out Check Point Research’s part in the day’s event with a talk built around a simple, frustrating question. What do you do when you have to analyze an atypical malware format, for which tools are scarce?

Aleksandra ran into this while tracking JSCeal, a cryptocurrency focused stealer Check Point Research has followed since early 2025. The payload arrives as compiled V8 JavaScript bytecode, wrapped in Brotli compression and run through a bundled Node.js runtime, with the original JavaScript obfuscated before it was ever compiled. Standard reversing tools barely touch this format. The original JavaScript from which the payload was generates is not distributed, and technically gone by the time an analyst gets a copy.

Rather than settle for behavioral analysis alone, Aleksandra built a full deobfuscation pipeline to get back to something readable. It leans on View8, a disassembler built for this exact format, alongside a series of custom passes that unravel string encoding, undo control flow flattening, and strip away layers of proxy functions. The last stage hands the cleaned up output to an LLM, which proposes meaningful function names based on what the code actually does, turning a wall of gibberish identifiers into something an analyst can follow.

Run across twenty real JSCeal payloads, the pipeline surfaced browser and cryptocurrency theft, Telegram session collection, keylogging, screenshot capture, and a local HTTPS interception proxy that installs an attacker controlled certificate, all recovered statically. Aleksandra released the toolkit as open source at the end of the talk, so other researchers can put it to use.

Her closing thought fit the day well: compiled V8 bytecode doesn’t have to stay a sealed box. With the right pipeline, it turns back into something you can analyze like code.

When Agentic Glue Melts: Exploiting Cloudflare Code Mode and Workers

Cloudflare’s Code Mode is built on a genuinely interesting bet. Rather than having a model call tools one at a time, let it write a small program and run that program inside a locked down sandbox. Shahar and Yarden set out to see whether that sandbox would hold, and rather than chase the model itself, they went straight at the runtime powering it, worked, the same code handling more than a tenth of all traffic on Cloudflare’s network.

They found five memory corruption vulnerabilities, two of them rated Critical. Two carried the talk. The first was a flaw in URLPattern that let an attacker reach across the boundary meant to separate tenants and pull a neighboring customer’s secrets straight out of shared memory, with every defense fully switched on. The second was a use after free bug in node:zlib that the pair chained all the way to arbitrary memory read and write, and from there to a full sandbox escape, demonstrated on self hosted worked and starting from nothing more than a prompt injection.

Cloudflare ran a full disclosure process and shipped fixes for everything in worked v1.20260619.1.

The idea Shahar and Yarden left the room with was simple and worth sitting with the sandbox protects the engine, not the glue holding it together. Once a model is the one writing the code, that glue becomes the boundary, and it needs to be audited like one.

Wrapping Up Black Hat

The thread connecting all four talks this year: the weak points weren’t in code attackers wrote, but in code we’d already agreed to trust. From a kernel driver nobody thought to question, a malware format most tools can’t even read, an agent framework’s own internal plumbing, to the glue code stitching a sandbox together. Scrutiny, not just defense, is what closes that gap.

Full technical write-ups from each talk will be published on research.checkpoint.com. Thanks to everyone who stopped by to talk shop with us this week. And to Jiří, Aleksandra, Shahar, and Yarden for the work behind these talks.