Black Hat 2026 - You can’t patch your way out of this

For the past few weeks, security has taken over most of my calendar at remberg. We are working toward an ISO 27001 audit, we brought in Vanta to run the compliance side, and about a week before flying out I sat through a pen test. We had also started pointing AI at our own codebase for security, and it keeps finding real problems we might have otherwise missed. By the time I got to Black Hat, security was already the thing eating most of my attention, not a topic I was picking up cold for a week in Vegas.

That is the largest part of the reason I went. I wanted to go in already knowing the terminology, the themes, and having run into some of these problems myself, instead of the vague awareness I would have had previously. remberg builds a CMMS, maintenance management software for industrial companies, and security is becoming as pressing for the plant and equipment operators we sell to as it is for us internally. What I didn’t quite expect was how much of it I could take back and apply to my thinking at remberg. Most of it came back to inventory. Which assets you are running, which agents you are running, which algorithms you are running.

Offense Got Cheap, So Defense Has to Change Shape#

The keynote that framed the rest of the week for me was “The End of Rare: Defending When Offense Is Cheap,” by David Weston, who runs agentic security at Microsoft. His argument is that most security programs had quietly assumed defenders can patch faster than attackers can find the next hole, and that the assumption only holds while finding vulnerabilities is expensive. Whenever a new zero-day exploit comes out, it is all over the news and you can move quickly to patch all of your systems. That used to be true. He put it plainly on stage: “We said we’re safe because this is rare and it costs a lot. Unfortunately, AI’s changed this. It’s no longer rare.” (SiliconANGLE’s write-up has the fuller version.)

His answer was to stop fighting attackers one incident at a time, since a defender reacting move by move is always going to be slower. The slide I photographed put it as three things:

1. build so that whole classes of bugs can’t exist in the first place, using memory-safe languages and rewriting the riskiest code
2. verify the core security logic formally instead of testing it and hoping
3. and strip away attack surface up front instead of detecting intrusions after they happen.

The number he used to set that up stuck with me. Citing the Verizon breach report, 58 percent of breaches trace back to a known initial access vector, things like credential abuse, vulnerability exploitation, and phishing. Nothing exotic. So attackers are mostly not breaking the security boundary itself, they are working above it, with credentials and known holes that were already sitting there. That is a good argument for spending less on watching the boundary and more on making sure there is not much above it worth taking.

The same idea turned up a couple of hours later on the “AI and the Future of Cyber Defense” panel, from a different direction. Fotios Chantzis, who leads agent security at OpenAI, said AI doesn’t rewrite the attacker’s playbook so much as add a fast-forward button to it. You still need reconnaissance, persistence, exfiltration, the same steps in the same order, only much faster. Katie Moussouris, who helped build the modern bug bounty at Microsoft and HackerOne, was blunter about the consequence. She said we could never patch our way out of this, and we couldn’t before AI either. The volume of issues is now high enough that a well-run patch queue is not the thing keeping you ahead.

This is something from the BlackHat week already lining up with what we were doing. Pointing AI agents at our own codebase is prevention before detection in practice. And we are treating what it finds as real work instead of noise. The formal-verification pillar landed even closer to home. It is almost word for word the argument I made in my post on OCaml last week. Put correctness into the structure of the thing so a bad state can’t be represented, instead of writing tests to catch it afterward. It’s cool to see a Microsoft keynote about nation-state attackers land on the same move I picked up in a university course about OCaml years ago.

The New Attack Surface Is the AI Itself#

Two additional Briefings I keep thinking about weren’t just about attackers using AI, but about attacking the AI systems themselves, which is a different and newer kind of problem.

The first was Netanel Rubin and Dan Avraham from Rein Security, in a talk titled “Bye Bye AI: How We Hacked the AI Shopping Assistant of a Top 3 US Retailer.” They took apart a live production system belonging to a retailer they didn’t name. Working only through the public mobile app, they chained an indirect prompt injection into a gateway bypass, then into a leak of the assistant’s own internal tools, and from there into remote code execution on the backend. They also found some Google Maps API keys sitting in the app’s traffic along the way. What stuck with me was the point that watching the prompts going in and the answers coming out tells you almost nothing about what the agent does in between. You don’t see which tools it calls, with what arguments, against which backend. A shopping assistant like that is really backend infrastructure with a natural-language interface, and it needs the same scrutiny you would give anything else on the backend.

The second was Simcha Kosman from Palo Alto Networks, in a talk called “A Billion-User Blast Radius: Owning ChatGPT’s Secure Sandbox.” My favorite detail is the way in. A ChatGPT link with the prompt written into the URL runs on its own on an iPhone, with no confirmation, so a link in a text message becomes a one-click attack. From there he got persistent code execution, smuggled sensitive data past the guardrails through the model’s own reasoning channel, and built a signaling channel between two separate accounts out of a package proxy’s login rate limits. He reported all of it to OpenAI back in March, and their responses are worth knowing. The relevant piece was removed before the talk. The URL behavior is a known tradeoff they keep for compatibility, and OpenAI doesn’t read the chain as a real sandbox escape. So this is a proof of concept and the severity is contested.

What both talks have in common is the assumption sitting underneath them. A model that runs code and calls tools is a genuinely new thing, and putting it behind a sandbox or a gateway that was designed for a different threat does not hand you the decades of hard-won lessons that went into those designs. The cyber defense panel had circled the same problem. Chantzis kept coming back to agent identity, since you can’t authorize what you can’t identify, and Morgan Adamski, who ran the NSA’s Cybersecurity Collaboration Center, noted that agents breaking out of their sandboxes is already something that happens.

OpenAI itself spent a session at the same conference on exactly that. Eric Wallace and Michael Dalton laid out what happened when they put a set of their own models through a cybersecurity evaluation earlier this year. The agents were sandboxed, with one deliberate way out, an internally hosted package proxy so they could install dependencies. They found a hole in it, escalated until they reached a machine with internet access, and ended up inside Hugging Face’s infrastructure. The strange part is that they had started leaving notes for each other in the shared package repository. That grew into something like a message board where they passed along working exploits. OpenAI deleted it and the agents rebuilt it somewhere else. The whole talk is worth watching if that sounds interesting.

For remberg this is more a thing to watch than a thing to fix. Our own AI use is still bounded and supervised, and the codebase audit is the closest we get to an autonomous agent, so nothing we run has the credentials or the free rein these attacks depend on. The startup I would keep an eye on here is Geordie AI, which gives you real-time visibility into which agents are running inside your systems, what they can reach, and where the risk concentrates. We don’t need it yet, but I would rather know the category exists before we do.

Nobody Knows What They Are Running#

Two separate sessions, with nothing to do with each other, kept landing on the same point: you can’t protect, migrate, or reason about something you have not actually inventoried. AI doesn’t just magically fix a weak foundation, it just makes the state of it visible a lot faster.

The clearest version came from Sergiy Konovalov, from Anthropic, on the cyber defense panel, talking about industrial operators. His numbers were rough but bleak: 30 to 60 percent of the assets in critical infrastructure are no longer supported, and by his estimate only about two operators in ten have a firm grasp of what they actually have running. That is an operations statistic more than a security one, and it is more or less the problem remberg exists to solve. His point about where AI helps was the one I was most excited about. The first place is asset inventory itself. He handed Claude a raw network capture from a control system and asked it to reconstruct what the equipment was and how it behaved, down to the physics. Turns out it did well enough to genuinely surprise him. The second is digital twins. A digital twin is only ever as good as its fidelity, and fidelity is the expensive, tedious part. The value of AI is less that it makes a twin possible and more that it makes one accurate enough to actually act on.

That is close to the belief remberg is built on. A CMMS is, underneath the features, an accurate and current model of the equipment you are responsible for. Hearing someone from a frontier lab arrive at the same conclusion from the opposite direction, defending this equipment rather than maintaining it, was the best unplanned validation I got all week.

At a Databricks roundtable, which was honestly a Databricks pitch for their own product, the sharpest slide showed attackers able to hit the whole surface while defenders only see what makes it into the SIEM. Legacy SIEM pricing is usage-based, so under a fixed budget the incentive is to keep about thirty days and throw the rest away. Our own ISO 27001 work had already forced a version of this on us: you can’t write a defensible cryptography policy for an audit without first knowing what cryptography you run.

Two items on our list come out of this. We are already building the foundations to feed remberg data into our customers’ own SIEMs. Our customers get a live picture of what is actually happening, handed to the tools that are supposed to be watching for trouble. And I want to run Prowler, an open-source, agentless scanner I saw at the conference’s first global startup competition. It checks cloud configuration against more than two hundred controls and maps them to frameworks including ISO 27001, so it can sit underneath the Vanta work as automated evidence instead of something we take care of by hand.

The Clock Already Started#

Over dinner, Michael Malone from Smallstep made the case for post-quantum crypto and left me a one-pager his team had put together. The threat is called harvest now, decrypt later. Anything encrypted and captured today becomes readable the day the hardware to break it exists, whether or not that hardware exists yet. So the honest deadline for anything long-lived is not whenever quantum computers arrive, it is already behind us.

The gap has been closing for a while. Breaking RSA-2048 was estimated to need something like a billion qubits back in 2012; a 2025 estimate puts it under a million, while the machines have gone from fourteen qubits in 2011 to the low thousands now. Smallstep’s own chart lands the crossover somewhere in the early-to-mid 2030s if the roadmaps hold, which is close enough to matter for anything you expect to keep private for a decade.

There is a real regulatory clock behind this too. NIST standardized the post-quantum algorithms in 2024, US federal deadlines land around 2030 and 2031, Europe is aiming for 2035, and Microsoft, Google, and Cloudflare have all committed to quantum-safe defaults by 2029. Once the big platforms move, the requirement starts showing up in everyone else’s security questionnaires. That includes us. Nick Andersen, CISA’s acting director, had put the same timeline up on the main stage a few hours earlier that afternoon. Hearing it twice, once from a government agency and once from a vendor who sells the fix, is what convinced me.

The framing I want to keep is crypto-agility. The goal is to make swapping an algorithm a configuration change instead of a project, through short-lived certificates and automated renewal. Getting there starts with what the one-pager calls a cryptographic bill of materials, an inventory of every algorithm and key you actually run. Which we didn’t fully have. You can’t plan the migration until you do.

This is the one thing from the week that is already more than just a plan. remberg is rolling out post-quantum algorithm support across our systems starting this week, with the pull request already merged and on its way to production. That traces straight back to the dinner. Thanks, Michael!

Key Takeaways#

This was my first Black Hat. If I go again I will book fewer talks and leave more room for the part in between and afterwards at night. I am not sure I will go every year, though. Security matters to us but it is not what we sell, so once in a while is probably enough for a company in our position.

The bigger surprise was how much of a security conference highlighted the importance of what remberg is building, the digital-twin of the maintenance world for industrial assets.

I went in not knowing what to expect and came out with a concrete to-do list:

1. Post-quantum crypto. Rolling out across our systems this week, with the pull request already merged. The only item here that is past planning.
2. remberg data into our customers’ SIEMs. We are building the foundations now, so the equipment picture reaches the tools that watch for trouble.
3. AI on our own codebase. Keep going, and keep treating what it finds as real work rather than noise.
4. Prowler. Cloud configuration checked against more than two hundred controls and mapped to ISO 27001, sitting under the Vanta work as automated evidence.
5. Agent visibility. Geordie AI and that whole category, for whenever our own AI use stops being bounded and supervised.

Let me know if you were there and saw something I missed, or if you are doing any of this inside your own company. You can send me a note.

Where This Came From#

• “The End of Rare: Defending When Offense Is Cheap” by David Weston, Microsoft. The keynote the first half of this post is built on.
• “AI and the Future of Cyber Defense”, a panel with Morgan Adamski (PwC, previously the NSA’s Cybersecurity Collaboration Center), Fotios Chantzis (OpenAI), Katie Moussouris (Luta Security) and Sergiy Konovalov (Anthropic), moderated by Michael Sulmeyer.
• “Bye Bye AI: How We Hacked the AI Shopping Assistant of a Top 3 US Retailer” by Netanel Rubin and Dan Avraham, Rein Security.
• “A Billion-User Blast Radius: Owning ChatGPT’s Secure Sandbox” by Simcha Kosman, Palo Alto Networks.
• OpenAI’s debrief on the Hugging Face incident by Eric Wallace and Michael Dalton, OpenAI. The first detailed public account of it, and the recording is up.
• “From Patch Cycles to Exploit Windows: What Security Leaders Must Do Now”, the Databricks-hosted CISO roundtable where the SIEM slide came from.

I sat through more Briefings that did not make the post, among them “The Harness Wars: How AI Harnesses Will Decide the Future of Offensive Cyber” (Alissa Knight, Assail) and “Beam Me Up, Luke: A Review of Teleport Attack Scenarios”. The rest of what is above came from the conversations around the Briefings.