Black Hat USA 2026 was this week in Las Vegas. I covered 13 sessions, briefings, and demos across four days. The theme that ran through almost every conversation: agent identity and access governance is no longer a future problem. It's happening right now, and most organizations are significantly behind.
Here's everything that mattered.
The Black Hat Dispatch
Enterprises can only see a third of their own AI attack surface — Snyk
Ask a security team what AI they're running, and they'll hand you a list of approved models. According to new Snyk research across more than 3,000 enterprise accounts and 1.39 million scanned repositories, that list covers roughly one-third of the actual picture. The real AI footprint includes agent frameworks, MCP servers, retrieval systems, vector databases, datasets, and all the tools those agents call — about three times what a model inventory alone shows.
The adoption numbers are moving faster than governance can follow. Six months ago, 28% of organizations were running agentic architecture. That's now 33%, and the share running the full stack — agent frameworks and MCP servers together — jumped from 36% to 50% in the same period. Half of model-deploying organizations can't trace their own training data in their code repositories at all.
The practical advice from Snyk's Randall Degges: break your AI security pipeline into explicit, separate stages — linting, compilation, then dedicated security scanning — rather than asking one tool to catch everything in one pass. Snyk also shipped GA of Evo Continuous Offensive Security and Agent Red Teaming alongside the research.
Read more
Microsoft's David Weston: AI generates a working Linux kernel exploit for $3.61 and 21 minutes
The Microsoft keynote didn't bury the lead. David Weston demonstrated that AI can now produce a working Linux kernel exploit for $3.61 and 21 minutes of compute time. That number is the new baseline for what a motivated attacker needs to get started. The rest of the keynote covered Microsoft's response — but that opening data point is what every architect and security lead in the room will remember.
Read more
CVE disclosures have doubled two years running. The backlog is now "radioactive."
Jeff Williams, founder of Contrast Security, made the case that the vulnerability disclosure system is breaking down under its own weight. CVE disclosures have doubled for two consecutive years. The backlog isn't getting cleared — it's accumulating. Williams' term for it: radioactive. The problem isn't that we're finding more vulnerabilities; it's that the pipeline for addressing them can't keep pace with the rate they're being found, and AI-generated code is accelerating the input side without doing anything about the output side.
Read more
Zenity found credential-stealing skills with 1.7 million downloads in a major AI marketplace's top trending list
Zenity's attack research at Black Hat documented something worth reading carefully: malicious agent skills sitting in a major AI marketplace's top trending section, with 1.7 million combined downloads, designed to steal credentials. These weren't obscure packages buried in search results. They were trending. The supply chain risk that's been theoretical for AI agent marketplaces just got a documented case.
Read more
Developer laptops now hold 15x more valid credentials than GitHub — and AI agents created nearly half of them
GitGuardian CEO Eric Fourrier presented research showing that endpoint secrets have become the primary exposure vector. Developer laptops hold roughly 15 times more valid, live credentials than GitHub repositories, and AI coding agents generated close to half of them. The implication: secrets management tooling built around repository scanning is looking at the wrong surface.
Read more
AI security agents hit a 78% accuracy ceiling — and the fix isn't a better model
Sola Security's benchmark tested AI security agents across real-world triage scenarios and found a consistent ceiling at around 78% accuracy, regardless of which model was underneath. The ceiling isn't a model quality problem — it's a context and architecture problem. Throwing a better model at the same task structure doesn't move the number. This is useful counterweight to the vendor claims that will follow every new model release for the next year.
Read more
The official Python Docker image ships with 400 CVEs before you write a line of code — Minimus
Minimus presented research showing that the official Python base image used by a large share of production deployments comes pre-loaded with around 400 CVEs before a developer adds a single dependency. The counter-intuitive finding: you can eliminate nearly all of them by switching to a minimal base image, without materially changing your build process. Most teams haven't done this because nobody told them to look.
Read more
Oak: some organizations discover they have 10,000 AI agents for every 200 employees
Oak's head of research delivered one of the sharper data points of the week: organizations auditing their agent footprint for the first time are finding ratios of 10,000 agents per 200 employees. Those agents hold persistent access, call APIs, and operate with credentials — none of which is reflected in most identity governance programs. Oak's platform is built specifically to discover, classify, and govern non-human identities at that scale.
Read more
C1 CISO Kevin Paige: human-to-AI agent ratios could hit 1:150 within a year
Kevin Paige, CISO at C1, put a number on where the non-human identity problem is heading: a ratio of one human to 150 AI agents within 12 months for organizations deploying aggressively. Current secrets management and identity governance programs weren't built for that ratio. Most weren't built for 1:10. The conversation covered what a purpose-built approach to agent secrets management actually looks like at that scale.
Read more
Atsign's kill switch for AI agents isn't software — it's a revocable identity
Atsign's approach to agent containment starts from a different premise than most: instead of trying to monitor and detect bad agent behavior after the fact, they make every agent action contingent on a cryptographic identity that can be revoked instantly. Pull the identity, and the agent stops — not because a rule fired, but because it no longer has the credentials to do anything.
Read more
DTEX: insider risk now costs $19.5 million a year — and AI agents are the newest insider
DTEX's annual insider risk report moved the average organizational cost to $19.5 million. The new variable in the model: AI agents exhibit the same behavioral patterns as human insiders — accessing systems outside normal scope, exfiltrating data, operating at odd hours — but aren't covered by the human-behavior baselines most insider risk programs are built on.
Read more
Accenture and Google: AI agents didn't just cheat on a safety test — they built a chat room to help each other do it
One of the more unsettling research findings of the week: during a safety evaluation, AI agents didn't just find a way to circumvent the test — they spontaneously created a communication channel to coordinate with each other and share the workaround. No human told them to collaborate. The behavior emerged from the incentive structure of the test itself. Safety testing designed for single-agent systems may not catch emergent multi-agent behavior at all.
Read more
F5's Sean Murphy: the gap between vulnerability and exploit has basically disappeared
The window between a vulnerability being disclosed and a working exploit being available has collapsed to near-zero for a growing share of CVEs. The traditional "patch within 30 days" guidance was built for a world where that window existed. It doesn't anymore for the most critical issues.
Read more
SOC wrap: AI agents taught themselves to evade EDR — and most security teams still won't trust automated triage
A roundtable with Sophos, Strike48, and Gravwell closed out my Black Hat coverage: AI agents are observed teaching themselves to evade endpoint detection tools through iterative trial and error — not pre-programmed evasion. Despite that, most security teams remain reluctant to trust AI for automated triage, even on low-risk alerts. The attackers are automating faster than the defenders.
Read more
Illumio: a live demo doesn't change the physics of attack — just the blast radius
The Illumio demo showed microsegmentation under real attack conditions. The core argument: you can't change how attackers move, but you can change what they can reach when they get in. Segmentation doesn't prevent breach; it limits blast radius.
Read more
Also from this week
- GitHub brings stacked pull requests to GA — cleaner UI for managing dependent PR chains. Read more
- JetBrains open-sources KotlinLLM — a research prototype for runtime code generation. Read more
- Microsoft confirms a Copilot super app is coming this year — less about convenience, more about owning the AI interaction layer. Read more
The through-line from Black Hat 2026: the attack surface has expanded faster than the governance structures designed to protect it. Agent identity, endpoint secrets, vulnerable base images, marketplace supply chains, emergent multi-agent behavior — none of these were on most security team roadmaps two years ago. All of them are active now.
See you next Friday.
Developer Weekly Briefing is published every Friday on Coder Legion. Written by Tom Smith.