Zak Raxter

Almost nothing in the attacker’s toolkit is new. The vulnerability classes on display at Black Hat USA 2026 and DEF CON 34 were the same ones security teams have tracked for a decade: request smuggling, SQL injection, SSRF, broken object level authorization. What changed is the economics. Attacks that used to need a specialist and… Read More »Field Notes from Black Hat and DEF CON 2026: What Changed in the Attacker Playbook?

At Black Hat USA 2026 and DEF CON 34, one theme was ever-present in both the briefings and the hallway conversations alike: autonomous AI threat actors are actively executing multi-stage attacks. Under permissive evaluation conditions, AI agents have already demonstrated the ability to escape sandbox constraints, establish covert communication channels across third-party tools, and systemically… Read More »What Recent Autonomous Hacking Incidents Mean for Web App and API Security