News

Black Hat USA 2026 Research Roundup: AI Speeds Up the Old Attacks

• By David Ramel
• 08/05/2026

Black Hat 2026 is underway and interesting security-related research is pouring in. An autonomous vulnerability-research system analyzed 3,915 open source projects in two months and confirmed 14,090 flaws, 99.4% of them previously unreported. Other research released around the high-profile security event found identity or privilege involved in 75% of completed investigations, attacker breakout time dropping below 30 minutes and malware frequently bypassing DNS monitoring by connecting directly to IP addresses.

Taken together, the findings show AI accelerating security work on both sides without replacing the attack paths defenders already know. Attackers are using AI for software development, reconnaissance, payload generation and operational scaling, while continuing to rely on phishing, stolen credentials, exposed services, misconfigurations and trusted software dependencies. Defenders, meanwhile, are applying autonomous systems to vulnerability discovery, investigation and malware analysis.

The reports also point to a shrinking response window for cloud and infrastructure teams. Researchers documented faster exploitation, increased cloud-aware criminal activity, abuse of enterprise AI infrastructure, poisoned software dependencies and identity attacks that can turn legitimate authentication mechanisms into paths for unauthorized access.

Those findings set the tone for Black Hat USA 2026, which runs Aug. 1-6 at Mandalay Bay in Las Vegas. The six-day event opened with four days of technical training, followed by Summit Day on Aug. 4 and the main conference, Briefings, Arsenal demonstrations and Business Hall activities on Aug. 5-6.

The following roundup summarizes the principal findings from official studies, reports and technical analyses released around the event.

AI Systems Find Vulnerabilities at Software Scale
Palo Alto Networks Unit 42 published results from NOVA, an autonomous vulnerability research system, in its frontier AI vulnerability study. Unit 42 said NOVA analyzed 3,915 open source projects over two months and confirmed 14,090 vulnerabilities. According to the researchers, 99.4% had not previously been reported, and 39.7% were rated High or Critical under CVSS 4.0.

Unit 42 also reported that vulnerability patterns varied by programming-language ecosystem, including differences in access-control flaws, path traversal, code injection, prototype pollution and server-side request forgery.

• Semantic flaws: Unit 42 said 92% involved semantic or logic problems that are difficult to identify through conventional fuzzing.
• Workflow: NOVA reviews project history and code, identifies candidates, builds proofs of concept, validates them in clean environments and prepares patch candidates and disclosure reports.
• Disclosure: Unit 42 said it worked with maintainers and vulnerability-clearing organizations on responsible disclosure.

Another Unit 42 study analyzed malware that bypasses domain-name monitoring by connecting directly to IP addresses. The researchers examined more than 4 million dynamic-analysis reports for the direct-to-IP malware analysis. Among samples that communicated with command-and-control infrastructure, 45.32% made at least one direct-to-IP connection. After excluding bulk scanning, the figure was 41.97%. Direct-to-IP traffic represented 23.17% of all command-and-control connection attempts in the study.

• Evasion method: Direct connections can avoid controls that rely primarily on domain names and DNS telemetry.
• Observed uses: Unit 42 associated the technique with ransomware droppers, peer-to-peer botnets and software supply-chain risks.
• Proposed control: The researchers described zero-trust IP checking that verifies whether outbound destinations were sanctioned through DNS.

Identity and Privilege Remain Central Attack Paths
BeyondTrust released its Phantom Labs Research Index, an annual analysis covering more than 400 research projects. BeyondTrust said 75% of completed investigations involved identity or privilege. The company categorized major root causes as credential or secret exposure, at 18%; identity relationship or graph exposure, 11%; excessive or standing privilege, 11%; identity misconfiguration, 10%; and lateral movement, 6%. The work also resulted in coordinated vulnerability disclosures involving technologies including OpenAI Codex and Amazon Web Services' Bedrock AgentCore.

• Cloud relevance: The findings place credentials, machine identities and privilege relationships at the center of cloud risk.
• Main operational point: Preventive controls must account for how identities connect, not only whether individual accounts are protected.
• Research scope: More than 400 projects were included in the index.

CrowdStrike's 2026 Threat Hunting Report draws on active investigations conducted from July 1, 2025, through June 30, 2026. The company reported a 2.5-fold increase in detection leads triggered by AI agents compared with human-triggered leads. CrowdStrike also documented attackers using AI to generate payloads and shell commands, exploit AI infrastructure and abuse enterprise large language models.

• Cloud activity: CrowdStrike reported a 171% increase in e-crime activity involving cloud-aware techniques.
• Identity activity: Monthly device-code phishing activity increased fifteenfold, according to the report.
• AI infrastructure abuse: One documented LLM-jacking operation generated more than 200,000 API requests in two minutes.
• Supply-chain activity: CrowdStrike said one actor compromised more than 300 dependencies in a day, while another poisoned 131 AI framework packages.
• Exploitation speed: China-linked actors were observed exploiting vulnerabilities within 24 hours of an effective proof of concept becoming available.

Attackers Compress the Time Available for Defense
Dataminr's 2026 Mid-Year Cyber Threat Landscape Report is based on monitoring that the company said covered 4,500 threat actors, 73,000 vulnerabilities and more than 2 million alerts per month. The report describes a widening speed gap between attackers and defenders. Dataminr said median patching time increased from 32 days to 43 days while attacker breakout time fell below 30 minutes.

• Vulnerability management: The reported patching delay leaves exposed systems available for longer periods.
• AI techniques: Dataminr documented hallusquatting and AI-augmented device compromise among emerging methods.
• Financial impact: Ransomware accounted for the bulk of confirmed losses examined in the report.
• Geopolitical context: The report connected cyber activity with tensions involving Iran, Israel and the United States.

Cisco Talos examined how attackers use coding assistants and other generative AI tools in its analysis, A Data-Driven Look at How Adversaries Are Weaponizing AI. Talos reviewed prompt logs and artifacts from endpoints running tools including Claude Code, Codex, Cursor and Gemini. The researchers grouped activity into malicious software engineering, the scaling of criminal operations and vulnerability or bug-bounty research.

• Guardrail bypasses: Talos found that actors sometimes evaded controls through simple role claims, labels or task decomposition.
• Skill differences: Less experienced actors produced limited but functioning malicious capabilities, while advanced actors built more sophisticated platforms and pipelines.
• Defensive implication: AI-tool monitoring must examine complete workflows, not only individual prompts.

In a separate second-quarter incident response review published immediately before conference week, Cisco Talos reported that phishing was the initial-access method in more than half of its engagements, up from approximately one-third in the previous quarter. Talos also observed increased use of legitimate remote-management software in attack chains.

• Initial access: Phishing remained more prevalent than AI-specific intrusion methods in the examined engagements.
• Tool abuse: Attackers used legitimate management applications rather than relying exclusively on custom malware.
• Cloud relevance: Remote administration and identity access can give attackers entry to distributed enterprise environments.

Attack Operations Combine Automation With Manual Control
Unit 42 also documented a campaign in which a Chinese-speaking actor used an AI-driven environment to automate reconnaissance across seven vulnerabilities while retaining manual control over exploitation. The autonomous AI campaign analysis described custom automation skills, Model Context Protocol integration, proxy-based anonymization and Telegram command-and-control components.

• Outcome: The campaign did not fully compromise its intended targets.
• Control limitations: Target-side configurations prevented exploitation in some instances.
• Platform response: Unit 42 reported that OpenAI confirmed its safeguards rejected violating requests and disabled a linked account.
• Main finding: Autonomous enumeration did not eliminate the actor's need for judgment and manual intervention.

A separate Unit 42 analysis covered XCSSET version 4.0, a macOS threat targeting software developers through Xcode projects. The researchers documented fileless persistence using the macOS defaults system, a polymorphic and memory-resident design and actions intended to interfere with software updates, cloud telemetry, XProtect and Transparency, Consent and Control settings.

• Infrastructure: Unit 42 identified approximately 40 domains registered in batches and aged before use.
• Targeting: The researchers associated the activity with developers in South Asia.
• Analysis methods: Defenders used pattern matching and large language model assistance to decode parts of the malware.
• Supply-chain significance: Compromised development projects can place downstream users and software consumers at risk.

Payment Fraud Moves Around Technical Security Controls
Trustmi reported a sharp increase in intent-driven payment fraud in its 2026 invoice fraud analysis. The company counted 597 attacks during the first half of 2026, compared with 119 during the same period in 2025. Seven of nine documented attack patterns involved a fake invoice.

• Fabricated correspondence: Trustmi identified 193 incidents combining a false email thread with a fake invoice.
• Executive impersonation: A pattern labeled Ghost Executive accounted for approximately 255 incidents, or more than four in 10.
• Deadline pressure: A Deadline Deception pattern appeared approximately 97 times during the six-month period.
• Control challenge: These attacks manipulate business payment workflows and do not necessarily require malware or a single technical compromise.

Research Themes for Cloud and Infrastructure Teams
Taken together, the releases describe a security environment in which AI increases the volume and pace of some activities but does not displace identity abuse, phishing, exposed software, remote-management tools or fraudulent business processes. The cloud-specific findings place particular weight on device-code phishing, secret exposure, privilege relationships, direct-to-IP traffic and malicious use of enterprise AI infrastructure.

The research also shows opposing uses of automation. Attackers are applying coding assistants to malware engineering, reconnaissance and workflow scaling. Defenders are using autonomous systems to identify vulnerabilities, investigate alerts and decode malware. Both sides remain dependent on configuration, access rights, validation and human decisions. For cloud operators, the practical subjects documented across the reports are inventory, identity governance, software dependency visibility, rapid patching, runtime telemetry and controls that cover both domain-based and direct-IP communications.