On the eve of its final day, BSides Las Vegas 2026 had already spent two and a half days making the case that AI coding tools are the next major attack surface — that the same design property that makes Claude Code and VS Code useful makes them exploitable as persistence vectors for autonomous malware. Microsoft confirmed it on August 4.

The ChainDrop campaign, disclosed by Microsoft Threat Intelligence on August 4, 2026 — the evening before BSidesLV’s closing day — compromised more than 400 npm packages with a self-propagating worm that specifically injects malicious code into .claude/settings.json and .vscode/tasks.json configuration files. Those two files govern how AI coding agents load instructions, which tools they trust, and which actions they are permitted to take. A developer who installs any of the 400-plus compromised packages triggers a chain: the worm collects credentials, propagates through stolen npm publishing tokens, and then uses stolen GitHub credentials to ensure that the next time Claude Code or VS Code starts on that machine, it begins executing attacker-controlled configuration. The developer does not need to run any additional code. The agent does it.

That is the precise scenario Noelle Murata described in the Siena room at the Tuscany Suites on Monday, August 3. Her talk, “Prompt Injection Is an Auth Bug: The Case Against Bearer Tokens in an Agentic World,” argued that the security industry’s classification of prompt injection — OWASP’s top-ranked LLM vulnerability — as a content filtering problem is architecturally wrong. The correct framing, Murata argued, is authentication: an AI agent that processes instructions and data as identical token streams has no structural way to verify which principal issued an instruction, so injected malicious instructions are indistinguishable from legitimate ones. Filtering for bad content after the fact is like trying to prevent SQL injection by scanning query strings for the word “DROP.” Murata’s talk is listed here.

ChainDrop does not inject malicious text into a conversation. It rewrites the configuration files that tell the agent what to do before any conversation begins. That is not a content problem. It is a trust and authentication problem — which is exactly what Murata said.

BSides Las Vegas 2026 ran August 3–5 at the Tuscany Suites and Casino in Las Vegas, Nevada. As Hacker Summer Camp’s practitioner-driven opener — flanked by Black Hat USA at Mandalay Bay and DEF CON 34, which is scheduled to open Thursday at the Las Vegas Convention Center — BSidesLV operates on a different premise than both of its neighbors. Attendance is capacity-limited and community-priced at $110, with no walk-in registration and no expo floor. Talks are peer-reviewed. The organization is a federally recognized nonprofit. What the conference has, that its larger neighbors do not, is a format that selects for practitioners who want to talk about what they are actually building, breaking, and defending.

In 2026, that meant a week-long argument — made from multiple rooms, across three days — that the question of whether agentic AI introduces new attack surfaces has already been answered.

Prompt Injection Is an Auth Bug: What BSidesLV’s New AI Track Said

The debut of the [un]prompted track at BSidesLV 2026 represented one of the most significant programming additions in the conference’s history. The track — curated by the organizers behind the standalone [un]prompted AI Security Practitioner Conference, co-founded by Gadi Evron (CEO, Knostic) and co-chaired with Jeff Moss (founder of DEF CON) — occupied the Siena room on Monday with a full-day program that treated agentic AI not as a threat to be anticipated but as a production reality to be dissected. Details are on the [un]prompted CFP page.

“Let’s take AI back from the marketers,” is the stated philosophy of the standalone [un]prompted conference. The BSidesLV edition ran without modification of that premise.

The first session, Alissa Knight’s “Autonomous Adversaries on Wheels: Building Self-Directed AI Systems for Connected Vehicle Exploitation,” opened by demonstrating that agentic AI architectures can be built for autonomous attack against connected vehicle systems — not in a lab but against production systems. The afternoon escalated steadily. Mackenzie Jackson and Rein Daelman presented “Turning GitHub Issues Into RCE: Exploiting AI Agents in CI/CD Pipelines,” demonstrating a live exploitation chain in which malicious content in a GitHub issue — submittable by anyone with a GitHub account — hijacks an AI coding agent operating inside a CI/CD pipeline and escalates to remote code execution. Sessions are on the schedule.

Yotam Perkal identified a structural vulnerability in the way model serialization formats grant code execution at load time — meaning that importing a machine-learning model from a shared repository is now a code-execution risk surface, not a data import. His follow-on talk, “Deception Is Back: Catching AI Attackers With AI-Built Bait,” described an AI-powered deception infrastructure designed specifically to detect and characterize AI-driven attacks — a sign that the defensive tooling is already specializing for an all-AI threat model. Both talks are on the schedule.

Kane Narraway addressed the organizational damage: “Paved Roads, AI Potholes: Security Platform Engineering in 2026” examined how AI integrations are disrupting security platform architectures that engineers spent years stabilizing, creating new classes of undocumented risk in systems that were previously well-understood.

Murata’s authentication argument sat at the center of the day. Prompt injection is OWASP’s top-ranked LLM vulnerability, named analogously to SQL injection. But the analogy breaks down at the solution layer: SQL injection can be eliminated by parameterized queries that structurally separate data from control. Large language models have no equivalent architecture because they process instructions and data as the same stream of tokens. Defenders cannot patch this at the application layer any more than they could patch TCP/IP from within an application. The correct response — which Murata argued, and ChainDrop’s design inadvertently confirms — is to treat agent instruction sources as principals that require cryptographic authentication, not as content channels that require filtering.

89 Seconds: What the Supply Chain Sessions Told Practitioners

On the other end of the Tuscany, the Breaking Ground and Common Ground rooms ran parallel tracks that gave the [un]prompted arguments their empirical grounding.

The most operationally consequential session of BSidesLV 2026 may have been the one that ran in the Proving Ground mentorship track — the conference’s first-time speaker program — on Wednesday morning. Mohit Bansal’s “89 Seconds to Compromise: Inside npm Supply Chain Attacks and How to Fight Back” drew its title from IR data collected during two massive real-world supply chain breaches: the Nx/s1ngularity compromise in August 2025 and the Axios attack in March 2026. The talk is listed here.

The Axios attack has since been independently confirmed and extensively documented. Google Threat Intelligence Group formally attributed it to UNC1069, a North Korean state-sponsored threat actor active since at least 2018 and historically focused on cryptocurrency theft. Google published full attribution analysis. The attackers compromised the npm account of the package maintainer through a sophisticated social engineering campaign — the maintainer later confirmed that UNC1069 had cloned the founder’s identity and created a convincing fake Slack workspace to gain his trust. The Hacker News covered this account. They then published two malicious versions of Axios — a package with more than 100 million weekly downloads — containing the WAVESHAPER.V2 backdoor. Tenable’s FAQ covers the incident. The malicious versions stayed live for approximately three hours before removal.

The 89-second figure refers to the interval between malicious package publication and confirmed downstream impact Bansal documented from incident response. That interval is shorter than most organizations’ security alert triage cycles, let alone their patching windows.

Bansal’s talk delivered what Bansal described as a concrete IR playbook: detection queries, proactive controls for shrinking blast radius, and an honest account of what attackers do once they have a foothold on a developer machine. The session also described the Nx/s1ngularity compromise from August 2025 — the first documented supply chain attack to specifically search for installed large language model tools on developer machines in order to extract additional secrets. Orca Security documented the s1ngularity attack.

The night before Bansal gave that talk, Microsoft Threat Intelligence published the ChainDrop worm analysis. ChainDrop extends the s1ngularity pattern: it does not merely search for LLM tools. It injects into their configuration files and creates a secondary infection route so that future Claude Code or VS Code activity restarts the payload, even after the original npm installation has been remediated. Bansal did not know about ChainDrop when he wrote his talk. The convergence is not a coincidence — it reflects the direction that sophisticated attackers have been moving since s1ngularity, and that the practitioner community tracking these campaigns had already identified.

In Common Ground on Tuesday, Adrian Sanabria presented “Destroyed by Breach: Corporate Casualties of Cybersecurity Failures” — a systematic catalog of companies that failed after security incidents, built to challenge the narrative that breaches are survivable with good public relations management and credit monitoring. The implication for the npm supply chain context: organizations that treat supply chain compromise as a recoverable incident without auditing developer tooling, rotating all credentials, and rebuilding from known-good sources are underestimating what a ChainDrop-style worm actually installs.

What Practitioners Can Do With This Now

The [un]prompted track and the supply chain sessions together delivered a concrete set of practitioner actions. The architectural argument is not purely academic.

If your organization deploys AI coding agents — Claude Code, GitHub Copilot, Cursor, or any agent with access to CI/CD pipelines or production secrets — the minimum viable security posture that the BSidesLV sessions collectively outlined is:

Treat the MCP server and plugin ecosystem with the same skepticism you apply to npm dependencies. Rajaram Srinivasan’s Common Ground session on Wednesday morning — “What Bounds Your Coding Agent? A Field Guide to Access, Inputs, Supply Chain, and Hooks” — documented that the skills, MCP servers, and plugins AI coding agents load come from a supply chain that most organizations did not build and have not audited. Session is on Day 3 schedule. ChainDrop’s ability to inject into .claude/settings.json is only effective if Claude Code trusts the configuration it finds there.

Audit .claude, .vscode, and CI/CD workflow configurations for unauthorized modifications after any npm package installation. The ChainDrop mitigation guidance specifically identifies Math_Symbol.js, Math_init.js, and similar patterns as indicators of post-compromise persistence.

Review OIDC-based npm publishing permissions. ChainDrop specifically exploits GitHub Actions workflows configured as npm trusted publishers, because packages published through this route carry valid provenance from legitimate workflow identities.

Do not treat prompt injection as a content problem. If an AI agent processes external data — from GitHub issues, from retrieved documents, from user inputs routed through a pipeline — the agent should not be granted trust equivalent to the operator’s system prompt simply because the data arrived through the same channel. This is the authentication architecture problem Murata identified, and ChainDrop’s .claude/settings.json injection path is a concrete example of why it matters: it does not inject bad content into a conversation. It rewrites the trust model before the conversation begins.

CVE, Critical Infrastructure, and the Conference’s Other Arguments

The [un]prompted track and the supply chain sessions were not the only work happening at the Tuscany. They were the most immediately urgent, but BSidesLV has always carried more ground than any single theme.

The “I Am CVE, AMA!” panel in Common Ground on Wednesday brought together CVE program leadership — Tod Beardsley, Lindsey Cerkovnik, Madison Ficorilli, and Katie Noble — to address the state of the Common Vulnerabilities and Exposures system directly. Panel is on Day 3 schedule. Noble, a CVE board member who told an RSAC 2026 panel that funding remains a critical issue and that the program is struggling to keep pace, participated in an unscripted community Q&A that covered the 2025 funding crisis, the governance reform questions it surfaced, and the implications of the EU and an independent international coalition having launched alternative CVE number allocation systems in 2026. Cybersecurity Dive covered Noble’s RSAC remarks. The long-term fragmentation risk for vulnerability management infrastructure is real and remains unsolved.

In the Copa Lounge, Joshua Corman closed the I Am The Cavalry track with “The Next 12 Months” — his annual assessment of the 12-month threat horizon for life-safety systems. Corman’s track has documented for more than a decade that hospitals, water utilities, and power infrastructure are chronically under-defended; in 2026, the track’s sessions on water utility security (“The Water Must Flow,” presented by Dean Ford, Virginia Wright, and Cole Dutton), hospital continuity of care under crisis (Christian Dameff and Jeff Tully), and Taiwan cross-strait conflict critical infrastructure scenarios (Mark Montgomery) reflected a threat environment where those vulnerabilities are no longer theoretical. Cavalry track sessions are listed here.

Monday’s Breaking Ground keynote came from Leonard Bailey of the US Department of Justice: “Patching the Law: How Hackers Helped DOJ Protect Security Researchers.” Bailey’s talk examined how decades of security community advocacy — including specific researcher engagement with DOJ guidance on the Computer Fraud and Abuse Act — has reshaped prosecutorial discretion in ways that now make legitimate security research substantially safer than it was 15 years ago. Bailey’s keynote is here.

Cindy Cohn, Executive Director of the Electronic Frontier Foundation, delivered a 60-minute keynote in Common Ground on Monday: “Privacy’s Defenders: How Hackers Helped and Can Do So Again.” An “Ask EFF” panel on Tuesday afternoon — featuring Cohn, Rory Mir, Haley Pedersen, Kenyatta Thomas, and Alexis Hancock — took practitioner questions on surveillance law, researcher legal risk, and digital rights. Cohn’s keynote appears on the schedule.

HD Moore, creator of the Metasploit Framework, presented Tuesday’s most technically adventurous Breaking Ground session: “Mind the Gap: Bridges, Backplanes, and BloodHound.” Moore extended BloodHound-style graph analysis — the attack-path mapping technique originally designed for Active Directory — to industrial backplanes and network bridges, identifying lateral movement paths that defenders building their detection around AD-centric frameworks have been consistently missing. Moore’s session is here.

The Hire Ground track ran a revamped format built around facilitated discussions rather than standard presentations. Multiple sessions addressed the same underlying reality: the cybersecurity job market has become significantly more competitive as AI tooling reduces the need for some categories of security work while simultaneously creating demand for others. Georgia Weidman’s Tuesday session delivered one of the conference’s more memorable titles: “If an Autistic Girl From Rural Mississippi Can Make It in Infosec, So Can You: Building a Cybersecurity Career on Your Own Terms.” The Hire Ground schedule is here.

What the Conference Is, and What It Does for the Week

BSides Las Vegas is worth understanding as a structural phenomenon, not only as a content source. It exists because the first BSides in 2009 began with rejected Black Hat submissions — practitioners who had done real research that did not fit the commercial conference format. The organization has been a federally recognized 501(c)(3) since 2012. It does not have an expo floor. Its Middle Ground room at the Tuscany is a networking space, not a vendor showcase.

The [un]prompted track’s debut at BSidesLV in 2026 is a specific example of how the community uses the conference structure: Gadi Evron and the [un]prompted team brought a practitioner-first AI security agenda to Hacker Summer Camp precisely because the track format allows subject-matter experts to run a curated program without a vendor sales cycle. CybrSecMedia covered the track’s debut. The 49 slide decks from the standalone [un]prompted conference held in San Francisco in March 2026 — covering AI agents, offensive AI, LLM security, governance, and the agentic future — were produced in a room that overflowed its original venue and had to be moved; the practitioner demand for non-marketing AI security content is evidently larger than the market had assumed. Slide decks are archived on GitHub.

As of Wednesday afternoon, the conference’s closing locknote — a session featuring Mixæl Laufer, Zac Ilex, String Fellow, Mike Kiss, and Hugo Bosler, titled “The End of the Beginning” — is scheduled for 1:00 p.m. PT at Florentine A. BSidesLV social media described Laufer’s appearance. Laufer, who holds a doctorate in mathematics and physics from the CUNY Graduate Center and is known as the de facto leader of the Four Thieves Vinegar Collective, was described on BSidesLV’s social media as the story of how a music school dropout ended up at Google — a characteristically BSides framing for a talk that will almost certainly cover more than the career path. Laufer’s background is on Wikipedia.

DEF CON 34 opens Thursday at the Las Vegas Convention Center. The community’s week in the desert is not over.

Frequently Asked QuestionsWhat is BSides Las Vegas, and how is it different from Black Hat and DEF CON?

BSides Las Vegas is a nonprofit 501(c)(3) security conference held annually the same week as Black Hat USA and DEF CON, which together form what the security community calls Hacker Summer Camp. Unlike Black Hat, which charges several thousand dollars for access to its briefings and hosts a large commercial expo floor, BSidesLV is community-priced (registration was $110 in 2026), has no vendor exhibition space, and selects talks through peer review rather than sponsorship. It attracts roughly 3,000 practitioners and is capacity-limited — no walk-in registration was available for 2026. DEF CON is the largest and oldest of the three and runs on a different cultural model still. BSidesLV’s specific contribution to the week is programming that tends toward practitioner-to-practitioner knowledge transfer rather than product demonstrations or government keynotes.

What is prompt injection, and why does BSidesLV’s argument that it is an “authentication bug” matter?

Prompt injection is the top-ranked vulnerability in the OWASP Top 10 for large language model applications. It works because large language models cannot structurally distinguish between instructions from the system that deployed them and instructions embedded in the data they process — both arrive as the same kind of text. The conventional response has been to treat this as a content filtering problem: scan incoming data for malicious patterns. Noelle Murata’s argument at BSidesLV’s [un]prompted track is that this framing is wrong. The correct analogy is authentication: the agent needs to know which principal issued an instruction and whether that principal has permission to issue it, before processing it — not after. ChainDrop’s .claude/settings.json injection mechanism illustrates why this matters: it does not inject bad text into a conversation. It rewrites the configuration that defines which instructions the agent trusts before any conversation begins. A content filter cannot catch that.

How does the ChainDrop npm worm actually work, and what should developers check?

Microsoft Threat Intelligence’s August 4, 2026 analysis describes ChainDrop as a self-propagating worm that embeds itself in npm packages via a preinstall lifecycle hook, which npm runs before package installation completes. When a developer or CI/CD pipeline installs a compromised package, the hook executes, collects credentials from the local system and environment variables, and uses stolen npm publishing tokens to inject itself into additional packages. It then uses stolen GitHub credentials to inject malicious files into Claude Code and Visual Studio Code configuration paths — specifically .claude/settings.json, .claude/setup.mjs, .vscode/tasks.json, and .vscode/setup.mjs — creating a secondary infection route that persists after the original package is removed. Developers should check for unexpected files matching Math_Symbol.js, Math_init.js, or math_.js patterns in Node.js directories, audit .claude and .vscode config files for unauthorized changes, rotate all credentials from a known-clean environment, and rebuild any CI/CD artifacts produced by affected build systems.

What is the MCP server supply chain risk that BSidesLV practitioners flagged?

MCP — the Model Context Protocol — is the emerging standard that allows AI coding agents to connect to external tools, services, and data sources. The protocol is what lets Claude Code invoke a file search tool, query a database, or trigger a CI/CD action. The security problem Rajaram Srinivasan described at BSidesLV is structural: the MCP server and plugin ecosystem has grown rapidly without establishing the security vetting processes that developers apply to software dependencies. Developers install MCP servers from third-party sources, grant them significant permissions, and trust them to behave. That is the same pattern that enabled the Axios and ChainDrop attacks in the npm ecosystem — and the MCP ecosystem does not yet have the equivalent of npm’s automated malware scanning, rate-limiting, or tamper-evident provenance controls that are being incrementally deployed. ChainDrop’s .claude/settings.json injection path is one way to poison that trust relationship without ever touching the MCP protocol directly.