Defcon.org
When the Benevolent Bureau of Birds runs the DEF CON Capture the Flag finals this weekend, they will be presiding over something that did not exist two years ago: a competitive environment where autonomous AI agents are expected, not exceptional. That competitive shift — from novelty to norm in two iterations of the world’s most prestigious hacking championship — is the defining story of DEF CON 34, which opens this afternoon at the Las Vegas Convention Center’s West Hall for a four-day run through Sunday, August 9.
The conference opens at 10:00 AM PDT (1:00 PM ET) when founder Jeff “The Dark Tangent” Moss delivers his traditional welcome address, framing this year’s event around the theme of “Agency” — self-determination in an era of algorithmic manipulation, dark patterns, and shrinking digital autonomy. “Dark patterns embedded in apps circumvent our will, hijacking our focus,” the official theme document states. “Tech giants conspire to shrink our pool of options for information and communication while their algorithms maximize rage engagement and spread deliberate disinformation and bot content.” DEF CON’s answer — in the theme’s framing and in the research being presented across its 38 villages and dozens of simultaneous competitions — is active resistance and technical reclamation.
DEF CON 34 runs simultaneously with the final day of Black Hat USA 2026 at Mandalay Bay, in the same week that saw BSidesLV warn of AI agent attack surfaces and Microsoft disclose the ChainDrop npm worm — a self-propagating npm worm that specifically targeted Claude Code and VS Code configuration files to hijack AI coding agents as persistence vectors. The research arriving at DEF CON this weekend addresses exactly the infrastructure ChainDrop weaponized. That is not a coincidence. It is the state of the field.
Tickets are $520 cash at the door. The conference runs through Sunday, August 9.
Why Autonomous Agents Are Standard Weapons Now, Not Experimental Tools
In 2025, a DEF CON CTF team called Blue Water discovered — after a judge notified them — that their autonomous hacking agent had independently solved a challenge and won without human involvement. DEF CON organizers described it as “an exciting novelty.” For DEF CON 34, that novelty is gone. The Benevolent Bureau of Birds, this year’s CTF organizers, have designed challenges specifically around a hybrid human-and-agent competitive environment. Their explicit framing, published on the official CTF archive: “This year, we expect that novelty to be the norm.”
The speed of that shift has empirical grounding. At the DEF CON CTF qualifier this year, researchers from UC Santa Barbara and UC Berkeley deployed an autonomous system called SageCTF against the 48-hour online qualifier — a 686-team Jeopardy-style competition covering web, cryptography, binary exploitation, reverse engineering, and more. SageCTF recovered 8 flags and finished in the top 5 percent of all scored teams, outperforming every team that self-reported using no AI assistance or low AI assistance. The median solve required five hours of sustained autonomous exploration. The best human teams remain stronger — but the gap is measurable and narrowing.
What makes this significant for practitioners outside the CTF world is the model constraint under which SageCTF operated: it ran on models available to anyone, not on specialized or frontier infrastructure. The same dynamic governs HALctf, the AI Village’s own autonomous competition launching Friday: all model inference runs through a centralized Model Service that removes any GPU budget advantage, and the challenge is specifically framed around open-source models. The official HALctf contest description puts it directly: “HalCTF breaks that cycle by asking a critical question: What can be achieved with pure, open-source models?”
The answer implicit in the question is the one that should inform every security team’s threat model: quite a lot.
What HALctf Is and How It Works
HALctf (Hostile Autonomous Layer CTF), organized by the AI Village, is the formal debut of fully autonomous-only competitive security at DEF CON. Participants do not interact with challenge targets directly. Instead, they design and deploy autonomous AI agents — packaged as OCI Docker containers of up to 2.5 gigabytes (GB) — that navigate sandboxed environments, exploit challenge targets, and capture flags entirely without human guidance per challenge. The full technical specification is on aivillage.org.
To level the competition, all model inference runs through a shared Model Service: participants’ containers call an OpenAI-compatible API endpoint, and the service handles compute. No team wins on the strength of its GPU budget. What differentiates teams is agent architecture — the harness, the tooling, the memory management, the cross-agent communication topology. The first-place prize is a DGX Spark, a personal AI supercomputer, so that the winner can continue autonomous hacking research on local infrastructure after the conference.
The technical lessons from HALctf will land in offensive security tooling within months. That is how DEF CON research has always worked: what wins a CTF becomes what attackers use, and then what defenders must understand.
The CTF World Championship: 673 Teams, Four Days, One Black Badge
Beyond HALctf, the flagship DEF CON CTF — the Jeopardy-style competition widely considered the Olympics of hacking — runs across all four days of the conference, with qualifying teams selected from 673 that competed in the Benevolent Bureau of Birds’ online qualifier held May 22–24. The BBB, assembled from previous CTF champions spanning a lineage that includes the Nautilus Institute, Order of the Overflow, and a roster of organizers back to the Ghetto Hackers in 2002, runs the contest through Sunday’s closing ceremony.
The CTF floor simultaneously runs more than 40 separate competitions. Beyond HALctf, these include Capture The Packet (the Packet Hacking Village’s Black Badge–eligible network forensics contest), the Car Hacking Village CTF on live vehicle architectures, STARPWN from the Aerospace Village, Code Cadaver from the Biohacking Village (medical device exploitation), and Crack Me If You Can 2026, the annual password-cracking marathon. The DEF CON contests page has listings. The Call Center Village’s Escalation Desk CTF is worth noting specifically: competitors face social engineering and voice AI challenges, an acknowledgment that the human attack surface has not been automated away — only augmented.
Friday’s Main Stage: EV Exploitation, WhatsApp at Scale, and Schneier on AI
Main stage talks begin Friday morning (10:00 AM PDT, 1:00 PM ET) across five simultaneous tracks. The complete DEF CON speakers schedule is posted online.
At 10:00 AM PDT, five sessions open simultaneously. Carlo Meijer and Wouter Bokslag will deliver “Texas Incidents: How We Broke the OMAP-L138 Trusted Execution Environment,” exposing a compromise of the widely-deployed OMAP processor’s TEE. Track 4 has Christopher “xoreaxeaxeax” Domas with “Weaponizing Uselessness: Breaking SMM with the Slowest Instruction Ever Written,” and Track 5 has Ron Ben Yizhak on escaping Azure containers via a Python-in-Excel exploitation chain. At 10:30 AM PDT, bunnie Huang will present on the Baochip-1x badge chip in Main Track 1 — the hardware at the center of DEF CON 34’s supply-chain transparency story, already extensively covered in this outlet.
The 11:00 AM PDT session brings the 2026 Pwnie Awards — the community’s annual ceremony for the year’s most significant and most embarrassing security failures. Running concurrently in Track 3: Jaron Bradley and Alex Radocea will present “Keychained Melody: Grabbing the Keys to the iCloud Kingdom,” and in Track 5, Mehdi Ziazi and Martin “MasorX” Strohmeier will demonstrate live attacks against CPDLC — the Controller-Pilot Data Link Communications protocol used in commercial aviation.
At 12:30 PM PDT, a fireside chat between Jeff Moss and General Paul Nakasone, the retired NSA Director and US Cyber Command commander, opens in Main Track 1. Nakasone has previously spoken at DEF CON on national security cyber operations; his return for DEF CON 34 arrives at a moment when the policy and technical communities are both grappling with autonomous AI capabilities across offense and defense.
Friday’s 5:00 PM PDT close is anchored by two high-profile sessions. Bruce Schneier will deliver “Hacking AI” in Track 1 — a keynote-caliber talk from one of the security field’s most recognized public intellectuals on adversarial manipulation of AI systems. And Maximilian Guenther and Gabriel Gegenhuber will present “Gotta Catch ‘Em All: How to Capture 3.5 Billion WhatsApp Accounts” in Track 3 — a mass-scale account takeover research disclosure.
Saturday and Sunday: Cliff Stoll, EV Battery Theft, and a Claude Zero-Day
Saturday opens at 10:00 AM PDT with Zhenghan Wang and Yang Liu presenting on mass exploitation of TTLock smart locks, and Federico Kirschbaum and Gaston Aznarez demonstrating root-level remote code execution against Ubiquiti AirMax infrastructure. At 11:00 AM PDT, Felipe Solferini and Vangelis Stykas will present “Tracking the Trackers: How We Took Over 36 Million GPS Devices Protecting Children and Vehicles” — a mass-scale takeover of consumer GPS tracker infrastructure. All Saturday sessions are listed on the DEF CON speakers page.
At 1:00 PM PDT Saturday, Cliff Stoll — the author of The Cuckoo’s Egg and the figure who documented the first international computer intrusion investigation — will take the stage with “Stalking the Wily Hacker…40 Years Later.” Stoll caught a KGB-linked hacker in 1986 by tracking an accounting discrepancy of 75 cents. His retrospective frames four decades of how the community’s threat model has evolved from a single curious intrusion to the nation-state and AI-driven campaigns filling this weekend’s program.
At 2:00 PM PDT Saturday, H.D. Moore — creator of Metasploit — will present on exploitation of baseboard management controllers and out-of-band server management interfaces, the hardware layer that remains accessible even when an OS is powered off or fully compromised.
Saturday’s 5:00 PM PDT close features Fabien Guillebot and Stepan Konicek on “High Voltage Heist: Turning Your EV into My Power Bank” — exploiting EV charging protocols to extract energy from a vehicle — and Robert Herrera and Alex Plaskett on USB video exploitation.
Sunday closes the conference with, among other sessions, a multi-vendor exploitation chain disclosure: Barak Sternberg, Nevo Poran, and Ron Bobrov will present “Your WAF Blocked Us, That Was The Exploit — Remote Agent Takeover via Cloudflare, Sentry and Claude Zero-Day for Data Exfil.” The talk, listed on the speakers schedule, discloses a zero-day in a major AI model as part of a multi-vendor attack chain, arriving at a conference whose entire program has spent three days interrogating how AI systems can be subverted, not just used. The closing ceremony, final CTF results, and Pwnie Award winners will follow Sunday afternoon.
How AI Came to Dominate Both Offense and Defense at Once
The AI theme at DEF CON 34 is not a keynote buzzword or a marketing layer. It is the organizing principle of the technical program.
Across nearly every time slot and multiple villages simultaneously, researchers are presenting work that treats AI systems as both the primary attack surface and the primary offensive weapon. The AI Village’s HALctf makes autonomous pentesting agents a competition category — while talks on AI sandbox escapes (“The Sandbox is a Suggestion: Deconstructing AI Agent Sandboxes,” Friday Track 1, Elad Meged), LLM build gate bypasses (“LGTM: Bypassing an LLM Build Gate When Prompt Injection Fails,” Friday Track 5, Aviv Donenfeld), AI orchestration RCE (“Hacking Your Life with AI Can Get You Hacked: How AI Orchestration Platforms Ship RCE by Design,” Saturday Track 1, Peyton Kennedy), and AI-assisted influence operations (Creator Stage Saturday, Tobias Diehl) run back to back across the main stage and Creator Stage.
The Creator Stage panel featuring Bruce Schneier Saturday afternoon — “Rules for Defenders and Frontier Models for Adversaries” — asks directly whether institutional restrictions on dual-use AI models only disarm defenders, a question that the HALctf’s open-source-only model mandate has already partially answered in the competitive context.
The Voting Village, in its tenth year, and the Policy @ DEF CON track both connect the AI conversation to institutional accountability. Carole House’s Creator Stage session on liability standards, the Nakasone fireside chat, and Curt Barnard of Anthropic presenting “Minimize Harm, Maximize Defense: How Anthropic Navigates the Offense-Defense Divide” on Friday afternoon all signal that DEF CON’s decade-long drift toward policy engagement has in 2026 arrived at the specific policy question the community has spent two years building toward: who is accountable when autonomous AI systems cause harm?
Creator Stage also features Joshua Marpet presenting “AI Safety Theater: What the RAISE Act Regulates — and What It Does Not” — an analysis of federal AI regulation’s scope gaps — and Alexis Hancock and Kenyatta Thomas on “Why Mandatory Age Verification Keeps Us All Less Safe,” connecting the conference’s digital autonomy theme to surveillance-infrastructure concerns that extend well beyond any single policy debate.
38 Villages: Aerospace to Voting, Maritime to Scambaiting
DEF CON 34 hosts 38 official villages — semi-independent mini-conferences each running their own talks, workshops, and labs across the four days. The DEF CON villages page lists all 38.
The AI Village has refocused for 2026 on practical AI security: drop-in workshops on LLM internals, agent construction, and prompt injection alongside HALctf and a novice-friendly demonstration of how local models can be equipped with custom tooling. The Aerospace Village pairs aviation and space cybersecurity research with the STARPWN CTF. The Car Hacking Village runs live vehicle architectures on bench setups for hands-on ECU teardown and CAN bus interception. The ICS Village simulates realistic industrial control environments — PLCs, HMIs, RTUs, actuators — for offensive and defensive exercises. The Voting Village, now in its tenth year, provides real US voting hardware for public hacking alongside a two-day speaking track on election security. The Maritime Hacking Village features panels with retired flag officers on subsea cable vulnerability and live exploitation of AIS, NMEA 2000, and GMDSS maritime protocols.
The Social Engineering Community Village will host its Vishing Competition — competitors place real live calls from a soundproof booth — and “Battle of the Bots,” where AI agents attempt to social engineer human targets. The Call Center Village allows attendees to synthesize their own voice and wire up conversational AI agents against simulated customer service environments. And the Quantum Village, now in its fifth year, offers open access to quantum computing hardware for the hacker community — a reminder that the threat model beyond the immediate AI moment is already being built.
What to Watch This Weekend
A few through-lines worth tracking across the four days:
Hardware transparency as an existence proof — The Baochip-1x badge has already established that verifiable open-source silicon is achievable at production scale. The red-team work on that same silicon begins this weekend. Whether the community finds exploitable flaws in the AES masking implementation, the closed-source USB PHY, or the Xous boot chain will determine how far the existence proof extends.
Telecom and maritime infrastructure — North Korea’s DPRK IT worker operation (Saturday Creator Stage), maritime subsea cable vulnerability panels with RADM John Mauger USCG (ret.) and Michael Sulmeyer on Friday, satellite protocol exploitation, and public transport RFID attacks all reflect a community increasingly focused on critical infrastructure that has been under-secured and under-studied.
Policy as technical practice — The DEF CON Franklin program, which deploys security volunteers to under-resourced rural water utilities — the same category of infrastructure that has faced escalating nation-state attacks — will have a dedicated session connecting technical capacity-building to the conference’s broader “Agency” theme. Jake Braun is scheduled to present on the program’s first-year results.
Talks will be archived on the DEF CON Media Server and Infocon.org following the conference.
Frequently Asked QuestionsWhat is HALctf, and why does it matter that it requires open-source models only?
HALctf is the AI Village’s debut autonomous-only CTF competition at DEF CON 34: participants build AI agents in OCI Docker containers and deploy them against sandboxed challenge targets without any human interaction during the challenge itself. The HALctf specification is on aivillage.org. What makes the open-source-model requirement significant is that it removes the assumption that autonomous offensive capability requires access to frontier closed-source systems like GPT-4 or Claude. If effective autonomous pentesting agents can be built on models any practitioner can run locally, the threat is not limited to sophisticated actors with enterprise API budgets — it is available to a much broader range of adversaries. That is the question HALctf is designed to answer empirically, in a competitive setting, with results the community will be able to evaluate.
What is the DEF CON CTF, and who are the Benevolent Bureau of Birds?
The DEF CON Capture the Flag is widely considered the world championship of competitive hacking — a multi-day competition where teams solve complex offensive security challenges across binary exploitation, cryptography, reverse engineering, web security, and other categories. Winning teams earn black badges, DEF CON’s most elite recognition, granting lifetime free admission to the conference. The DEF CON CTF archive has history. The Benevolent Bureau of Birds are this year’s CTF organizers — a team assembled from previous CTF champions across the competition’s multi-decade lineage — taking over from the Nautilus Institute, which ran the competition from 2022 through 2025.
Can AI hacking agents actually solve the kinds of challenges in competitive security competitions?
Increasingly yes, and the evidence from 2026 is specific. At this year’s DEF CON CTF online qualifier, an autonomous system called SageCTF — built by researchers at UC Santa Barbara and UC Berkeley — recovered 8 flags, top 5 percent of all 686 scored teams, outperforming every team that self-reported using no AI or only minimal AI assistance. Each solved challenge required an average of five hours of sustained autonomous exploration. The best human teams remain stronger — CTF still rewards creativity and deep security intuition that no current agent fully replicates. But the gap between human-led AI teams and fully autonomous agents has narrowed enough that DEF CON’s organizers are now designing competition architecture around the assumption that autonomous agents will be competing.
What should security practitioners who cannot attend DEF CON 34 do to follow along?
Talks will be archived on the DEF CON Media Server (media.defcon.org) and Infocon.org following the conference. For practitioners most concerned about the AI agent threat specifically, HALctf results and the AI Village’s published research will be the highest-priority material to track — specifically whether open-source-only autonomous agents succeed in the competition, and what architectural choices made the difference. The sessions on AI sandbox escapes, AI orchestration RCE, and the Claude zero-day multi-vendor chain disclosure on Sunday will similarly have direct defender applicability. The conference’s main stage talks have historically appeared publicly within weeks of the event’s close.