![\"DEFCON](\"https:\/\/www.europesays.com\/ai\/wp-content\/uploads\/2026\/08\/defcon-34.png\")
<\/p>\n<\/p>\n
Defcon.org<\/p>\n
When the Benevolent Bureau of Birds runs the DEF CON Capture the Flag finals this weekend, they will be presiding over something that did not exist two years ago: a competitive environment where autonomous AI agents are expected, not exceptional. That competitive shift<\/a> \u2014 from novelty to norm in two iterations of the world’s most prestigious hacking championship \u2014 is the defining story of DEF CON 34, which opens this afternoon at the Las Vegas Convention Center’s West Hall for a four-day run through Sunday, August 9.<\/p>\n The conference opens at 10:00 AM PDT (1:00 PM ET) when founder Jeff “The Dark Tangent” Moss delivers his traditional welcome address, framing this year’s event around the theme of “Agency”<\/a> \u2014 self-determination in an era of algorithmic manipulation, dark patterns, and shrinking digital autonomy. “Dark patterns embedded in apps circumvent our will, hijacking our focus,” the official theme document states. “Tech giants conspire to shrink our pool of options for information and communication while their algorithms maximize rage engagement and spread deliberate disinformation and bot content.” DEF CON’s answer \u2014 in the theme’s framing and in the research being presented across its 38 villages and dozens of simultaneous competitions \u2014 is active resistance and technical reclamation.<\/p>\n DEF CON 34 runs simultaneously with the final day of Black Hat USA 2026 at Mandalay Bay, in the same week that saw BSidesLV warn of AI agent attack surfaces and Microsoft disclose the ChainDrop npm worm \u2014 a self-propagating npm worm<\/a> that specifically targeted Claude Code and VS Code configuration files to hijack AI coding agents as persistence vectors. The research arriving at DEF CON this weekend addresses exactly the infrastructure ChainDrop weaponized. That is not a coincidence. It is the state of the field.<\/p>\n Tickets are $520 cash at the door. The conference runs through Sunday, August 9.<\/p>\n Why Autonomous Agents Are Standard Weapons Now, Not Experimental Tools<\/p>\n In 2025, a DEF CON CTF team called Blue Water discovered \u2014 after a judge notified them \u2014 that their autonomous hacking agent had independently solved a challenge and won without human involvement. DEF CON organizers described it as “an exciting novelty.” For DEF CON 34, that novelty is gone. The Benevolent Bureau of Birds, this year’s CTF organizers, have designed challenges specifically around a hybrid human-and-agent competitive environment. Their explicit framing, published on the official CTF archive<\/a>: “This year, we expect that novelty to be the norm.”<\/p>\n The speed of that shift has empirical grounding. At the DEF CON CTF qualifier this year, researchers from UC Santa Barbara and UC Berkeley deployed an autonomous system called SageCTF against the 48-hour online qualifier \u2014 a 686-team Jeopardy-style competition covering web, cryptography, binary exploitation, reverse engineering, and more. SageCTF recovered 8 flags<\/a> and finished in the top 5 percent of all scored teams, outperforming every team that self-reported using no AI assistance or low AI assistance. The median solve required five hours of sustained autonomous exploration. The best human teams remain stronger \u2014 but the gap is measurable and narrowing.<\/p>\n What makes this significant for practitioners outside the CTF world is the model constraint under which SageCTF operated: it ran on models available to anyone, not on specialized or frontier infrastructure. The same dynamic governs HALctf, the AI Village’s own autonomous competition launching Friday: all model inference runs through a centralized Model Service that removes any GPU budget advantage, and the challenge is specifically framed around open-source models. The official HALctf contest description<\/a> puts it directly: “HalCTF breaks that cycle by asking a critical question: What can be achieved with pure, open-source models?”<\/p>\n The answer implicit in the question is the one that should inform every security team’s threat model: quite a lot.<\/p>\n What HALctf Is and How It Works<\/p>\n HALctf (Hostile Autonomous Layer CTF), organized by the AI Village, is the formal debut of fully autonomous-only competitive security at DEF CON. Participants do not interact with challenge targets directly. Instead, they design and deploy autonomous AI agents \u2014 packaged as OCI Docker containers of up to 2.5 gigabytes (GB) \u2014 that navigate sandboxed environments, exploit challenge targets, and capture flags entirely without human guidance per challenge. The full technical specification is on aivillage.org<\/a>.<\/p>\n To level the competition, all model inference runs through a shared Model Service: participants’ containers call an OpenAI-compatible API endpoint, and the service handles compute. No team wins on the strength of its GPU budget. What differentiates teams is agent architecture \u2014 the harness, the tooling, the memory management, the cross-agent communication topology. The first-place prize is a DGX Spark, a personal AI supercomputer, so that the winner can continue autonomous hacking research on local infrastructure after the conference.<\/p>\n The technical lessons from HALctf will land in offensive security tooling within months. That is how DEF CON research has always worked: what wins a CTF becomes what attackers use, and then what defenders must understand.<\/p>\n The CTF World Championship: 673 Teams, Four Days, One Black Badge<\/p>\n Beyond HALctf, the flagship DEF CON CTF \u2014 the Jeopardy-style competition widely considered the Olympics of hacking \u2014 runs across all four days of the conference, with qualifying teams selected from 673 that competed in the Benevolent Bureau of Birds’ online qualifier held May 22\u201324<\/a>. The BBB, assembled from previous CTF champions spanning a lineage that includes the Nautilus Institute, Order of the Overflow, and a roster of organizers back to the Ghetto Hackers in 2002, runs the contest through Sunday’s closing ceremony.<\/p>\n The CTF floor simultaneously runs more than 40 separate competitions. Beyond HALctf, these include Capture The Packet (the Packet Hacking Village’s Black Badge\u2013eligible network forensics contest), the Car Hacking Village CTF on live vehicle architectures, STARPWN from the Aerospace Village, Code Cadaver from the Biohacking Village (medical device exploitation), and Crack Me If You Can 2026, the annual password-cracking marathon. The DEF CON contests page has listings<\/a>. The Call Center Village’s Escalation Desk CTF is worth noting specifically: competitors face social engineering and voice AI challenges, an acknowledgment that the human attack surface has not been automated away \u2014 only augmented.<\/p>\n Friday’s Main Stage: EV Exploitation, WhatsApp at Scale, and Schneier on AI<\/p>\n Main stage talks begin Friday morning (10:00 AM PDT, 1:00 PM ET) across five simultaneous tracks. The complete DEF CON speakers schedule<\/a> is posted online.<\/p>\n At 10:00 AM PDT, five sessions open simultaneously. Carlo Meijer and Wouter Bokslag will deliver “Texas Incidents: How We Broke the OMAP-L138 Trusted Execution Environment,” exposing a compromise of the widely-deployed OMAP processor’s TEE. Track 4 has Christopher “xoreaxeaxeax” Domas with “Weaponizing Uselessness: Breaking SMM with the Slowest Instruction Ever Written,” and Track 5 has Ron Ben Yizhak on escaping Azure containers via a Python-in-Excel exploitation chain. At 10:30 AM PDT, bunnie Huang will present on the Baochip-1x badge chip<\/a> in Main Track 1 \u2014 the hardware at the center of DEF CON 34’s supply-chain transparency story, already extensively covered in this outlet.<\/p>\n The 11:00 AM PDT session brings the 2026 Pwnie Awards \u2014 the community’s annual ceremony for the year’s most significant and most embarrassing security failures. Running concurrently in Track 3: Jaron Bradley and Alex Radocea will present “Keychained Melody: Grabbing the Keys to the iCloud Kingdom,” and in Track 5, Mehdi Ziazi and Martin “MasorX” Strohmeier will demonstrate live attacks against CPDLC \u2014 the Controller-Pilot Data Link Communications protocol used in commercial aviation.<\/p>\n At 12:30 PM PDT, a fireside chat between Jeff Moss and General Paul Nakasone, the retired NSA Director and US Cyber Command commander, opens in Main Track 1. Nakasone has previously spoken at DEF CON on national security cyber operations; his return for DEF CON 34 arrives at a moment when the policy and technical communities are both grappling with autonomous AI capabilities across offense and defense.<\/p>\n Friday’s 5:00 PM PDT close is anchored by two high-profile sessions. Bruce Schneier will deliver “Hacking AI” in Track 1 \u2014 a keynote-caliber talk from one of the security field’s most recognized public intellectuals on adversarial manipulation of AI systems. And Maximilian Guenther and Gabriel Gegenhuber will present “Gotta Catch ‘Em All: How to Capture 3.5 Billion WhatsApp Accounts” in Track 3 \u2014 a mass-scale account takeover research disclosure.<\/p>\n Saturday and Sunday: Cliff Stoll, EV Battery Theft, and a Claude Zero-Day<\/p>\n Saturday opens at 10:00 AM PDT with Zhenghan Wang and Yang Liu presenting on mass exploitation of TTLock smart locks, and Federico Kirschbaum and Gaston Aznarez demonstrating root-level remote code execution against Ubiquiti AirMax infrastructure. At 11:00 AM PDT, Felipe Solferini and Vangelis Stykas will present “Tracking the Trackers: How We Took Over 36 Million GPS Devices Protecting Children and Vehicles” \u2014 a mass-scale takeover of consumer GPS tracker infrastructure. All Saturday sessions are listed on the DEF CON speakers page<\/a>.<\/p>\n At 1:00 PM PDT Saturday, Cliff Stoll \u2014 the author of The Cuckoo’s Egg and the figure who documented the first international computer intrusion investigation \u2014 will take the stage with “Stalking the Wily Hacker\u202640 Years Later.” Stoll caught a KGB-linked hacker in 1986 by tracking an accounting discrepancy of 75 cents. His retrospective frames four decades of how the community’s threat model has evolved from a single curious intrusion to the nation-state and AI-driven campaigns filling this weekend’s program.<\/p>\n At 2:00 PM PDT Saturday, H.D. Moore \u2014 creator of Metasploit \u2014 will present on exploitation of baseboard management controllers and out-of-band server management interfaces, the hardware layer that remains accessible even when an OS is powered off or fully compromised.<\/p>\n Saturday’s 5:00 PM PDT close features Fabien Guillebot and Stepan Konicek on “High Voltage Heist: Turning Your EV into My Power Bank” \u2014 exploiting EV charging protocols to extract energy from a vehicle \u2014 and Robert Herrera and Alex Plaskett on USB video exploitation.<\/p>\n Sunday closes the conference with, among other sessions, a multi-vendor exploitation chain disclosure: Barak Sternberg, Nevo Poran, and Ron Bobrov will present “Your WAF Blocked Us, That Was The Exploit \u2014 Remote Agent Takeover via Cloudflare, Sentry and Claude Zero-Day for Data Exfil.” The talk, listed on the speakers schedule<\/a>, discloses a zero-day in a major AI model as part of a multi-vendor attack chain, arriving at a conference whose entire program has spent three days interrogating how AI systems can be subverted, not just used. The closing ceremony, final CTF results, and Pwnie Award winners will follow Sunday afternoon.<\/p>\n How AI Came to Dominate Both Offense and Defense at Once<\/p>\n The AI theme at DEF CON 34 is not a keynote buzzword or a marketing layer. It is the organizing principle of the technical program.<\/p>\n Across nearly every time slot and multiple villages simultaneously, researchers are presenting work that treats AI systems as both the primary attack surface and the primary offensive weapon. The AI Village’s HALctf makes autonomous pentesting agents a competition category \u2014 while talks on AI sandbox escapes (“The Sandbox is a Suggestion: Deconstructing AI Agent Sandboxes,” Friday Track 1, Elad Meged), LLM build gate bypasses (“LGTM: Bypassing an LLM Build Gate When Prompt Injection Fails,” Friday Track 5, Aviv Donenfeld), AI orchestration RCE (“Hacking Your Life with AI Can Get You Hacked: How AI Orchestration Platforms Ship RCE by Design,” Saturday Track 1, Peyton Kennedy), and AI-assisted influence operations (Creator Stage Saturday, Tobias Diehl) run back to back across the main stage and Creator Stage<\/a>.<\/p>\n The Creator Stage panel featuring Bruce Schneier Saturday afternoon \u2014 “Rules for Defenders and Frontier Models for Adversaries” \u2014 asks directly whether institutional restrictions on dual-use AI models only disarm defenders, a question that the HALctf’s open-source-only model mandate has already partially answered in the competitive context.<\/p>\n The Voting Village, in its tenth year, and the Policy @ DEF CON track both connect the AI conversation to institutional accountability. Carole House’s Creator Stage session on liability standards, the Nakasone fireside chat, and Curt Barnard of Anthropic presenting “Minimize Harm, Maximize Defense: How Anthropic Navigates the Offense-Defense Divide” on Friday afternoon all signal that DEF CON’s decade-long drift toward policy engagement has in 2026 arrived at the specific policy question the community has spent two years building toward: who is accountable when autonomous AI systems cause harm?<\/p>\n Creator Stage also features Joshua Marpet presenting “AI Safety Theater: What the RAISE Act Regulates \u2014 and What It Does Not” \u2014 an analysis of federal AI regulation’s scope gaps \u2014 and Alexis Hancock and Kenyatta Thomas on “Why Mandatory Age Verification Keeps Us All Less Safe,” connecting the conference’s digital autonomy theme to surveillance-infrastructure concerns that extend well beyond any single policy debate.<\/p>\n 38 Villages: Aerospace to Voting, Maritime to Scambaiting<\/p>\n DEF CON 34 hosts 38 official villages \u2014 semi-independent mini-conferences each running their own talks, workshops, and labs across the four days. The DEF CON villages page lists all<\/a> 38.<\/p>\n The AI Village has refocused for 2026 on practical AI security: drop-in workshops on LLM internals, agent construction, and prompt injection alongside HALctf and a novice-friendly demonstration of how local models can be equipped with custom tooling. The Aerospace Village pairs aviation and space cybersecurity research with the STARPWN CTF. The Car Hacking Village runs live vehicle architectures on bench setups for hands-on ECU teardown and CAN bus interception. The ICS Village simulates realistic industrial control environments \u2014 PLCs, HMIs, RTUs, actuators \u2014 for offensive and defensive exercises. The Voting Village, now in its tenth year, provides real US voting hardware for public hacking alongside a two-day speaking track on election security. The Maritime Hacking Village features panels with retired flag officers on subsea cable vulnerability and live exploitation of AIS, NMEA 2000, and GMDSS maritime protocols.<\/p>\n The Social Engineering Community Village will host its Vishing Competition \u2014 competitors place real live calls from a soundproof booth \u2014 and “Battle of the Bots,” where AI agents attempt to social engineer human targets. The Call Center Village allows attendees to synthesize their own voice and wire up conversational AI agents against simulated customer service environments. And the Quantum Village, now in its fifth year, offers open access to quantum computing hardware for the hacker community \u2014 a reminder that the threat model beyond the immediate AI moment is already being built.<\/p>\n What to Watch This Weekend<\/p>\n A few through-lines worth tracking across the four days:<\/p>\n Hardware transparency as an existence proof \u2014 The Baochip-1x badge has already established that verifiable open-source silicon is achievable at production scale. The red-team work on that same silicon begins this weekend. Whether the community finds exploitable flaws in the AES masking implementation, the closed-source USB PHY, or the Xous boot chain will determine how far the existence proof extends.<\/p>\n Telecom and maritime infrastructure \u2014 North Korea’s DPRK IT worker operation (Saturday Creator Stage), maritime subsea cable vulnerability panels with RADM John Mauger USCG (ret.) and Michael Sulmeyer on Friday, satellite protocol exploitation, and public transport RFID attacks all reflect a community increasingly focused on critical infrastructure that has been under-secured and under-studied.<\/p>\n Policy as technical practice \u2014 The DEF CON Franklin program, which deploys security volunteers to under-resourced rural water utilities \u2014 the same category of infrastructure that has faced escalating nation-state attacks \u2014 will have a dedicated session connecting technical capacity-building to the conference’s broader “Agency” theme. Jake Braun is scheduled to present on the program’s first-year results.<\/p>\n Talks will be archived on the DEF CON Media Server and Infocon.org following the conference.<\/p>\n Frequently Asked QuestionsWhat is HALctf, and why does it matter that it requires open-source models only?<\/p>\n HALctf is the AI Village’s debut autonomous-only CTF competition at DEF CON 34: participants build AI agents in OCI Docker containers and deploy them against sandboxed challenge targets without any human interaction during the challenge itself. The HALctf specification is on aivillage.org<\/a>. What makes the open-source-model requirement significant is that it removes the assumption that autonomous offensive capability requires access to frontier closed-source systems like GPT-4 or Claude. If effective autonomous pentesting agents can be built on models any practitioner can run locally, the threat is not limited to sophisticated actors with enterprise API budgets \u2014 it is available to a much broader range of adversaries. That is the question HALctf is designed to answer empirically, in a competitive setting, with results the community will be able to evaluate.<\/p>\n What is the DEF CON CTF, and who are the Benevolent Bureau of Birds?<\/p>\n The DEF CON Capture the Flag is widely considered the world championship of competitive hacking \u2014 a multi-day competition where teams solve complex offensive security challenges across binary exploitation, cryptography, reverse engineering, web security, and other categories. Winning teams earn black badges, DEF CON’s most elite recognition, granting lifetime free admission to the conference. The DEF CON CTF archive has history<\/a>. The Benevolent Bureau of Birds are this year’s CTF organizers \u2014 a team assembled from previous CTF champions across the competition’s multi-decade lineage \u2014 taking over from the Nautilus Institute, which ran the competition from 2022 through 2025.<\/p>\n Can AI hacking agents actually solve the kinds of challenges in competitive security competitions?<\/p>\n