DEF CON 34 Highlights: The Biggest Hacks So Far

DEF CON 34 turned the systems marketed as safeguards into attack surfaces: AI sandboxes, web application firewalls, passkeys, anti-theft devices and even CPU shadow stacks. The conference runs August 6–9, 2026, at the Las Vegas Convention Center. Based on the talks and research made public through August 9, these are the disclosures that matter most after the demos end.

This is a research roundup, not a list of attacks observed in the wild. Some flaws were already patched before their DEF CON presentation; other sessions demonstrate exploit techniques or deployment weaknesses rather than a new CVE. Sunday items are identified from the conference's published program and accompanying research, so readers do not have to guess what was already delivered and what was scheduled for the final day.

The short version: eight DEF CON 34 standouts

Researchers broke the containment assumptions behind three major AI coding-agent sandboxes.
A patched Gemini CLI flaw reached CVSS 10.0 and executed code before the sandbox started.
Cloudflare and Sentry logs became prompt-injection delivery channels for connected agents.
RovoBlast showed how one Atlassian link could make Rovo expose authorized enterprise data.
A passkey audit reported server-side attack paths across all 103 relying parties tested.
Linux shadow stacks were modified using three techniques despite CET remaining enabled.
USB video bugs were chained into reliable code execution against mobile-device kernels.
Dealer-installed anti-theft hardware put an estimated 2.2 million cars at risk until updated.

Friday: AI sandboxes, transit cards and a bomb-disposal robot

AI agent sandboxes failed below the prompt layer

In The Sandbox is a Suggestion, Novee Security researcher Elad Meged compared the containment architectures used by Anthropic's Claude Code, Google's Gemini CLI and OpenAI's Codex CLI. The reported failures did not depend on persuading a model or winning a jailbreak. They targeted structural assumptions in permission checks, environment sanitization and filesystem enforcement. Meged said the deterministic issues were reported through coordinated disclosure.

The practical lesson is that an AI agent's security boundary begins before the prompt: repository configuration, environment variables, startup arguments, protocol handshakes and tool permissions are all inputs. A model can follow its policy while the runtime around it has already granted an attacker execution.

Public-transport security by obscurity did not survive a Flipper Zero

Aidan Nakache's Riding for Free research mapped proprietary transit-card formats across more than 50 cities and produced the open-source Metroflip reader. The talk reported critical weaknesses in Spain's RENFE and Barcelona's T-Mobilitat systems: modifying counters, expiry dates and zones in one case, and changing a byte in a mobile relay to bypass card-level cryptography in the other.

The significant finding is not free travel. It is that undocumented data formats were treated as a control. Once the format and checksum were reverse-engineered, the systems still needed server-side validation capable of rejecting impossible balances, routes and refund sequences.

A six-figure tactical robot still spoke plaintext Python 2.5

Patrick Kiley and Emily Astranova dismantled an iRobot PackBot used for explosive ordnance disposal. Their full-stack teardown described unencrypted VPN traffic, plaintext control protocols, paths to root access and command injection in the modern tablet controller's JAUS implementation. The live demo connected the legacy software stack to a physical machine that can operate in dangerous spaces.

Long-lived operational hardware creates a familiar security trap: the chassis and mission remain valuable long after its original software assumptions expire. Network segmentation and authenticated, encrypted control channels are not optional simply because a device is specialized or difficult to reach physically.

Saturday: Linux shadow stacks were writable after all

Intel CET shadow stacks are designed to stop return-address corruption by keeping a protected copy of control-flow data. Vladimir Tokarev demonstrated three ways to place attacker-chosen values into Linux shadow-stack memory: through /proc/self/mem, through userfaultfd, and with Intel's WRSSQ instruction.

The first path prompted a Linux kernel restriction, although the talk says a fork-and-ptrace variant remained possible. Theuserfaultfd technique was not stopped by that fix. Tokarev validated the methods against memory-corruption vulnerabilities in dnsmasq, libinput and rsync, including a root-shell demonstration with CET still enabled.

This does not make shadow stacks useless. It demonstrates why exploit mitigations must be evaluated as systems: kernel interfaces, page-fault behavior, debugging features and privileged instructions can reopen a path that the memory protection itself appears to close.

Sunday: the final-day disclosures widened the blast radius

Gemini CLI could execute code before receiving a task

Meged's Sunday session focused on a Gemini CLI and run-gemini-cli GitHub Action vulnerability scored CVSS 10.0 by Google's security team. In headless workflows, attacker-controlled repository content could be accepted as trusted configuration and reach command execution before the agent sandbox initialized. A malicious pull request could therefore expose the secrets and source code available to the CI runner without any model decision.

This issue was publicly disclosed and patched before DEF CON. Novee lists fixed versions as Gemini CLI 0.39.1 and 0.40.0-preview.3, plusrun-gemini-cli 0.1.22. CI owners should also stop automatically trusting forked pull-request workspaces and keep untrusted jobs away from production credentials.

When a WAF blocks the payload, the log can deliver it

Tenet Security's published Sunday abstract describes two indirect prompt-injection chains. In the first, attacker text lands in Cloudflare WAF logs after a blocked request. When a developer asks an agent to investigate, the agent retrieves the poisoned log through connected tools; the researchers report using those tools to change DNS and reroute traffic. In the second, crafted stack traces reach Sentry, poison an agent's recommendation and then flow into a developer's coding agent.

The team also reported a responsibly disclosed Claude sandbox bypass used for data exfiltration. Its exposure estimates are the researchers' figures, not an observed breach count. The defensive conclusion is already clear: logs, tickets, traces and monitoring alerts are untrusted input. Giving an agent access to them and authority over DNS, deployment or a shell creates an execution chain that needs a human confirmation boundary.

RovoBlast made one trusted Atlassian URL dangerous

Varonis showed that a crafted rovoChatPrompt URL could seed attacker instructions into an authenticated Atlassian Rovo session. Because Rovo could read Jira, Confluence, Bitbucket and connected SaaS data under the victim's legitimate permissions, no access-control bypass was necessary. Atlassian fixed the reported issue before publication, and there is no public evidence of exploitation.

Our separate RovoBlast analysisexplains the link-to-prompt path, the exfiltration channel and the controls Atlassian administrators should review.

Passkeys were strong; the systems around them were not

Matteo Giordano's Beyond the Ceremony talk keeps an important distinction intact: WebAuthn's phishing-resistant cryptographic ceremony works. Real sign-in systems also include account recovery, fallback authentication, cloud sync, cross-device transport and relying-party server logic. According to the talk's audit, every one of 103 live relying parties tested had at least one server-side attack path.

That is a reported research result, not a claim that passkeys are broadly broken. Teams should test the entire account lifecycle: registration and deletion, username and account binding, recovery, session upgrade, fallback methods and administrative resets. A phishing-resistant front door does not help if the side entrance still accepts a reusable secret.

USB video frames became a kernel exploit path

NCC Group researchers Alex Plaskett and Robert Herrera reconstructed exploitation for CVE-2024-53104, an out-of-bounds write in Linux USB Video Class handling associated with an earlier in-the-wild mobile-device exploit chain. They combined it with the information-disclosure flaw CVE-2025-38494 to bypass KASLR and reach reliable code execution.

The story matters beyond two CVEs. USB peripherals deliver structured, attacker- controlled input into large kernel parsers. Cameras and capture devices should not be considered passive merely because the user is not opening a file or clicking a link.

An anti-theft upgrade exposed an estimated 2.2 million cars

UC San Diego researchers found a global shared authentication key in dealer- installed KARR/SWDS Bluetooth anti-theft devices. Their updated analysis estimates at least 2.2 million affected vehicles. An attacker within Bluetooth range could control locks, the alarm and the immobilizer; gaining entry could enable further theft through tools available to automotive locksmiths.

The manufacturer released a patch on July 20, 2026, but owners must receive it through the updated app. The hardware can remain installed even when a buyer declines the dealership upsell, so owners should look for KARR or SWDS markings and confirm the device was updated or removed. A single fleet-wide secret is not device authentication—it is one password copied into millions of targets.

What defenders should do after DEF CON 34

Inventory every agent and connector. Record which repositories, logs, SaaS tenants, shells, DNS zones and deployment systems each agent can reach.
Treat retrieved context as hostile. Logs, issues, pull requests, web pages and traces must never silently become trusted instructions.
Separate reading from acting. An investigation agent should not be able to change DNS or deploy code without a distinct approval step.
Patch the runtime, not only the model. Update agent CLIs, GitHub Actions, kernels, device firmware and companion apps.
Test the fallback path. Passkeys, hardware protections and encrypted protocols are only as strong as recovery, debugging and legacy modes.
Eliminate shared device secrets. Automotive, industrial and IoT fleets need unique credentials, rotation and revocation per device.

The theme of DEF CON 34

The standout research did not defeat cryptography with magic. It followed trust across boundaries that product diagrams tend to separate: a blocked request became agent context, a repository became configuration, a Bluetooth accessory inherited authority over a car, and a debugging interface reached protected stack memory.

The durable takeaway is to model the whole path from untrusted input to privileged action. The component labeled “security control” can still transform, store or forward attacker data. At DEF CON 34, that was where many of the most interesting attacks began.