That timing problem matters. DEF CON 34 runs from August 7 through August 9 at the Las Vegas Convention Center. A report published at 7:47 a.m. Pacific time on August 8 described the event as having already “ended” and treated multiple future talks as completed disclosures. The research themes are serious; the account of what had been publicly demonstrated, independently verified, and remediated is not yet reliable enough to support the article’s central conclusion.
The more defensible takeaway for Windows administrators, developers, and security teams is narrower but still urgent: agent runtimes are accumulating conventional security failures at unusually privileged trust boundaries. The weak points are configuration parsing, workspace trust, identity delegation, tool invocation, logging pipelines, and model-loading code—not an exotic new category of failure that patches cannot address.
The Gemini CLI flaw is real—and already patched
The strongest claim in the submitted account is also the one with the clearest public record. Google’s advisory for GHSA-wpqr-6v78-jr5g covers a critical remote-code-execution chain affecting Gemini CLI and the
run-gemini-cliGitHub Action. In headless CI environments, affected releases could automatically trust the working directory and consume attacker-controlled configuration before the expected trust checks and sandboxing protections took effect.
Elad Meged of Novee is scheduled to present “No Prompt Required: Pre-Task RCE in Google Gemini CLI” at DEF CON on Sunday, August 9. Novee’s own July announcement described the case as a CVSS 10.0 issue that requires no model interaction. That is a meaningful finding because it reframes a common deployment mistake: teams often evaluate an agent’s prompt guardrails while forgetting that the agent process has already made file-trust and configuration decisions before a prompt is processed.
But the phrase “unpatchable” does not survive the primary record. Google shipped fixes in Gemini CLI 0.39.1 and
run-gemini-cli0.1.22, with the affected preview release also updated. The fix does not eliminate the broader risk of putting autonomous tooling in a privileged CI job, but it does correct this specific trust-boundary failure.
For enterprises that use Gemini CLI in GitHub Actions or another headless build system, the immediate work is straightforward:
- Upgrade Gemini CLI and the companion GitHub Action to the fixed releases or later supported versions.
- Treat
.geminiconfiguration, repository files, pull-request content, issues, and comments as untrusted input when an agent can read them. - Remove persistent cloud credentials and broad repository tokens from agent-triggered workflows, particularly workflows that can run against forks or public issues.
- Review CI logs and commit history for unexpected
.geminiconfiguration and environment files.
The practical lesson is not that sandboxes are fictional. It is that a sandbox cannot contain code that executes before the sandbox begins. That is a design and implementation error with a patch path—provided operators apply it.
DEF CON’s schedule contradicts the “conference is over” premise
The article’s largest factual weakness is chronology. Novee’s “The Sandbox Is a Suggestion: Deconstructing AI Agent Sandboxes” was scheduled for Friday, August 7, and its general description supports the broader concern that Claude Code, Gemini CLI, and Codex CLI make different containment promises that depend on assumptions outside the model itself.
However, Novee’s separate Gemini CLI session is scheduled for Sunday, August 9. Tenet Security’s “Your WAF Blocked Us, That Was The Exploit” is also scheduled for Sunday, August 9. Cloud Village’s program lists David Fišer and Amy McMahon’s “The Hidden Cost of Agentic Connectivity” for the final day as well. The submitted report treats all of these as completed presentations and reports exact exploit outcomes, estimated exposure counts, and success rates before the public sessions occurred.
That does not mean the research is false. It means readers should distinguish a conference abstract, a company teaser, and an independently documented vulnerability disclosure. They are not interchangeable.
Novee’s pre-event description says its sandbox research concerns structural assumptions in agent containment. Tenet Security advertised a Claude network-sandbox escape and exploit paths involving Cloudflare and Datadog. Those are specific technical claims from the researchers and their employers, not yet a substitute for public technical material that administrators can reproduce, scope, and mitigate.
No Microsoft, Anthropic, OpenAI, Cloudflare, Datadog, Sentry, or Cursor advisory was identified in the submitted report for the alleged exploit chains. There is also no published remediation matrix naming affected versions, deployment prerequisites, exposure criteria, or fixed builds. Until those details appear, organizations should not interpret dramatic conference-stage claims as evidence that every deployment of those products is compromised.
Microsoft Copilot Studio is the Windows-side finding to watch
The most relevant DEF CON claim for Microsoft administrators comes from BeyondTrust researchers Ryan Hausknecht and Simon Maxwell-Stewart. Their session, scheduled for Saturday, August 8, describes an attack against a no-code Microsoft Copilot Studio agent that allegedly reached TLS private keys, Azure AD client IDs, environment variables, and application source code after bypassing multiple layers of defense.
BeyondTrust’s public promotion says the researchers obtained administrative access to Copilot Studio agent containers. The company also says the chain defeated Python-level filtering, the sandbox boundary, and an AI guardrail that exposed its reasoning. Those are vendor claims pending the researchers’ technical release and, more importantly, Microsoft’s account of affected service scope and remediation.
The distinction is especially important because Copilot Studio is a managed service. Customers cannot simply patch a local executable or replace a DLL. If the attack depends on Microsoft-hosted container isolation or an exposed platform-secret boundary, Microsoft must establish the affected environments, whether the issue has been fixed server-side, whether customers need to rotate credentials, and whether prior compromise is detectable in tenant telemetry.
For now, organizations running Copilot Studio agents should inventory every agent that can execute Python, call connectors, access Azure resources, or retrieve secrets from Key Vault and other back ends. Treat agent identities as production service principals: use narrowly scoped permissions, short-lived credentials where supported, separate development and production resources, and review connector access rather than assuming a no-code interface implies low privilege.
The submitted report’s assertion that the researchers obtained “admin-level access to every Copilot Studio agent sandbox” goes further than BeyondTrust’s own promotional wording. It has not been independently corroborated, and Microsoft had not published a corresponding security advisory in the material reviewed before publication.
The PyTorch CVE undercuts the “nothing can be patched” argument
CVE-2026-24747 is another concrete issue presented as proof of a permanently broken AI stack. The National Vulnerability Database describes a flaw in PyTorch’s
weights_onlyunpickler that can allow a malicious checkpoint file to corrupt memory and potentially achieve arbitrary code execution even when an application uses
torch.load(..., weights_only=True).
That is an important correction to a widely held operational assumption.
weights_only=Truereduces exposure to unsafe pickle deserialization, but it did not create an absolute safety boundary. Applications that accept or fetch model artifacts from users, shared storage, model hubs, or automated pipelines need to treat checkpoints as executable-risk inputs, particularly if their service API can be induced to load them.
Yet the record is explicit that PyTorch 2.10.0 fixes CVE-2026-24747. Calling the issue architectural or unpatchable confuses the existence of a broad attack class with the status of this individual vulnerability. The remediation is concrete: upgrade PyTorch, restrict who can introduce or modify model artifacts, verify provenance and hashes, and isolate model conversion and loading from production-serving credentials.
The submitted account also names vLLM, ComfyUI, and NVIDIA Dynamo as remotely compromisable through the flaw. That may prove accurate for particular configurations, but the CVE record alone does not establish that all versions or deployments of those products expose remote
torch.loadpaths. Administrators should validate their own upload APIs, model-management endpoints, and background worker paths rather than treating product names as an exposure determination.
The real architectural problem is delegated authority
The most durable DEF CON theme is not that AI agents cannot be secured. It is that vendors and customers keep granting agents authority that exceeds the controls around their inputs.
Cloud Village’s program captures the issue more clearly than the rhetoric in the submitted report. Muskan Tomar’s scheduled research on cross-agent escalation focuses on AI agents holding standing cloud IAM permissions and using cloud-provider APIs to reason their way through escalation paths. That is a familiar identity-security failure: a principal with legitimate API access performs actions the security architecture did not anticipate as part of one chain.
Similarly, MCP expands the number of tool descriptions, remote services, credentials, and delegated operations an agent may trust. Every connection introduces a decision point: who controls the server metadata, what identity makes the tool call, what data can influence its arguments, and whether the result can trigger another action. Prompt injection is only one way to abuse that chain.
The security program needed here looks more like privileged-access management than content filtering. Agents require separate identities, constrained tool scopes, explicit trust tiers for local and remote content, transaction-level approval for high-impact actions, and telemetry that captures tool calls, argument sources, identity use, and resulting cloud activity. EDR cannot see a malicious but authorized IAM call as malware, because it is not malware; it is a valid API request made under a credential that should never have held that authority.
DEF CON 34 has not yet delivered enough public evidence to declare the AI-agent security model irredeemable. It has delivered something more useful: repeated evidence that privileged automation is being deployed faster than organizations are separating untrusted inputs from execution authority. The patches already available for Gemini CLI and PyTorch should be applied now, while the still-unreleased conference research is treated as a warning to audit agent permissions before the next disclosure makes the risk concrete.
References
- Primary source: forkast.news
Published: August 8, 2026 at 2:47 PM UTC
Loading…
forkast.news - Related coverage: nvd.nist.gov
Loading…
nvd.nist.gov - Related coverage: labs.cloudsecurityalliance.org
Loading…
labs.cloudsecurityalliance.org - Related coverage: labs.cloudsecurityalliance.org
Loading…
labs.cloudsecurityalliance.org