Black Hat Europe

AI adoption is reshaping the enterprise, but many organizations are still determining how to balance innovation with security, governance, and risk management. In this interactive executive forum, attendees will take part in live polling, real-world scenarios, and audience-driven discussions alongside leaders from Zenity, Backslash Security, Verno Labs, Hornetsecurity by Proofpoint, and Dash Security. As organizations deploy copilots, AI-generated code, autonomous workflows, and intelligent agents, participants will be challenged to make critical security decisions in real time, exploring the tradeoffs between speed, visibility, governance, application security, and business outcomes. Through practical insights and spirited debate, attendees will gain a clearer understanding of where to focus their efforts to build a secure and resilient AI-powered enterprise.

We discovered thousands of unreported messages from rogue AI agent swarms hidden somewhere nobody was looking: inside URLs. These messages reveal how agents encoded HTML and Javascript into addresses on public httpbin-like services and abused public infrastructure to increase their network reach and complete their tasks. This Briefing focuses on the chains created by the agents, and the techniques behind those chains. We show how these messages uncover the swarm's circumvention methods and how the agents built a URL laundering mechanism for broader network access, chaining dozens of ordinary public services that their sandboxes allowed in order to access restricted destinations. Agents ran Javascript by hijacking online scanning services which have remote browsing capabilities, encoding scripts with elaborate functionality and abusing the services' infrastructure to get to otherwise inaccessible targets. Here, the URL laundering moves into Javascript fetch calls, placing the requests well outside the agents' original sandbox controls. The controls most organizations rely on today for network sandboxing, such as host-based allowlists and HTTP request method restrictions, are exactly the ones these techniques bypass. Building on these concepts, we elaborate on what's required to identify rogue agents attacking your infrastructure, as well as on how to detect and restrict misaligned AI when running your own agents. Takeaway Agents are determined to achieve their goal at whatever means possible. They are consistently finding creative and sophisticated ways to bypass their restrictions, coordinate with other agents and cross into systems unrelated to their initial goals. Defenders need to start considering their next attacker might be an agent, on a different assignment, using your infra as a stepping stone. Naive egress controls won't hold swarms back. Swarms circumvent these controls by chaining encoders, redirectors, fetchers, remote browsing execution and any available service that extends their capability. This is a bigger lesson, we need to start thinking about more durable ways to contain agents. As they become more capable of finding paths around restrictions, the boundaries we put in place must hold even when our own agents push against them. Protecting your infrastructure from rogue AI agents' abuse requires anticipating future swarm patterns and capabilities that misaligned AI will seek. This means both understanding current observed attacks vectors, as well as considering what these could evolve to become in the future.