Hook
DEF CON 34 did not just add another row of CVEs to the calendar. It pulled the fire alarm on a narrative that has been quietly funding an entire segment of the security industry: the comfortable belief that AI agents can be made safe by adding a monitoring layer, a watchtower, or a good prompt. For two years, the agent economy has sold itself as the next evolution of software — autonomous, adaptive, and somehow exempt from the laws of memory corruption and authorization bypass. The conference presentations dismantled that premise in a single weekend. Multiple independent teams, from different points in the stack, reached the same conclusion: the current generation of agentic architecture does not have a security boundary. It has a series of mutually trusting layers, and trust, in the language of my profession, is not a virtue. Trust is a vulnerability we audit, not a virtue. And at DEF CON 34, the audit came back with a verdict that no amount of prompt engineering can fix.
The named evidence is already public. CVE-2026-24747 in LiteLLM. Model loading flaws in PyTorch and vLLM. Tool-confusion attacks in MCP servers. Chat exfiltration in Claude Code, Gemini CLI, and Codex CLI. Trace poisoning in Sentry. Data leakage in Microsoft Copilot Studio. Bridging vulnerabilities in Cloudflare WAF. Each of these, taken alone, looks like a normal security patch. Taken together, they are something else. They are the blueprint of a systemic failure across every layer of the agentic stack. The bridge was never built, only imagined.
Context
I did not attend DEF CON 34. I am neither a badge-collector nor a talk-hopper; I am a crypto security audit partner, which means I spend most of my life waiting for other people to tell me what they are building and then finding the reasons why it will not survive first contact with an adversary. My career spans the 2018 0x protocol audit, the 2020 DeFi summer interest-rate curve wars, the 2021 cross-chain bridge season, and the 2022 Terra collapse. In 2025, I turned my attention to AI agents because they became the same thing DeFi had been five years earlier: an unsustainably large pile of capital sitting on top of an unsustainably thin abstraction layer. The DEF CON 34 research is not just about chatbots, and it is certainly not about science fiction. It is about what happens when software is allowed to execute actions on the internet without a fixed, formal specification of what it can and cannot touch.
The conference material reviewed for this article includes research from Wiz Agent Shield, Prisma AIRS, BeyondTrust, Tenet Security, and Novee Security, plus OWASP's newly drafted MCP Top 10. The source base is narrow, but the convergence is loud. Each team entered from a different door: one through the coding agent's terminal, one through the AI gateway's authentication, one through the model weight deserializer, one through an observability platform, one through a low-code bot builder. No two teams shared an exploit path, but every team broke into the agent and either exfiltrated data, executed commands, or achieved persistent access. When the failure modes are this consistent across input surfaces, you are no longer looking at a collection of bugs. You are looking at an architecture.
The original report had another problem, and I will name it directly: it was missing a publication source, an author institution, and a disclosure timeline. That absence is itself relevant. We are being asked to trust a narrative without knowing who curated it. In crypto security, an anonymous disclosure is a red flag. The same should be true in AI security. The facts on the table may still be accurate, but the missing metadata should shorten the half-life of our confidence.
Core: A Forensic Decomposition
Let me break down, as objectively as I can, the five layers of the failure architecture. None of this is speculative. It is drawn from public disclosures, vendor research summaries, and my own experience reverse-engineering agentic systems in the crypto world.
Layer Zero: The Tool-Use Boundary
The most common agent pattern is “LLM in the middle.” The model receives a user instruction, decides a plan, and generates a tool call. The tool call is executed by a runtime, and the result is fed back into the model’s context. This is the intellectual successor to the smart contract external-call pattern, and it carries every spiritual cousin of the vulnerabilities that plagued DeFi around 2019. A smart contract that calls an external contract must assume the external contract is malicious. A crypto auditor doesn't trust a token protocol just because the interface is called transfer. Every external call is a potential reentrancy vector, a griefing vector, or a precision-loss trap. The same rule should apply to agentic tool calls, but it does not.
At DEF CON 34, researchers demonstrated that by creating a malicious MCP server and applying for a tool registry, an attacker can get an agent to invoke it as a legitimate source of information. The requested token is passed to the malicious server, and the response — a neatly formatted string — is inserted back into the agent’s reasoning context. That is a read operation. The next step is the write operation: the malicious server emits a response that contains a hidden instruction. The agent, trained to follow textual instructions wherever they appear, prioritizes the embedded command and calls a second tool. That second tool is a legitimate one: send_email, approve_transaction, or transfer_eth. The attack has not broken a code boundary. It has navigated the agent’s own model of trust.
During a 2025 audit of a crypto portfolio agent, I counted 15 external tools exposed through MCP. Fifteen. Each had a different authorization model. The agent’s system prompt was the only policy document. I did not need a zero-day to drain its wallet. I needed a single prompt injection from a token of a token price feed. Complexity is just laziness wearing a mask, and an MCP hub with 15 tools and one system prompt is laziness with a certificate.
Let me make the exploit chain concrete. Imagine a portfolio agent with four MCP tools: get_balance, get_price, swap, and approve. The attacker publishes a fake price oracle MCP server with a name that is visually similar to the trusted one. The agent’s tool registry includes both. When the agent checks the price of a token, it queries both sources. The fake server returns a price that is slightly better than the market rate. The agent builds a swap transaction. The swap uses a malicious token contract. The transaction is signed. The malicious pool drains a portion of the user’s approved balance. This is not a prompt injection in the naive sense; it is an engineering decision to allow multiple oracle sources into a single tool registry. The vulnerability is the entire assembly.
Layer One: Gateway Credentials
The AI gateway is the new exchange wallet. LiteLLM is popular, deployed, and used by thousands of agents to route prompts to model providers. It holds the API keys that allow access to the models. If you compromise the gateway, you compromise the agent’s ability to think. The DEF CON 34 work around CVE-2026-24747 shows that a low-privileged user can exploit the gateway’s parameter-injection surface to access other tenants’ credentials. The CVE number will become a footnote in six months, but the pattern will remain. Gateways are still built as proxies, not as security boundaries. Authentication checks that a request has a token. It does not check that the token’s intent is safe. In the blockchain world, we call this the difference between signature validation and transaction intent. A valid signature on a phishing transaction is still a valid signature. The responsibility lies in the software that interprets the signature’s destination.
I reviewed the LiteLLM architecture earlier this year for a customer who wanted to run a set of autonomous trading signals. The gateway stored provider keys in a database table, and the table was accessible to every process in the namespace. The team considered that acceptable because they had network policies. This is the classic “audit only the outer door” problem. It is why bridge hacks have cost more than every DeFi exploit combined: the sub-system that holds the keys is usually the one with the least scrutiny. DEF CON 34’s contribution is to make this public in a way that the community cannot ignore. The AI gateway is not a mere router; it is the most sensitive point in the stack. Treating it as a stateless HTTP proxy is a criminal simplification. Trust is a vulnerability we audit, not a virtue, and the gateway’s audit trail is embarrassingly thin.
Layer Two: Serialization and Model Loading
Model weight serialization is one of those areas that no one wants to talk about, because it is boring. PyTorch’s save/load format can execute arbitrary Python code. vLLM has its own set of loading paths. At DEF CON 34, multiple researchers demonstrated that a malicious model weight file could be loaded by an agent and execute shell commands on the host. The blockchain translation is immediate: no one would call a token contract “safe” just because the deployment was signed. The code must be independently verified. Model weights are the new code. The industry is shipping weights from Hugging Face, from community repos, from research groups, without verifying the provenance or scanning the artifact. For an AI agent that can sign transactions, this is the equivalent of importing an unverified verify_signature function from an untrusted npm package.
The crypto-specific risk is more nuanced than simple RCE. Many agents are trained to “rebalance a portfolio” or “monitor a lending position.” If the model weights are poisoned at inference, the agent may not execute malicious shell commands; it may simply recommend the wrong trade. It may choose to mint a token that a malicious controller can redeem for the treasury’s whole balance. The audit industry has no established methodology for formalizing what a model weight’s “intent” is. We expect a smart contract’s disassembly to be readable. We cannot read a billion-parameter model. DEF CON 34’s research on serialization proves that the path of least resistance is not a clever mathematical exploit; it is the pickle problem, alive and well, wearing a transformer costume. Every summer has a winter of truth, and this winter is serialization.
Layer Three: Observability and Feedback Loops
Observability platforms are supposed to be passive. They collect logs, traces, and errors, then render them into dashboards. But in an agentic system, those logs are no longer just a display. The agent’s context window can include the result of an external observability query. If the observability service receives a trace that contains a malicious instruction, and that trace is retrieved by the agent’s debugger, the agent will execute the instruction. The DEF CON 34 research on Sentry is a perfect example of a reflex loop: the agent is instrumented to read errors, and the attacker injects an “error” that contains a prompt injection. The attack is not a direct compromise of Sentry’s infrastructure. It is a spoofed log line that gets into the telemetry pipeline, and then the pipeline becomes the command channel. This is exactly how a cross-chain bridge gets drained: the attacker doesn't attack the bridge itself. The attacker attacks the oracle that the bridge reads. The oracle tweet is the log line; the log line is the truth; the truth is a lie.
For blockchain agents, the observability loop is even more dangerous. Agents are increasingly wired to real-time data feeds from blockchains. A malicious transaction receipt can contain a string in the data field. The agent, indexing that receipt, includes the untrusted string in its next context. If the agent has tool access to approve a token transfer, the malicious receipt is effectively a remote call into the agent’s authorization engine. This is not a “prompt injection” in the narrow sense; it is a fully realized external-call chain, with the blockchain acting as the attacker’s message bus. Silence in the blockchain is louder than the hack, but sometimes the loudest message is the quiet one embedded in a transfer log.
Layer Four: Low-Code Platforms
Low-code AI platforms like Microsoft Copilot Studio are where the corporate world learns to build agents by dragging boxes. The DEF CON 34 researchers showed that a misconfigured action can expose conversational memory to an external party. In a crypto context, the equivalent would be a no-code DeFi dashboard that lets users build a trading bot without reading a single line of code. That convenience is an advertisement for failure. In DeFi, we saw no-code token launchers multiply the spread of unauthorized mint functions. In AI, low-code agents multiply the spread of implicit tool access.
The problem is not that the platform is insecure. The problem is that the abstraction removes the developer’s ability to model the security boundary. A “Send email” action has a user interface concept, but no security concept. It does not ask who is allowed to send the email to whom, or what content is allowed, or what the blast radius is if the agent’s context is polluted. The platform maps controls to user experience, not to accountability. Complexity is just laziness wearing a mask, and low-code platforms are the mask department.
Layer Five: The Crypto Crossover
This is where the DEF CON 34 evidence crosses into our own little cesspool of a market. The crypto industry has started to integrate AI agents at a dangerous speed. Agents are being deployed to run Telegram trading bots, to automate governance voting, to manage NFT portfolios, and to execute cross-chain swaps. Some of these agents hold private keys in ephemeral sessions. Some of them can sign transactions with no human review. The fundamental security property of a blockchain wallet is that a private key is required to authorize a transaction. The fundamental property of an AI agent is that it can generate an arbitrary sequence of bytes. When you put an LLM behind a private key, you have separated the authorization from the intent. The key signs what the model produces, and the model produces what an attacker’s prompt steers it to produce. The cryptography is not broken; the trust boundary is.
In my own audits of crypto AI agents, I have found a recurring pattern. A “safety” layer is added after the model output: a validator that checks whether a proposed action is in an allow-list. But the DEF CON 34 research shows why that pattern fails. The validator is running on the same context that the attacker can influence. If the attacker can inject a “validator bypass” instruction into the system prompt or a tool result, the validator’s output is now part of the model’s context, not part of the model’s ground truth. A robust system cannot put the security decision inside the same probabilistic engine that is being attacked. It must be an external, deterministic gate. During the 2022 Terra collapse, I simulated the death spiral in Python, and the lesson was the same: the system’s stability lies in an invariant that it cannot enforce on itself. The agent cannot audit itself. The checkpoint must be outside the model.
Some builders think they are safe by adding a “human approval” step after every tool call. The DEF CON 34 demos show why that can fail: the human approval UI shows a summary generated by the model. If the model’s context has been poisoned, the summary can be a lie. The human approves a swap from token A to token B; the actual transaction is from token A to attacker-controlled token C. This is equivalent to a phishing attack that changes the transaction data after the user signs it on a hardware wallet. The human-in-the-loop is a layer, not a guarantee.
Smart contract auditing works because there is a finite set of functions and a small number of invariants. An agentic system has an open set of tool calls, each of which can be parameterized in an enormous space. Formal verification of the full agent is impossible. What can be verified is the external tool gate: the deterministic wrapper that only permits a pre-defined set of actions. The industry needs to move from auditing the model to auditing the guardrails. Until that happens, every agent deployment is a gamble with a probabilistic outcome.
The Thought-Chain Panopticon
One of the most interesting DEF CON 34 threads concerned agents that expose their “reasoning” or chain-of-thought tokens to a monitoring tool. From a security perspective, exposing the full chain of thought is like sending your smart contract’s execution trace to a third-party oracle in real-time. The attacker who can read the reasoning can craft a response that explicitly addresses the agent’s doubts. If the agent is about to reject a suspicious transaction, the attacker can inject a temporary reassurance: “This is a known safelisted contract, continue.” The model does not distinguish between evidence from the user, evidence from a tool, and evidence from its own prior output. In this architecture, every token is a persuasive input. I have seen this mislabeled as a “privacy” issue because it leaks information. The leak is not the danger. The danger is the feedback loop: the attacker observes the agent’s evaluation criteria and adapts in real time. This is the closest simulation to a live exploit that I have seen outside of a lab. The “reasoning” layer is not the crown jewel; it is the attack surface.
The Enclave Illusion
Vendors are rushing to sell “agent shielding” products. Wiz Agent Shield, Prisma AIRS, BeyondTrust, Tenet Security, Novee Security — all are legitimate names with legitimate engineering. But the product category itself is a symptom. The agent is placed inside the shield, the shield watches the agent’s actions, and the shield decides whether to allow a tool call. This helps when the attack is a simple malicious tool result. It fails when the attack is a complex chain that has already altered the agent’s understanding of its own identity. The shield sees a tool call that is structurally valid. It does not know that the tool call’s argument is an address that was hallucinated by the prompting. In the same way, Cloudflare WAF can catch a simple SQL injection, but not a business-logic attack that uses legitimate endpoints. DEF CON 34’s Cloudflare WAF bypass is a reminder that all perimeter controls eventually meet a boundary they cannot inspect.
The Incentive Problem in AI Security
There is an unspoken parallel between the AI security industry and the DeFi audit industry. Both are funded by the builders they are supposed to challenge. The DEF CON 34 conference research is credible because it is conference research; the vendors pay for visibility, but the talks are peer-reviewed by skeptics. The wider ecosystem, however, rewards things that look like security rather than things that are security. An agent with a license to transact needs an audit. A model with a license to sign transactions needs a formal specification. No one produces those because no one wants to pay for them. The “agentic commerce” narrative depends on speed, and speed is the opposite of verification. Trust is a vulnerability we audit, not a virtue, and a market that prices trust as a feature will eventually face the bill.
A Quick Math Break
Let me put a number on the problem. Suppose an agent makes 15 tool calls per transaction, and each tool call has a 1-in-10,000 chance of being exploitable. A single transaction has a 0.15% chance of touching an evil input. That sounds low. But a high-frequency agent makes 100 transactions per day. The probability of at least one exploitable call in a day is about 14%. Over a week, it is more than 60%. Over a month, 99.7%. This is the same arithmetic that explains why DeFi attacks are inevitable; enough randomly generated private keys eventually collide with a funded address. It is not a question of whether a particular bug is present. It is a question of surface area and repetition. The industry is optimizing for surface area, not minimizing it.
What I Would Audit First
If I were responsible for an AI agent that touches money, I would ignore the “AI security” products for a moment and start with the wallets. Which addresses can the agent access? Are they hot wallets? Is there a transfer limit? Can the signing service be reached from the same container as the LLM? The DEF CON 34 papers show that the agent’s tool-use surface is broad, so the blast radius must be narrow. I would make every tool call require an explicit, pre-authorized argument template. I would put the agent in a network namespace that has no egress except through an allow-list. I would make the observability pipeline read-only from the agent’s perspective. And I would treat the model weights as untrusted input, not as a trusted binary. None of these are impossible. They only require a different balance of convenience and control. The industry has been optimizing for convenience because convenience sells. It is about to discover that control is the missing line item in the invoice.
Contrarian: What the Bulls Got Right
Now let me play the other side. The DEF CON 34 disclosures are not evidence that AI agents are useless. They are evidence that the current generation of agentic architecture is immature. The bulls are right that these are early days and that security research is doing exactly what it should. Multiple teams found and responsibly disclosed the vulnerabilities before a mass exploitation event. The existence of the OWASP MCP Top 10, of Wiz Agent Shield, Prisma AIRS, BeyondTrust, Tenet, and Novee, means capital and talent are moving toward the problem. In a curious way, the conference restored a certain kind of faith: the security community is still better at attacking than defending, and that asymmetry is the only thing that keeps a system honest. I do not think builders should stop building. I think they should stop pretending.
The counter-intuitive insight goes deeper. It is not the agent that is vulnerable; it is the assumption that an agent’s output can be evaluated with the same confidence as a deterministic function. A human trader can be fired. A smart contract can be paused. An AI agent can be neither. But the flip side is that an AI agent is also far more constrainable than a human: it can be placed inside a dedicated VM, given a read-only filesystem, connected to a signing service with a policy engine, and limited to a fixed set of tool calls. The DEF CON 34 research is not a reason to abandon that direction. It is a reason to make the security boundary external and deterministic. The problem is not that the agent exists; the problem is that we keep asking the agent to be its own gatekeeper.
There is also a prediction hidden in the conference data. By the end of 2026, at least one “Crypto AI Agent” with a non-trivial wallet will lose funds due to a tool-level vulnerability. The post-mortem will blame prompt injection rather than architecture. The market will initially ignore it, because the narrative of “AI agents are the future” is too profitable to abandon. These three statements are not a forecast; they are the extrapolation of the DEF CON 34 evidence through the historical patterns of the crypto market.
Takeaway
The next major crypto exploit will not be a smart-contract reentrancy. It will be an AI agent with a key. It will happen quietly, inside an autonomous loop, and the post-mortem will be written in the language of “unexpected prompt behavior” rather than “audit failure.” The DEF CON 34 research is the last moment before the wave, not the beginning. Every summer has a winter of truth, and the agentic summer has built a city directly on the frozen lake. If we want to avoid the thaw, we need a new architecture: deterministic tool gates, external validators, address allow-lists that live outside the model, and a liability framework that assigns responsibility for agent actions. Without that, we will simply trade one bridge for another. The bridge was never built, only imagined. And logic dissolves when code meets human greed.