Every security vendor at Black Hat next week will have a solution that automates security with agents. One question is worth settling before you walk the floor: which security trail do you actually need paved? đ
The trails we wore in
Todayâs security workflows are game trails. Somebody blazed each one, and then twenty years of humans wore it down doing what we could manage and what we could trust:
A scanner finds a CVE, a ticket gets filed, an owner gets located, and the fix waits for a maintenance window.
An alert fires, a tier-1 analyst triages it, and most of the dayâs alerts are never touched at all.
A vendor receives a security questionnaire once a year, and the answers go stale the day they are signed.
A pentest produces a PDF, the PDF produces a remediation plan, and the plan produces another queue.
Each path was rational when it was blazed, shaped by the same constraint: a human had to stand at every hop, because nothing else could be trusted with the decision.
With agents comes automation, and security vendors have paved many of the segments with agents. Paving a game trail makes each leg of the path faster. It does not make it the highest-value path. A ticket queue with an agent bolted to the front of it is still a ticket queue.
Ninety days of new terrain
Meanwhile, the last ninety days point at terrain where few trails exist.
Mythos surfaced thousands of high-severity zero-days, including flaws in every major OS and browser, some of which had survived decades of human review. The count alone is not the main storyline here â itâs that discovery has stopped being the scarce resource, which puts every workflow that begins with a human reading a finding underwater by construction. Our ability to find vulnerabilities has grown exponentially, but our capacity to act on them has been, to date, constant.
Researchers at Toronto and the Vector Institute demonstrated a worm that generates a tailored attack strategy for each host it encounters. Sixty-two percent of a 33-host network compromised in seven days with zero attacker intervention, ingesting public CVE advisories at runtime and rooting one-day vulnerabilities it had never trained on. Once it lands on a GPU it runs its own inference, so the marginal attacker cost per new infection is roughly zero. Chaining together a string of existing vulnerabilities are in the realm of agents with neither access to specific offensive security tooling, or access to a closed frontier model.
Hugging Face was breached in-the-wild by a not-completely-sandboxed agentic security-research harness. Nobody was driving it. It ran through all layers of imperfect sandboxing, network segments and runtime protections to a self-discovered target. Code execution in one worker pod to cluster-admin across multiple internal clusters in under thirteen hours, 181 devices enrolled into the corporate mesh with a stolen key, and Hugging Faceâs own exit nodes turned into the egress path. Hugging Faceâs technical timeline puts numbers on it: about 17,600 recovered attacker actions in roughly 6,280 clusters between July 9 and July 13. XDR and automation may make some headway at an incident. Then what?
A decade in this seam
I have spent more than a decade in this seam: demonstrating automated AI attacks (reinforcement learning) against ânext-gen AVâ at Black Hat and DEF CON in 2017, architecting the AI red team at Microsoft, then as CTO at Robust Intelligence, testing AI both for and against security controls.
One invariant has held the entire time: a persistent optimizer with just-good-enough tooling will eventually achieve its objective with nonzero probability. That was survivable when the optimizer was a person with a day job and a budget. At machine speed, with marginal cost near zero, it becomes untenable.
The only term we control
Which brings it back to security economics. Your security posture eventually boils down to the ratio of attacker net cost to defender net cost, and every algorithmic advance of the last three years has driven the numerator closer to zero. The denominator is the only term we still control, and most solutions arenât optimizing the long pole in the tent. They are automate the parts that were already fastâdetection, enrichment, scoring, rankingâor make the security org efficientâautomatic triage or incident reporting. But, the long pole in the âdefender costâ tent is actually the schlep thatâs shared between discovered exposures in the security org and the fix in an engineering or IT org. It still requires a human to confirm a security exposure is real, find the owner, write the fix, stage it, prove it broke nothing, and close the loop.
Automating that schlep is a road worth paving, because it is the only one that changes the ratio in a durable way.
Four lenses for the expo floor
So, four lenses to take onto the expo floor as you consider an AI-centric future for defensive security. For each game trail a vendor claims to automate:
âĄď¸ Does it survive a world in which attacker cost and machine speed approach zero? In that world, defense cost favors proactivity over reactivity, and multiple defensive agents over multiple keyboards and monitors.
âĄď¸ Does it remove or meaningfully decrease time-in-human-hands? If a person still has to read the finding first, you are buying a faster queue.
âĄď¸ How does it accelerate end-to-end security, i.e., when the response/remediation actually lands? If it cannot ship where your code ships, that is not remediation. It is a notification.
âĄď¸ How are humans being elevated from the mundane to the strategic? At the end of the day, scaling defensive security means queening every human security pawn.
One extrapolative prediction: the future of machine-speed security resolution will not live in a security org at all. It will live in engineering, with the platform and devops teams already running coding and configuration agents. They have no security trails to pave.
Sources
Hugging Face, security incident disclosure, July 2026; OpenAI, on its evaluation harness; Simon Willison, analysis
Guan et al., âAI Agents Enable Adaptive Computer Worms,â arXiv:2606.03811, CleverHans Lab (Toronto / Vector Institute), June 2026
Hugging Face, technical timeline of the July 2026 agent intrusion (17,600 recovered actions)
Mythos disclosure coverage: CNBC, The Conversation
Anderson et al., âBot vs. Bot: Evading Machine Learning Malware Detection,â Black Hat USA 2017