Black Hat 2026: Five Security Findings Every Organisation Should Know About
From fake AI tools downloaded 1.7 million times to a flaw that lets attackers hijack internet connections through network devices, this year's hacker conference in Las Vegas carried some practical warnings for businesses of every size.
Key points
- Malicious fake AI tools impersonating popular software were downloaded more than 1.7 million times in under a month, researchers from Zenity disclosed at Black Hat.
- Every one of the 32 network devices or configurations tested by researcher Malcolm Stagg was vulnerable to a newly disclosed class of connection-hijacking attacks called NatJack.
- Microsoft and Linux maintainers have both issued patches in response to the NatJack findings.
- A Microsoft executive argued at Black Hat that monthly patching cycles are too slow for the pace at which AI now helps criminals find and exploit security flaws.
- An open-source detection tool called GitHub Threat Detector, released at the conference, offers 30 built-in rules for spotting software supply-chain attacks.
Black Hat and DEFCON, the twin security conferences held in Las Vegas each summer, drew thousands of researchers, corporate defenders and government officials last week. This year's event, first covered in depth by CSO Online, had two overriding themes: artificial intelligence as both a powerful defensive tool and a fresh target for criminals, and the growing fragility of security assumptions that organisations have trusted for years.
Here is what happened, and why it matters outside the conference hall.
How did criminals use AI tools against ordinary users?
Researchers at security firm Zenity uncovered a campaign in which criminals uploaded booby-trapped AI "skills" to a public marketplace called skills.sh. AI skills are small instruction files that tell AI assistants how to interact with other software; think of them as plug-ins for AI systems.
The fake skills pretended to be two legitimate, popular tools: Paperclip and Browser Use. Users who downloaded them got malicious software instead. More than 1.7 million downloads happened in less than a month.
Zenity described this as part of a broader pattern they call AI software supply-chain attacks, where criminals slip poisoned components into the digital shelves that developers and businesses browse when building AI-powered products.
If your organisation uses AI tools built from third-party components, ask your technology team which marketplaces those components come from and whether any vetting process exists before installation.
Should businesses be worried about their network devices?
Yes, particularly if they have not applied recent patches. Malcolm Stagg, an independent researcher working with the Synack Red Team, disclosed a new family of attacks he named NatJack.
The target is a technology called Network Address Translation, or NAT, which almost every office router and firewall uses. NAT was originally built to conserve internet addresses, not to act as a security barrier, but many organisations have come to rely on it as an invisible shield that keeps internal devices off the public internet.
NatJack can punch through that shield. An attacker could use it to hijack active connections, feed poisoned responses to DNS lookups (DNS is the system that translates website names into addresses your computer can reach), or knock devices offline entirely. No special access to the target network is required.
| Scope | Detail |
|---|---|
| Products tested | 32 devices or configurations across multiple vendors |
| Vulnerable products | All 32, to at least some NatJack techniques |
| Patches issued | Microsoft and Linux maintainers, following Stagg's disclosure |
| Attack capability | Connection hijacking, DNS poisoning, denial of service |
Both Microsoft and the maintainers of Linux, the operating system that runs the majority of the world's servers, have now released patches. Applying those updates promptly is the single most direct response available.
How did AI change the picture for security defenders?
Two talks offered complementary answers. Microsoft's David Weston argued that AI now lets criminals find software flaws and build attack tools faster and more cheaply than before, meaning the old assumption that defenders have weeks to respond after a flaw is discovered no longer holds. He called for software to be written in programming languages, such as Rust, that are harder to exploit, and for automated patching rather than the traditional monthly update schedule.
Separately, PortSwigger researcher James Kettle demonstrated that AI can do genuinely original security research, finding hundreds of real HTTP request smuggling vulnerabilities (a technique where criminals send confusing instructions to web servers to intercept other users' traffic). Kettle's key finding: AI works best when a human expert designs the approach, filters poor results and keeps the AI focused. Left fully autonomous, it underperforms.
For defenders, that is a practical takeaway. AI tools are worth using, but they need a human hand on the wheel.
Common questions
Do I need to do anything right now?
If your organisation uses Microsoft products or Linux-based servers, check with your IT team that the latest patches covering the NatJack flaw have been applied. If your business uses any AI-powered tools assembled from third-party components, ask where those components come from.
Could employees accidentally install something harmful?
Yes. The 1.7 million downloads of malicious AI skills show that users often cannot tell a fake tool from a real one when both appear on the same marketplace. Brief your staff on checking with IT before installing any new AI tool or plug-in, however legitimate it appears.
