5 Key Takeaways From Black Hat USA 2026
TechTarget, Tuesday, August 19th, 2025
Malicious AI 'skills' hit 1.7 million downloads, and reactive patching is losing to AI-speed bug discovery.
Microsoft used Black Hat USA 2026 to argue that reactive patching cannot keep up as AI accelerates vulnerability discovery, pushing instead for memory-safe languages and automated remediation.
Researchers reported more than 1.7 million downloads of malicious AI skills from a marketplace, an emerging supply chain attack vector aimed squarely at AI agents. Another session showed how GitHub event streams and APIs can surface supply chain intrusions through behavioral patterns, supported by an open-source GitHub Threat Detector tool.
A recurring theme was that the most effective AI-driven security research still depends on human expertise setting the methodology, illustrated by PortSwigger's HTTP Terminator finding novel vulnerabilities.