At DEF CON 34, a security researcher whispered a prompt into a coding agent's context window, and within ninety seconds, the agent had silently copied a developer's SSH key into a log message that appeared completely harmless. Across the venue, another team corrupted a model weight file that passed every validation check, then turned a production inference server into a token-stealing zombie. A third team used an observability dashboard to read the internal state of a financial AI agent: every tool call, every hidden deliberation, every credential sitting in memory.
By the end of the conference, independent research streams had converged on a conclusion that should terrify anyone building on this stack: the AI agent ecosystem doesn't have a bug problem. It has a trust problem. And no firewall, WAF, or 'agent shield' is going to fix that.
Let me translate this into the language I know best. After the 2022 bear market, I spent months auditing dead DeFi protocols. I kept seeing the same autopsy: a 'decentralized' protocol that had quietly concentrated power in a multi-sig, a privileged admin key, or a governance contract that no one actually read. The developers didn't intend to build a honeypot — they intended to ship fast. The result was an invariant: centralized control, external consequences.
Today's agent stack is that same autopsy, repeated at machine speed. We have coding agents like Claude Code, Gemini CLI, and Codex CLI holding the keys to repositories and cloud consoles. We have gateways and orchestration layers like LiteLLM and LangChain routing prompts and tool calls across untrusted boundaries. We have model serialization formats in PyTorch and vLLM that can hide malicious payloads inside innocent-looking weights. We have low-code platforms like Microsoft Copilot Studio that let business users assemble these weapons without understanding them. And we have observability platforms like Sentry collecting every sensitive detail — making them the perfect exfiltration target.
Five years ago, we had the same problem in DeFi. The difference is that DeFi had at least an intellectual commitment to decentralization. AI agents, by default, are designed as centralized servants, not sovereign actors. That is the root cause.
The Reentrancy Remix
Take the most famous vulnerability in blockchain history: the reentrancy attack that drained a DAO in 2016. An external contract calls back into a vulnerable contract while funds are still in flight. The vulnerable contract assumes the external call is harmless. It isn't. With AI agents, we are reenacting that 2016 bug in every single prompt injection.
Here's the pattern. An agent receives a request from an untrusted source — an email, a webpage, a Slack message, a tool output. The agent treats the content as data. But content is code. If the content contains instructions that the agent's reasoning loop decides to execute, you have reentrancy: the attacker has entered the agent's flow before the agent has finished its own.
In my audits, I learned to look for 'external call' patterns. You have to ask: who controls the callee? Who controls the arguments? What happens if the call fails? The agentic stack has the same checklist, but no one is enforcing it. Every tool call is an external call. Every model completion is an external call. Every MCP server connection is an external call. We don't have an agent-aware firewall that knows the difference between legitimate orchestration and an attacker's shadow narrative. We have prompts and prayer.
MCP Is the New RPC
The Model Context Protocol is the loudest solution in the room. It's designed to let agents talk to tools, databases, and other agents. It is elegant. It is also the new RPC.
And we know what happens with RPC: developers assume endpoints are authenticated, but they rarely check. They assume the server will never be malicious, but it's usually an open box. They assume a response is trusted, but a response is just data, and data lies.
At DEF CON 34, MCP was the connective tissue in nearly every attack chain. An attacker doesn't need to be inside the agent's brain. They just need to control one MCP server the agent trusts. From there, they can manipulate data, steal credentials, and change decisions. Researchers showed how a poisoned MCP server could alter the final answer of a financial analysis agent without being detected. There is no nonce, no signature, no audit trail tying each MCP response to a verified origin. It's an open invitation.
OWASP finally published an MCP Top 10. If you read it, you'll see items like path traversal, malicious server behavior, and unauthorized tool invocation. These are not exotic attacks. These are the same classes of problem we solved in web APIs a decade ago. But because agents are autonomous, the exploit radius is a thousand times larger.
Model Weights Are the New Corrupted Package
Here's the part that keeps me up at night. We spent the last decade teaching developers to check a package for integrity — but we still treat model weights as if they were downloaded from an oracle.
In a demonstration at DEF CON, a malicious model file passed every validation check and then executed code after deployment inside vLLM. This is not a toy. This is how supply chain attacks become institutionalized. You think you're running an open-source model with open weights. But weights are code. They carry latent instructions that can be triggered by the right prompt, or by a deserialization function that executes a hidden object.
Every machine learning engineer needs to ask the question I used to ask of DeFi liquidity pools: where is this asset coming from, and what happens if it isn't what it claims to be? If you can't answer with a cryptographic hash and a signed provenance record, you don't have an asset — you have a liability.
The same goes for inference stacks like NVIDIA Dynamo and ComfyUI. They abstract away the complexity of serving models, but abstraction hides trust assumptions. A corrupted weight file is the equivalent of a smart contract upgraded by an anonymous admin. It looks the same externally, but the behavior is completely different.
Observability Is the New Exfiltration Highway
Security leaders love to add observability. They want to see every tool call, every token, every agent decision. But observability is double-edged.
We are building centralized dashboards that contain the crown jewels: prompts, context windows, tool calls, secrets, user data. At DEF CON, researchers demonstrated how a malicious agent could exfiltrate data through an observability platform — using the very tool built to monitor the agent as the delivery vehicle. It's like hiring a surveillance company to protect your house and discovering they left the back door unlocked for burglars.
Organizations like Cloudflare and Sentry are not evil. But they are centralized honeypots. Every token of context you pipe through them is another attack surface. We are aggregating exactly the kind of data an attacker wants, and then we are giving agents the ability to query that data in real time.
The Meta-Failure: Bolting Web2 Firewalls onto Web3 Actors
Now comes the layer of irony that only a crypto person can appreciate. The security industry's response to these agent failures is to launch yet another centralized guardian: Wiz Agent Shield, Prisma AIRS, BeyondTrust, Tenet Security, Novee Security. They promise to watch the agent, filter the prompt, block the injection. They are building firewalls for the agent economy the way we built firewalls for TCP/IP.
But an agent is not a packet. An agent makes decisions over time, in a stateful loop, with credentials that can be used outside the firewall. A prompt injection can hide in a tool result that was 'legitimate' a minute earlier. A malicious model file doesn't need to beat the classifier; it just needs to survive after the classifier runs.
The deeper problem is that these tools preserve the architecture of failure. They put a guard at the door of a building where the walls haven't been poured. They don't solve attribution, provenance, or consent. They re-centralize security into a vendor that has more access than the agent itself — which means the vendor becomes the next target.
The Information Gain: Attestation, Not Prediction
Here is the insight that most security reports miss. The industry keeps asking how to block attacks. The right question is: how do we make attacks visible and repudiable? In Web3, we solved a version of this problem with private key signing and smart contract invariants. We need to apply the same to agents.
Imagine an agent that carries a verifiable identity, perhaps an on-chain registration or a signed certificate. Every tool call is accompanied by an attestation: 'I am agent 0x..., running model hash sha256..., invoking tool X with argument hash Y, on behalf of principal Z.' That attestation is written to an immutable ledger. If a caller wants to dispute a decision, they can replay the trace. If an attacker tries to inject amnesia, the ledger exposes the contradiction.
This isn't science fiction. We have zero-knowledge proofs, threshold signatures, and Merkle trees. The building blocks already exist. The reason they aren't in the agent stack is not that they are too heavy — it's that no centralized vendor wants to give users the ability to verify without permission.
Notice what this does: it changes the attack model from 'keep the attacker out' to 'make the attacker accountable.' Prompt injection becomes a forensic event, not a silent tragedy. Model corruption becomes a provenance violation, not a hidden backdoor. MCP server manipulation becomes a signature failure, not a blurry warning. We don't need perfect security; we need perfect attribution.
The Contrarian Angle: The Attacks Are Real, But the Solution Isn't Another Shield
Let me play devil's advocate, because I don't want this to become another hype panic. Is the attack chain at DEF CON 34 representative of real-world exploitation in the field today? Partially. Conference demonstrations live in a curated environment. They choose the victim model, the agent configuration, and the failure mode. They don't show the hours of grinding against hardened deployments.
That caveat matters. But it doesn't matter as much as the vendors want you to believe. The reason the attacks converge across different teams and different stacks is that they are structural, not incidental. You cannot prompt-fix a missing signature. You cannot WAF-away a deserialized payload. You cannot SOC-fill an underlying trust gap. Every security control added on top of a trustless foundation is just a delay, not a defense.
Here's the contrarian take that will upset both AI maximalists and AI doomists: the vulnerability chain doesn't prove that agents are worthless. It proves that we are building agents with the wrong philosophy. We are building centralized agents with privileged access and no accountability, then expecting perimeter security to save us. That is not an engineering problem. That is a power problem.
The pragmatist will say: but the market wants agents now. I get it. I built communities with the same urgency in 2017 and 2021. I know what it feels like to ship before you understand the consequences. But shipping without accountability is not shipping; it's gambling with other people's money, other people's data, and other people's freedom.
Real-world agent security is not about adding a classifier. It is about making the agent's actions publicly verifiable. Every tool call should be signed. Every credential should be scoped to least privilege. Every model artifact should have cryptographic provenance. Every decision trace should be auditable — not just by a security team, but by the people affected by the decision.
Takeaway: The Agent Era Will Be Messy, But It Doesn't Have to Be a Betrayal
I've seen this cycle before. In DeFi, we learned the hard way that code is not law unless the code can be verified by the community. In AI agents, we will learn the same lesson. The DEF CON 34 disclosures are not the end — they are the beginning of a reckoning. The agents that survive will not be the ones with the best guardrails; they will be the ones that refuse to let a single central authority turn 'I'll protect you' into 'I own you.'
We don't need another red team report to know the current architecture is broken. We don't need another agent shield that watches the henhouse while carrying the fox. We need an architecture where trust is distributed, verified, and revocable.
Freedom isn't a firewall rule. It's built by our shared vision.
