DEF CON 34

DEF CON 34 (August 6–9, 2026). Las Vegas Convention Center.

Call for content.

These are the cipher-, agent-, and encoding-relevant talks from the DEF CON 34 media archive — a curated slice, not the full program. One-line reads below; longer machine drafts are held as working notes.

Tier 1 — direct overlap with current research.

• Oleksandr Mirosh — Transformers: Dark Side of the Type — a new .NET vuln class, insecure string transformation: strings coerced into objects with no serializer. The conversion layer as attack surface, straight at the type-systems and reversible-transform work. slides
• Albert Corzo — Taming the Swarm — a deterministic agentic web-pentest system. One model wearing many hats gave perfect consistency and zero useful output; the fix was distinct roles plus a dedicated Skeptic agent. The same multi-perspective adversarial-verify shape we use in workflows. slides
• Jon Gorenflo — Throw Out the Alphabet — token-based (not character-based) Markov chains for password guessing. Token-level encoding, adjacent to the transform tool and the synthetic-corpus work. slides
• Aviv Donenfeld — LGTM: Bypassing an LLM Build Gate When Prompt Injection Fails — defeating an LLM used as a merge gate. Directly probes the verification-as-a-gate thesis. (Slides are image-only; no text summary.) slides

Tier 2 — adjacent (the cipher/encoding villages above).

• Aleksandr Krasnov — Harvest Now, Decrypt Later — purely classical attacks on PQC implementations (lattice memory corruption, compiler side channels, fault injection) against liboqs/KYBER. Quantum Village, crypto thread. slides
• Jonathan Brossard — Witchcraft Solver — automated 0-day discovery in stripped binaries via a solver pipeline. Symbolic/solver methods, formal-methods adjacent. slides
• Matteo Giordano — Beyond the Ceremony: The 2026 Passkey Attack Surface — identity and auth. slides
• Aidan Nakache — Riding for Free — breaking public-transport RFID at scale. Encoding/RF, Packet Hacking Village. slides
• Romel Marin — Lowering the Orbit — exploiting satellite protocols over SDR. Signal decoding, the transform tool's RF codecs. slides
• Benito Sauceda — Going the Distance — long-range keystroke injection over Meshtastic (LoRa). Ham Radio Village, RF. slides
• Bill Swearingen — noRecognition — fooling facial recognition with a clothing pattern. Crypto & Privacy Village. slides

Placeholder, not yet read or summarized. The agent-runtime-security cluster named in a DEF CON 34 wrap-up (Forkast) — all present in the media archive and corroborated by the article. These sit closer to our own containment and sandbox work than most of the reviewed list above, so they are worth a pass.

• Yaara Shriki — OffGuard — LiteLLM (the most-deployed open AI gateway): MCP auth bypass chained to sandbox escape and SSRF, zero credentials to full cloud compromise. slides
• Ji'an Zhou, Lei Lu — One Chain to Own Them All — CVE-2026-24747, a PyTorch weights_only bypass turning torch.load into remote compromise of vLLM, ComfyUI, and NVIDIA Dynamo. slides
• Barak Sternberg, Nevo Poran, Ron Bobrov — Your WAF Blocked Us, That Was The Exploit — WAF 403 logs and Sentry public DSNs as injection channels into debugging agents; plus a Claude network-sandbox zero-day for exfiltration. slides
• Ryan Hausknecht, Simon Maxwell-Stewart — Wrestling with a Python — breaking all three Copilot Studio defense layers (dunder filters, the Python sandbox, the LLM guardrail) to admin-level access across agent sandboxes. (.pptx, embargo copy.) slides

DEF CON 34's paid AI trainings (DCTLV2026) and how they map against our research — three of five areas covered, two gaps (artifact provenance, judge reliability): Trainings and research coverage.

Design lead: Andrew "bunnie" Huang, with the Cheeso team — Yafsec (NL lead), Delia (artwork), Wietsman (routing). The core module runs the just-launched Baochip-1x SoC in transparent plastics, "literally and figuratively transparent to facilitate user inspection and trust." SAO header for expansion.

Interaction is light-pattern exchange over QR: attendees swap patterns face-to-face. Reset is a flat panel on the lower right edge; firmware uploads over USB.

Post-conference the badge converts to a security token — browser extension for password management and TOTP, physical disassembly requires a T6 Torx. The Bird Challenge runs 42 days from the end of con at bird.cheeso.io.

Sources: defcon.org/34b (official page); DEF COIN 34 Badge — Bunnie Huang (DEFCONConference video team).

Prioritized by relevance to the transform tool and reversible pipeline research:

• DC34 Call for Content
• Transform tool – decode badge ciphers interactively
• Reversible Pipeline Transforms – the theory