Key Takeaways From Black Hat 2026: AI Supply Chains, NatJack, and Telemetry

Discussions at Black Hat USA 2026 in Las Vegas made one reality plain: defensive security paradigms designed around monthly patch cycles and passive network boundaries are failing under the weight of AI-driven exploit engineering and novel attack vectors. From malicious instruction sets targeting autonomous agent frameworks to systemic flaws in network connection tracking, the research presented this year underscores a shift toward higher-durability engineering and proactive behavioral telemetry.

A central theme across several briefings was the expanding footprint of autonomous AI agents and the fragile infrastructure supporting them, alongside fundamental flaws uncovered in legacy network protocols long trusted to maintain private connectivity.

AI Attacks Target Agentic Supply Chains

The rapid adoption of AI agents has created a new software supply-chain attack surface centered around “skills”—instruction and configuration files that dictate how AI agents interface with external tools and APIs. Research presented by Zenity exposed a large-scale malicious campaign targeting skills.sh, a popular public repository for AI agent tools.

Attackers uploaded trojanized skill files that used typosquatting tactics against popular AI tools, including Paperclip and Browser Use. Before discovery, these malicious skills were downloaded more than 1.7 million times in less than 30 days. Once integrated into an agent’s environment, the compromised skills allowed attackers to manipulate agent actions, hijack tool execution, and exfiltrate data.

Complementing this finding, Microsoft’s David Weston delivered a keynote emphasizing that defensive posture must adapt to an environment where AI accelerates vulnerability discovery and exploit development. When exploit development becomes computationally trivial, reactive patching cannot keep pace. Weston argued that defenders must shift toward structural durability—such as transitioning codebases to memory-safe languages like Rust, using AI-assisted engineering to harden existing code, and automating remediation workflows rather than relying on traditional monthly update schedules.

Deep Dive: The NatJack NAT Vulnerability

Enterprise networks have long operated under the implicit assumption that Network Address Translation (NAT) provides a baseline boundary by keeping private IP addresses non-routable from the public internet. Research by Malcolm Stagg, an independent researcher affiliated with Synack’s Red Team, dismantled that security assumption with the disclosure of NatJack.

NatJack represents a class of attacks that directly manipulate NAT connection tracking (conntrack) tables. Unlike legacy network hijacking techniques that relied on Layer 2 IP spoofing or required the attacker to reside within the local broadcast domain, NatJack can be executed remotely across network boundaries.

Key capabilities demonstrated by the NatJack technique include:

• Connection Hijacking: Intercepting and taking over established, active TCP/UDP sessions passing through the NAT gateway.
• DNS Response Poisoning: Injecting malicious responses into outbound DNS resolution queries without local network access.
• Denial of Service: Disrupting session tables to drop legitimate traffic across entire enterprise egress points.

Stagg tested 32 distinct commercial and open-source NAT implementations across multiple major networking and operating system vendors. Every single product and configuration tested was vulnerable to at least a subset of the NatJack attack suite. In response to the findings, both Microsoft and Linux kernel maintainers have released patches to address connection tracking table manipulation.

Leveraging GitHub Telemetry for Supply Chain Defense

While software supply chain attacks continue to scale, security researchers Yossi Weizman (Microsoft) and Mor Weinberger (Echo) presented evidence that existing platform audit streams contain the raw signal needed to detect these intrusions early.

By analyzing high-profile supply chain incidents—including Shai-Hulud, Trivy, and Megalodon—the researchers identified consistent behavioral signatures, such as:

• Forged Git commit author identities.
• Release tag poisoning and unexpected tag movements.
• GitHub Actions workflow file abuse and unverified third-party action execution.
• Misuse and theft of OpenID Connect (OIDC) identity tokens.
• Post-exploitation attempt signatures aimed at erasing audit logs and commit history.

To turn these patterns into operational detections, the researchers released GitHub Threat Detector, an open-source tool containing 30 built-in behavioral rules. Operating similarly to an Endpoint Detection and Response (EDR) agent for repository infrastructure, the tool consumes GitHub webhooks, REST/GraphQL APIs, and Git metadata to surface pipeline anomalies. The authors noted that security teams implementing the tool should account for operational constraints, including rate-limited APIs, potential webhook delivery failures, and the lack of native real-time packet inspection.

Human-Guided AI Accelerates Vulnerability Research

Demonstrating the constructive side of AI-assisted security, PortSwigger researcher James Kettle introduced HTTP Terminator, a research system built to automate advanced vulnerability research without relying on full autonomy.

Kettle argued that fully autonomous AI agents often produce high false-positive rates when left unconstrained. Instead, Kettle’s methodology uses human expertise to establish the overall research strategy, filter low-confidence models, and apply deterministic code constraints to guide the model’s analysis.

Using HTTP Terminator, Kettle uncovered hundreds of active, live HTTP request smuggling (HTTP desync) vulnerabilities across internet infrastructure, successfully extracted a live API key from a major financial institution during authorized testing, and defined a novel vulnerability class named “shared-parser confusion.”

Recommended Actions

1. Deploy NatJack Mitigations: Immediately update Linux kernel instances and Windows gateway hosts to the latest patch levels addressing NAT connection tracking table handling.
2. Audit AI Agent Dependencies: Audit internal AI development environments for dependency on external skill marketplaces like skills.sh. Disallow unverified skill imports and verify instruction files for Paperclip, Browser Use, and similar tools.
3. Ingest Developer Platform Telemetry: Evaluate GitHub Threat Detector or implement native webhooks monitoring pipeline configuration changes, OIDC token requests, and release tag mutations across core repositories.