I spent DEF CON 34 bouncing between the talks from the AI Village, Adversary Village, and main tracks. Almost every talk I sat in on had a similar throughline: agents attacking, agents getting attacked, and agents standing between an alert and the human who has to decide whether to trust it. I took notes for each talk, cleaned them up,  and here they are as starting places for folks who didn’t get to attend.

Each linked post below includes a write-up: the talk’s own abstract, speakers, source links, and my notes. There is also a “download as Markdown” link at the top if you want the raw file for your own vault or to hand to an agent as context. All 15 raw notes also live in one place on GitHub: github.com/bryancowan/defcon34-notes

The Talks

1. A Billion-User Blast Radius — Owning ChatGPT’s Secure Sandbox — chaining spreadsheet-parsing abuse, Jupyter reasoning-channel hijacking, and a JFrog rate-limit covert channel to break out of and exfiltrate data from ChatGPT’s sandbox.
2. AI Pipeline for N-days Weaponization — a 14-agent pipeline that goes from a bare CVE ID to a working exploit and defense report in under an hour, with zero public PoC required.
3. AOBTD — AI-Driven DAST Scanner — a DAST scanner that understands the target app before firing payloads, using specialist LLM agents instead of blind fuzzing.
4. Automated Discovery of Prompt Injection Vulnerabilities via Mutated Prompt Generation — a mutation framework that generates adversarial prompt injection variants to map how much of your attack surface is actually covered by a fix.
5. Can AI do Novel Security Research — can an autonomous system invent genuinely new HTTP desync attack techniques, not just find known bugs?
6. Evading LLM Detection — how OKX built an LLM-based malicious-code scanner for their crypto supply chain, and the failure modes attackers use to evade it.
7. Hacking the Human-in-the-Loop — how attackers manipulate SOC analysts into slowly poisoning their own AI detection baseline through dismissal campaigns.
8. Overcast — Video OSINT Agent — a CLI agent that turns hours of video footage into cited, searchable OSINT evidence.
9. Pwning Agentic Browsers with PleaseFix — compromising agentic browsers (Comet, Atlas, Claude for Chrome) via intent collision, browser-history poisoning, and localhost pivoting.
10. Reconstructing Red Team Engagements — Developing Your Own Red Agent — a multi-agent system that automates the tedious post-engagement retest/validation workflow between red and blue teams.
11. Remote Badge Cloning with the Flipper Zero — long-range RFID badge cloning hardware you can build in a day, plus a Flipper Zero decoder script.
12. This Wasn’t AI Generated — Principles for Breaking Generative Watermarks — two attacks that reliably strip Google’s SynthID watermark from AI-generated images.
13. Vibe Coding Your Way to a Fully Functional Open-Source Intelligence Platform — a hands-on workshop building a real-time 3D-globe OSINT platform from scratch with AI coding agents.
14. X-Ray Your Agents — Pentesting MCPs, Skills, and the Plugin Supply Chain — a security scanner that ports classic pentest tradecraft to MCP servers, Claude skills, and agent plugins.
15. Zealot — An Autonomous Cloud Offensive Multi-Agent System — a multi-agent framework that autonomously chained recon through data exfiltration against a live GCP sandbox, no human in the loop.

All 15 are also tagged defcon34, so you can pull the whole set from bryancowan.com/tag/defcon34 any time.

Filed Under: #defcon34