AI agents are rapidly becoming the cybersecurity industry's next major attack surface. The problem is that security teams are still figuring out how to control them.
A new State of AI Cybersecurity 2026 report, released ahead of [un]prompted II in San Francisco, illustrates the growing disconnect. Of 490 talks submitted for the October conference, 71% involve AI agents, but only 12% describe production deployments or operational results. Just 8% model attackers using AI.
Those findings frame the discussions at [un]prompted II, taking place October 27–29 at The Hibernia in San Francisco. The gathering brings together researchers, security engineers, CISOs and AI practitioners confronting problems that are becoming harder to dismiss.
The central issue is no longer whether AI can discover vulnerabilities, automate attacks or perform security operations, but whether organizations can establish meaningful control over increasingly autonomous systems operating inside their environments.
AI agents are moving faster than security controls
The report compares 490 submissions for the October conference with 469 submitted for the last event in March. One of the clearest changes involves the infrastructure surrounding AI models.
Research increasingly focuses on the agent harness: the tools, memory, permissions, execution environments and integrations that determine what an agent can actually do.
- Submissions explicitly mentioning the harness increased from 19 in March to 94 in October. Broader research addressing that infrastructure grew from 34% to 42%.
- Submissions addressing attacks against the harness increased from 12 to 33, including malicious MCP tools, poisoned plugins and skills, memory manipulation and sandbox escapes.
- Meanwhile, prompt injection declined from 23% of submissions in March to 18% in October. That does not mean the problem is disappearing. It suggests researchers are moving beyond individual malicious prompts to examine the broader infrastructure that determines whether an attack succeeds.
AI vulnerability discovery is outpacing remediation
The report identifies another imbalance that should concern security leaders.
- Ninety-two submissions address AI-assisted vulnerability discovery, compared with 55 focused on patching or remediation. Fewer than 10 describe getting fixes merged and deployed at scale.
- AI is becoming increasingly effective at finding security problems. The operational capacity to resolve those problems is not keeping pace.
- That threatens to intensify an already difficult vulnerability-management challenge. Security teams could face growing volumes of AI-generated findings without corresponding improvements in validation, prioritization and remediation.
The October agenda addresses that problem directly.
Taesoo Kim's presentation, From DARPA AIxCC to Microsoft FORGE Lab, examines how autonomous vulnerability discovery and repair can move from research competitions into production environments.
Meta's David Molnar will discuss how the company is using AI to transform secure software development, including automated discovery, fixing and prevention.
Both sessions address a question that matters far more than the number of vulnerabilities an AI system can identify: Can the technology consistently help organizations reduce exploitable risk?
Where is the evidence of AI-powered attacks?
The report also exposes a striking gap between industry expectations and documented adversary activity.
- Although 46% of submissions are offense-led, only 39 explicitly model attackers using AI. Of those, 33 involve demonstrations, simulations or proofs of concept.
- Only 14 submissions mention threat intelligence, and just two cite a public threat-intelligence report.
- That does not mean malicious actors are avoiding AI. It means the research submissions provide limited direct evidence of how attackers are using it in operational environments.
The October program includes presentations aimed at closing that gap:
Google researchers Rik Dolfing and Reef Ettedgui will present Pandora's Dir – Hope at the Bottom of ../, drawing on investigations of exposed attacker infrastructure to examine real-world malicious AI adoption. Their abstract describes AI-enabled criminal activity, exposed API keys and examples of attackers incorporating AI into their operations.
Eyal Sela of Gambit Security will present The Death of TTPs – Fully Autonomous Cyber Attacks in the Wild, describing an investigation into autonomous attacks affecting multiple organizations.
These presentations offer something the industry urgently needs: observations that can be examined and challenged, rather than speculation about what AI attackers might eventually accomplish.
Gadi Evron, Knostic and the push for a practitioner-first conference
The conference's emphasis on practical research is no accident.
Gadi Evron, co-founder and CEO of Knostic, serves as co-chair of the [un]prompted call for papers alongside DEF CON founder Jeff Moss. Their program committee includes researchers and security practitioners drawn from across the industry, with CFP leads Ryan Moon, Aaron Zollman and Knostic co-founder Sounil Yu.
The organizers have established a clear expectation for submissions: Bring architecture, metrics, failures, lessons learned and code. Marketing presentations are not the point.
Evron has spent years building cybersecurity communities around research, information sharing and practical problem-solving. That experience is reflected in [un]prompted's approach to AI security: Give people doing the work a place to explain what succeeds, what fails and what other practitioners can learn.
Knostic's involvement also extends beyond Evron's leadership. The company is a sponsor of the event, helping support the gathering while its leadership participates in the technical program.
Evron is scheduled to deliver opening remarks and join reverse engineer John Cartwright for Auto-Exploiter by Use of a Ratchet Loop, Code Understanding, and… Haiku.
Their presentation examines an exploit-generation system built using Anthropic's Haiku model, including unsuccessful approaches and the difficulties of getting smaller models to perform complex exploitation tasks.
Evron will also debate former SolarWinds CISO Tim Brown about whether traditional security controls can withstand autonomous agent swarms. That will be one of three debates Oct. 28 at 9:10 p.m. ET, which will be live on Youtube:
Researchers tackle agent containment, governance and real-world deployment
Several sessions on the October agenda reflect the shift from theoretical AI safety concerns to operational security problems.
The broader program examines equally difficult problems.
Rock Lambros of Zenity and Fred Wilmot of Detecteam will examine how attacker-controlled content can cross trust boundaries inside an AI context window, drawing on lessons from the EchoLeak vulnerability in Microsoft 365 Copilot.
Microsoft researchers Fatih Bulut and Anjali Mangal will describe an autonomous purple-team simulation built around the Octo Tempest attack chain. Their session abstract reports that an AI-driven red-team agent completed all 10 attack phases in approximately 45 minutes, with roughly 77% verified success and no human interventions.
Matt Suiche of Tolmo will demonstrate techniques for changing model behavior at inference time without modifying the underlying model weights.
Other sessions examine AI evaluation failures, cryptography under AI pressure, malicious agent skills, sandboxing and the security implications of embodied AI systems.
The agenda also includes hands-on activities designed to move the conversation beyond conference presentations. The AI Harness Village on October 28 will demonstrate working agent infrastructure, while the Defender's Village will focus on practical defensive approaches to automated and agentic threats.
AI security needs evidence, not another round of hype
The report's findings are not a comprehensive measurement of AI security across the industry. They reflect what researchers and practitioners submitted to one conference, and that distinction matters.
Nevertheless, the trends are revealing.
AI agents dominate the research agenda. The attack surface is expanding beyond models into the infrastructure that gives those models capabilities. Vulnerability discovery is advancing faster than remediation. Production evidence remains limited, and security standards have not yet established a common operational baseline.
For security leaders, the lesson is straightforward: AI systems cannot be evaluated solely by what their models can do. They must be evaluated by the permissions they hold, the tools they invoke, the actions they take and the consequences when those actions go wrong.
That is the challenge confronting researchers and practitioners at [un]prompted II.
The cybersecurity industry has spent years debating what AI might eventually make possible. This week's conference is about what organizations are already building, breaking and trying to defend.
And whether those defenses will survive contact with reality.
