Skip to main content
CISO Daily
Briefing

Black Hat USA 2026: The Executive Threat Briefing

7 min read
CISO Daily
Black Hat USA 2026: The Executive Threat Briefing

Black Hat USA 2026 ran in Las Vegas against a backdrop of an industry grappling with the security implications of AI infrastructure at scale. The conference produced several significant disclosures and reinforced a trend line that has been building since 2025: the tools, frameworks, and compute infrastructure that organisations are deploying for AI workloads are producing a new and largely unmonitored attack surface.

This briefing covers the three themes most relevant to enterprise risk posture and board-level conversation.

Theme 1: AI Infrastructure Is the New Perimeter — and Nobody Is Watching It

The headline finding from Oligo Security’s Black Hat presentation this year: over 200,000 Ray servers are currently exposed to the internet with no authentication. Ray is an open-source distributed computing framework that organisations use to run LLM inference, model training, and increasingly multi-agent workloads at scale. It has no built-in authentication on its API or dashboard. It was designed for trusted internal networks.

The campaign Oligo documented, ShadowRay 2.0, turns compromised Ray clusters into botnet nodes. Each newly infected cluster begins scanning for and attacking other exposed Ray deployments. The payload includes cryptocurrency miners, SSH key injection for persistent access, and systematic exfiltration. Oligo documented 240GB of compressed AI models, source code, and datasets taken from compromised environments. Cloud credentials stored in environment variables — standard practice in many ML workflows — were harvested and used for lateral movement into broader cloud tenants.

The scale figure deserves emphasis. Two hundred thousand exposed servers is not a long-tail configuration error. It reflects a systematic gap between how ML/AI infrastructure is deployed and how enterprise security teams govern it.

The governance gap: Only 23% of security leaders report full visibility into AI agents and compute infrastructure operating in their environments, according to data cited at Black Hat. Ray clusters are typically deployed by data science and ML engineering teams, not IT operations. They frequently sit outside the standard asset management scope that vulnerability scanning covers. The teams deploying them often don’t know they’re exposed, and security teams often don’t know the clusters exist.

What boards need to understand: AI compute infrastructure carries the same risks as any other internet-facing server with code execution capabilities — and considerably higher stakes because of the sensitive data (proprietary models, training datasets, customer data) and cloud credentials often present on these systems. The question to ask your CISO: do we have visibility into all AI/ML compute deployments in our environment, and do we know which of them are internet-accessible?

Theme 2: Trusted Network Infrastructure as an Attack Vector

Microsoft’s CaptiveCrunch disclosure, which preceded Black Hat but whose implications were discussed extensively at the conference, documented a Russian state actor exploiting the trust relationship between corporate travellers and hotel Wi-Fi infrastructure.

Storm-2945, a cluster attributed to Midnight Blizzard (APT29, Cozy Bear), has been systematically compromising hotel and conference venue captive portal systems since at least May 2026. When corporate travellers connect through a compromised portal, the campaign either redirects to fake Microsoft 365 login pages or delivers custom malware through fake browser update prompts.

The malware set is purpose-built: CornFlake is a Go-based remote access trojan that installs as a Windows service, captures keystrokes, screenshots, and audio, and harvests M365 session tokens. ChocoShell is a PowerShell infostealer that runs entirely in memory, leaving no files on disk, and extracts browser credentials and SSO tokens.

The strategic objective is clear: harvest Entra ID and M365 tokens that provide persistent access to cloud environments without requiring further credential theft. SharePoint, Teams, Exchange, and any integrated SaaS application becomes accessible from a single captured session token.

Why this matters for enterprises with travelling employees: The attack targets the trust model, not the technology. Travellers extend a degree of implicit trust to hotel login pages that they would not extend to a random website — and Storm-2945 exploits that trust. The captive portal experience is familiar enough that a fake “browser update” prompt during hotel Wi-Fi login feels plausible.

Immediate actions for security leaders:

  • Block device code authentication flows in Conditional Access. Storm-2945 has used OAuth device code phishing since at least February 2026; this is a controllable exposure.
  • Deploy phishing-resistant MFA for senior personnel and anyone with broad M365 administrative access. Push-notification and SMS MFA remain bypassable in the scenarios CaptiveCrunch employs.
  • Brief travelling employees — particularly those attending industry conferences — on the specific behaviour to expect: captive portals should not push software updates. If a hotel Wi-Fi page prompts a browser or OS update, do not proceed.

Theme 3: Agent Exploitation as an Infrastructure Discipline

A broader theme ran through multiple Black Hat sessions this year: the exploitation of AI agent frameworks, orchestration layers, and LLM-integrated tooling has matured from opportunistic research into what several presenters called “an infrastructure discipline.”

The ShadowRay campaign exemplifies this: it uses Ray’s own NodeAffinitySchedulingStrategy — a legitimate cluster scheduling primitive — to propagate malware across every worker node in a compromised cluster. The attack uses the framework against itself. This pattern appeared in several other presentations covering different platforms.

For CISOs, this represents a meaningful shift in the threat model. The security assumptions baked into the deployment of AI orchestration tools — that they’re internal-only, that the teams deploying them understand their attack surface, that they’re covered by existing vulnerability management — are often incorrect on all three counts.

The risk framing for the board: AI infrastructure is not an experimental category anymore. Organisations are running production workloads on infrastructure that was designed before enterprise security requirements were considered. The attack surface is real, the adversary interest is documented, and the visibility gap is large.

For the CISO:

  1. Commission an AI/ML infrastructure audit. Work with the data science and ML engineering organisations to document every deployed AI/ML framework, compute cluster, and orchestration platform. Verify which have internet-accessible interfaces and which operate under standard IT governance.

  2. Add AI compute to vulnerability management scope. Tools like Ray, Langflow, and similar frameworks typically don’t appear in standard Tenable or Qualys scans. Ensure they’re covered.

  3. Brief the travel security policy. Update the corporate travel security guidance to address hotel Wi-Fi explicitly: route corporate device traffic through mobile hotspots or enterprise VPN for any access to corporate resources. Do not rely on hotel guest networks.

  4. Review Conditional Access for device code flows. If your organisation has not explicitly blocked OAuth device code authentication, this is a straightforward configuration change in Entra ID that closes a specific Storm-2945 vector.

For the board briefing:

The question of AI infrastructure security is moving from the “emerging risk” category to the operational risk category. The 200,000 exposed Ray servers and the systematic targeting of corporate travellers are not hypothetical scenarios — they’re documented, active campaigns. The board question is whether the organisation has the visibility and governance controls in place to know whether these risks apply to it.

References