DEF CON 34 wrapped August 9. And this year, the community answered a question the security world has been dancing around for two years: can autonomous AI hack real systems without a skilled human driving it?
Yes. And the models that power it are free to download.
What HALctf Was
The AI Village — the longstanding DEF CON community group focused on AI and security — introduced HALctf this year: the Hostile Autonomous Layer CTF. The first competition of its kind. Participants build an AI agent, package it as an OCI container, and deploy it against sandboxed challenge targets. Then they walk away. The agent scouts, probes, exploits, and captures flags on its own. No human touches the keyboard during the actual run.
The rule that defines the threat model: only open-source models allowed. No routing traffic to a commercial API provider. Whatever model the agent uses, it runs locally.
That constraint was the whole point. The AI Village built HALctf specifically to test how far small, locally-runnable models can push autonomous attack capability — as opposed to frontier systems that cost money and have content restrictions. First place prize was a DGX Spark personal AI supercomputer, which tells you where the winners are expected to take this research next.
The Week Before: Black Hat Proved Novel Attacks Are Invented, Not Just Found
While HALctf was running, the research that came out of Black Hat (which ended August 6) was working its way through the security community.
PortSwigger researcher James Kettle presented HTTP Terminator — an AI-assisted autonomous system that doesn't search for known vulnerabilities. It invents new attack techniques and then uses them.
The system explored 30,000 candidate HTTP desynchronization vectors, independently discovered attack techniques that weren't previously documented, and then ran those techniques against 30,000 authorized targets: banks, government infrastructure, an airport. It found roughly 700 vulnerable sites. Bug bounties paid out. The code is now public.
Not a simulation. Not a lab environment. Production systems, real money confirming real bugs.
What Changed for Your Organization
Most security conversations for small orgs assume human attackers with limited attention. People sleep. They have to pick targets. They get bored.
Autonomous agents don't have those limits.
An AI hacking agent running on cheap cloud hardware or a developer's laptop can probe your login pages, API endpoints, and web-facing services through the night, systematically, without degrading. If it hits a dead end, it reasons to a different path and keeps going. It doesn't need a skilled operator watching — the operator checks back for results later, if at all.
HALctf didn't just demonstrate this in theory. It structured it as a scored competition, with rules designed to pressure-test whether frontier AI access is necessary. The answer from the competition is no.
The same models you can pull from Hugging Face and run on consumer hardware are the same category of model being put through its paces as autonomous attackers. Both capabilities — internal automation for small teams, autonomous offensive tooling for adversaries — arrived at the same time from the same open-source ecosystem.
Practical Baseline
You defend by being a harder target to probe and exploit. Nothing exotic here — just things that specifically slow or stop autonomous reconnaissance:
Behavioral detection at the edge. Autonomous agents generate recognizable traffic: systematic parameter sweeps, consistent timing, structured request sequences. A web application firewall or IDPS configured for behavioral anomaly detection — not just signature matching — catches this. Most small teams skip the behavioral layer. Don't.
Close unnecessary attack surface. Every exposed service that doesn't need to be reachable gets probed indefinitely by automated scanners. Admin panels, staging environments, internal tools on public IPs — audit what's actually facing the internet. If it doesn't need to be there, close it.
Stay current on patches. Automated tools find known CVE coverage gaps efficiently. HTTP Terminator found hundreds of targets by systematically applying documented vulnerability classes. Being patched removes the most accessible wins from the attacker's checklist.
Segment for blast radius. When an agent gets a foothold, it pivots. If your web server and database share credentials or sit on the same flat network, a compromise at the edge becomes a compromise everywhere. Simple segmentation slows autonomous lateral movement more than almost anything else.
The Bigger Shift
For two years, the security community argued about whether open-source AI models posed a serious offensive risk or whether the guardrails on commercial systems were enough to limit dual-use. HALctf closed that debate as a community verdict, not a think-tank report.
The tools are accessible. The knowledge is being formalized and published. The techniques that win competitions become the techniques in offensive toolkits within months — that's how DEF CON research has always worked.
Small and mid-sized organizations aren't too small for automated scans. Automated doesn't mean targeted — it means everything reachable gets tried. The question is whether your systems are harder to exploit than the next org on the list when an autonomous agent reaches them.
If you want to know where your exposure sits before someone's agent finds it, that's a conversation we can make short.