Novee Researchers to Present Four Sessions across Black Hat USA and DEF CON, Uncovering Vulnerabilities in Anthropic, OpenAI and Google
Research spotlights new attack paths affecting AI agents, coding sandboxes and enterprise Java middleware
LAS VEGAS, July 28, 2026 (GLOBE NEWSWIRE) — BLACK HAT USA, DEF CON — Novee, a leader in AI penetration testing, today announced that its research team has been selected to present four sessions across Black Hat USA 2026 and DEF CON 34.
“These sessions show that some of the most serious security failures emerge before expected safeguards take effect, or inside components organizations already trust,” said Ido Geffen, CEO and co-founder of Novee. “By examining AI systems from Anthropic, Google and OpenAI alongside widely deployed enterprise Java platforms, our researchers are giving defenders practical ways to identify the same structural weaknesses across their own environments.”
Black Hat USA 2026 Sessions:
- Trusted Enough to Run: Breaking AI Agents in Official Workflows
Date: Wednesday, August 5 | 3:35 p.m. – 4:15 p.m. (Mandalay Bay H, Level 2)Elad Meged, founding team member and security researcher at Novee, will demonstrate how trust can break down between the internal stages of official AI agent workflows, leading to supply chain compromise. Across Anthropic’s Claude Code, Google’s Gemini CLI and OpenAI’s Codex, Novee found cases where one component marked an attacker-influenced state as safe, only for another component to consume it with greater authority, leading to remote code execution in some instances. This level of vulnerability exposes “the runner’s repository token and any workflow-injected secrets” to attackers, per Anthropic’s own analysis of the vulnerability. This research highlights an often-neglected component of AI security research: the harness that translates the intent of the AI model within it. Models are often equipped with built-in safeguards, but the harnesses around them act without humans in the loop, leading to oversights that cause unintentional risk.
The session will show how these trust-handoff failures can lead to command execution, secret exposure, persistence or policy bypass. Per Google’s own analysis of the potential impact, these issues are categorized as “supply chain compromises.” Meged will provide insights into identifying gaps between validation and execution and show attendees how to strengthen the points where trusted data becomes dangerous.
- Pre-auth RCE in Enterprise Java: When Middleware Becomes the Exploit
Date: Wednesday, August 5 | 11:05 a.m. – 11:45 a.m. (Oceanside D, Level 2)Novee founding team vulnerability researchers, Lidor Ben Shitrit and Assaf Levkovich, will present multiple pre-authentication remote code execution chains found in widely deployed enterprise Java platforms. The research shows how attackers can move from exposed APIs to privileged internal surfaces via middleware that was never designed to process untrusted input. The researchers will demonstrate paths leading to unsafe deserialization and direct code execution. These include permissive XStream configurations, an ObjectInputStream path without JEP-290 filtering and a separate chain involving token trust failures and Groovy evaluation. Attendees will learn how to identify similar execution paths and harden the middleware layers that make them possible.
DEF CON 34 Sessions:
- No Prompt Required: Pre-Task RCE in Google Gemini CLI
Date: Sunday, August 9 | 10 a.m. – 10:30 a.m. (Exhibit Hall West 3 – 906)Elad Meged will examine the attack surface that exists before an AI model processes its first task. AI agents accept configuration files, environment variables and other startup inputs before prompt-time safeguards activate. In headless CI/CD environments, those inputs may be trusted automatically and can reach execution before the sandbox starts. The session’s flagship case is a deterministic exploit in Google’s Gemini CLI that Google’s security team scored CVSS 10.0, and has since patched. It requires no model interaction. Attendees will learn how to identify pre-task inputs, determine the authority each one carries and test whether that authority can reach execution or disable security controls.
- The Sandbox Is a Suggestion: Deconstructing AI Agent Sandboxes
Date: Friday, August 7 | 4 p.m. – 5 p.m. (Exhibit Hall West 3 – 1006)The session will compare the containment systems used by Anthropic’s Claude Code, Google’s Gemini CLI and OpenAI’s Codex CLI. Each product takes a different approach to enforcement. Researcher Elad Meged found that each also depends on a structural assumption that the runtime can violate. The session will demonstrate how those containment mechanisms fail through design gaps rather than prompt injection or model persuasion. Attendees will leave with a practical methodology for evaluating any AI agent sandbox: understand what it claims to enforce, identify the assumption behind that enforcement and test whether the real execution path breaks it.
Meet The Team
Interested in learning how Novee applies its offensive security research to continuously improve its AI penetration testing platform? Meet Novee’s team at Booth #5323 August 1 – 6 at Black Hat USA. To schedule a more in-depth discussion with the co-founders, visit: https://lp.novee.security/meet-us-at-blackhat/. Not attending Black Hat? See a live demo of Novee’s AI penetration testing platform: https://novee.security/demo/.
About Novee
Novee is the AI penetration testing platform built to secure constantly changing environments against attackers operating at machine speed. Its purpose-trained AI reasons like a real attacker, uncovers novel attack paths continuously, and delivers precise, personalized fixes so teams can stay one step ahead of hackers. Founded by national-level offensive security leaders Ido Geffen, Gon Chalamish, and Omer Ninburg, Novee has raised $51.5 million within four months of its inception from leading investors including YL Ventures, Canaan Partners, and Zeev Ventures. Learn more at novee.security.
Media Contact
Sherlyn Rijos-Altman
Montner Tech PR
srijos@montner.com
