AI4 and Black Hat opened in Las Vegas on the same day. One room showed agents finishing work. The other asked who gave them credentials, what they touched, and how the damage gets reversed. By the end of the week, the security side had started assembling an answer in open tools.
One week connected adoption to failure
AI4 runs August 4–6 at the Venetian with a large enterprise-AI program. Black Hat’s AI Summit took place August 4 at Mandalay Bay, followed by technical briefings on agent credentials, autonomous shopping, model behavior, and security assumptions.
The events are not a joint conference. They are a useful joint reading list. Any buyer watching an agent demo at AI4 should carry the questions being asked at Black Hat, especially after OpenAI disclosed new third-party cyber evaluation incidents on August 4.
One Las Vegas week, three layers
Official schedules and announcements checked August 5, 2026.
Enterprise adoption, agents, models, data, infrastructure, and implementation.
Executive discussion about how AI changes attack, defense, governance, and risk.
The Open Secure AI Alliance outlined practical contributions spanning identity, isolation, scanning, testing, policy, and audit.
The agent demo has an invisible second half
A normal stage demo shows the happy path. An agent reads an email, opens a customer record, updates a spreadsheet, buys an item, or changes code. It looks efficient because identity, access, secrets, logs, and recovery have already been arranged offstage.
The security version begins when one input is hostile. A document can contain prompt injection. A website can redirect the agent. A compromised account can supply a plausible but wrong instruction. A tool response can be valid data and still trigger a harmful action.
This is why a model refusal is not a permission system. The model may refuse a dangerous prompt most of the time. The surrounding software must still prevent an allowed tool from reading every secret, reaching every network, or sending money without confirmation.
Five questions every buyer should ask
The five-question AI agent security scorecard
A pilot is incomplete until each answer includes evidence.
Which account acts, what can it reach, and how is access narrowed for this task?
Where are credentials stored, exposed, rotated, and blocked from model output?
Can an operator reconstruct the prompt, tool call, approval, result, and actor?
Can the team stop and reverse a bad change without rebuilding the system?
Which prompts, files, outputs, and telemetry leave the company, and for how long?
An agent acting as a shared admin account can bypass every role the company designed. Secrets can leak through prompts, tool output, debugging traces, or generated code. Logging can help an investigation and become a second pile of sensitive data. Rollback can sound reassuring until the action was an external email, permission change, purchase, or production deployment.
The Open Secure AI Alliance is turning questions into components
NVIDIA says the Open Secure AI Alliance now includes more than 120 organizations working on open technologies for AI and software security. Its latest contribution summary matters because it is not one magic “agent firewall.” It is a set of layers that can answer different parts of the scorecard.
An open control stack for agents
Representative contributions named by NVIDIA; availability and maturity vary by project.
The most practical idea may be verified agent skills. NVIDIA describes skills scanned for prompt injection and tool poisoning, cryptographically signed, and accompanied by a skill card. That does not make a skill harmless, but it gives teams provenance and something stable to review before an agent loads new behavior.
OpenShell attacks a different layer: runtime authority. It can restrict the agent’s view, tools, filesystem, and network behavior even when the model makes a bad choice. That is stronger than hoping the model remembers a sentence from the system prompt.
How to turn a conference demo into a safe pilot
Give the agent one narrow job, fake or low-risk data, and a sandbox identity. Remove broad network access. Add human confirmation before external messages, purchases, deletion, permission changes, or deployment. Then place hostile instructions inside a document, web page, and tool response.
Record not only whether the model resisted. Record what the system prevented. Our updated report on the OpenAI cyber evaluation incidents shows what happens when intended scope and enforced scope disagree. Our guide to AI coding chat exposure shows how identities, tokens, and logs become part of the attack surface.
- Run the demo once with the expected input, then once with an injected document.
- Use a short-lived account that cannot reach production or unrelated customer data.
- Require an operator approval for irreversible or external actions.
- Export the complete audit trail and ask another person to reconstruct the run.
- Trigger the stop control and prove the environment closes network and tool access.
- Reverse one realistic change, then measure what could not be undone.
My read: the best demo now includes the control stack
AI4 and Black Hat are asking different halves of the same production question. AI4 is right to focus on adoption. Black Hat is right to attack the assumptions. The Open Secure AI Alliance is useful when its projects let a buyer connect the two with evidence.
An agent that can complete ten steps is interesting. An agent that can show which identity it used, why a step was allowed, what left the system, when it stopped, and how the change was reversed is deployable. The interruption, audit trail, and undo path should no longer be the boring appendix to the demo. They are the demo.
Go deeper
- Review the official AI4 2026 program.
- Browse the Black Hat USA technical briefing schedule.
- Read NVIDIA’s Open Secure AI Alliance announcement.
- Review NVIDIA’s map of new alliance security contributions.
- Explore Garak and OpenShell before choosing a test or isolation layer.
Which part would your current agent demo fail first: identity, secrets, logs, rollback, or data movement?
Updated August 5, 2026. Event dates come from organizer schedules; alliance membership counts and tool descriptions are organization-reported and should be verified against each project before deployment.
