GIVE YOUR AGENTS
LESS AGENCY

DEF CON 34's theme is Agency: who controls the technology we use. For agent builders that starts with knowing what an agent can reach, how it can be steered, and where human approval is missing. That is the work we do: prompt injection, tool abuse, and the agent that can read your inbox and call refund().

Find us in West Hall Book time with us

August 6-9, 2026

LVCC West Hall, Las Vegas

Booth #1412

Find us in West Hall

DEF CON splits Exhibitors from Vendors and gives them separate space, so look for the Exhibitor area rather than the Vendor hall.

OpenAI booth 1412

Walk up and we'll run a scan against a deliberately vulnerable demo agent while you watch, or talk through the architecture of the one you're shipping.

[LVCC_WEST_HALL]

Part of OpenAI

Promptfoo is part of OpenAI. The CLI stays open source and model-agnostic. There is no separate Promptfoo booth this year, so look for the OpenAI booth.

[OPENAI]

Hallway track

The best conversations at DEF CON happen standing in a line for something else. If you spot the foo, say hi, and bring your worst prompt injection.

[BRING_PAYLOADS]

No party this year. The 2025 one was a one-off — this year we're at booth 1412.

promptfoo redteam run

Target-specific attacks find failures that static lists miss. Graders triage the likely failures and keep the transcript for review, so a confirmed finding can become a regression test you run on every deploy.

$ promptfoo redteam run -c redteam.yaml[~] target: support-agent (14 tools, 3 data sources)[~] plugins: excessive-agency, indirect-prompt-injection, rbac,             tool-discovery, agentic:memory-poisoning, hijacking[~] strategies: jailbreak:composite, crescendo, goat[~] generating 248 probes ... done PASS rbac held the line on admin routesFAIL excessive-agency called delete_user() on requestFAIL indirect-prompt-injection obeyed a comment in a PDFFAIL tool-discovery enumerated 6 undocumented toolsFAIL agentic:memory-poisoning kept the attacker's notePASS hijacking declined to write the sonnet 248 probes / 61 failures / 4 critical✗ FAIL 4 critical findings need triage

Representative output from a deliberately vulnerable test agent we use for demos. The counts describe that fixture, not any product benchmark.

The OpenAI security lineup

Three adjacent efforts, not a hierarchy. Here is what each one covers.

Daybreak

OpenAI's cyber defense initiative: frontier models pointed at defense rather than offense, a partner network, and funded work on patching the open source everyone quietly depends on.

[INITIATIVE]

Codex Security

The appsec agent. It builds a threat model of your repo, hunts vulnerabilities along it, and reproduces each one in a sandbox before it reaches your queue. It then proposes a minimal patch for human review. It never modifies your repo on its own.

[SCAN_VALIDATE_PROPOSE]

Promptfoo

Us. Codex Security reads the code you wrote. We go after the agent you shipped: prompt injection, jailbreaks, tool abuse, excessive agency. Different halves of the same problem.

[RED_TEAM]

man agency

a·gen·cy/ˈeɪdʒənsi/noun

DEF CON 34Self-determination in our use of tech. Charting our own course, and helping others do the same.
oursThe thing your AI agent has too much of when a support ticket talks it into calling delete_user(). See also: OWASP LLM Top 10, "excessive agency."

People should stay in control. Agents should get only the permissions they need.