GIVE YOUR AGENTS
LESS AGENCY

DEF CON 34 has ended. Its theme was Agency: who stays in control of the technology we use. We explored the same question through prompt injection, unauthorized tool calls, and an agent persuaded to call refund() without approval.

Event recap Request a demo

Conference: August 6-9, 2026

LVCC West Hall, Las Vegas

Booth #1412: Aug 7-9

DEF CON 34 recap

Thanks to everyone who visited us at DEF CON 34. The conference ran August 6-9, with booth demos August 7-9.

OpenAI booth #1412

We scanned a deliberately vulnerable demo agent and discussed how to test real-world agents for prompt injection and unsafe tool use.

[LVCC_WEST_HALL]

Keep testing

The conference is over, but the tools are still available. Follow the red team docs to test your own agent and turn confirmed findings into regression tests.

[RED_TEAM_DOCS]

Part of OpenAI

Promptfoo is part of OpenAI. The CLI remains open source and works across model providers.

[OPENAI]

Missed us in Las Vegas? Request a demo or browse all events.

promptfoo redteam run

Target-specific attacks find failures that static lists miss. Graders triage the likely failures and keep the transcript for review, so a confirmed finding can become a regression test you run on every deploy.

$ promptfoo redteam run -c redteam.yaml[~] target: support-agent (14 tools, 3 data sources)[~] plugins: excessive-agency, indirect-prompt-injection, rbac,             tool-discovery, agentic:memory-poisoning, hijacking[~] strategies: jailbreak:composite, crescendo, goat[~] generating 248 probes ... done PASS rbac held the line on admin routesFAIL excessive-agency called delete_user() on requestFAIL indirect-prompt-injection obeyed a comment in a PDFFAIL tool-discovery enumerated 6 undocumented toolsFAIL agentic:memory-poisoning kept the attacker's notePASS hijacking declined to write the sonnet 248 probes / 61 failures / 4 critical✗ FAIL 4 critical findings need triage

Representative output from a deliberately vulnerable test agent we use for demos. The counts describe that fixture, not any product benchmark.

The OpenAI security lineup

Daybreak brings together OpenAI's cyber-defense work. Codex Security tests application code, and Promptfoo tests deployed agents.

Daybreak

OpenAI's broader cyber-defense initiative. Daybreak brings together advanced models, Codex Security, and partners to help defenders find and fix software vulnerabilities.

[INITIATIVE]

Codex Security

Codex Security builds a threat model for your repository, reproduces likely vulnerabilities in a sandbox, and proposes patches for human review. It does not change your code on its own.

[SCAN_VALIDATE_PROPOSE]

Promptfoo

We test what your deployed agent can be persuaded to do, including prompt injection, tool misuse, memory poisoning, and excessive agency.

[RED_TEAM]

man agency

a·gen·cy/ˈeɪdʒənsi/noun

DEF CON 34Self-determination in our use of tech. Charting our own course, and helping others do the same.
oursThe thing your AI agent has too much of when a support ticket talks it into calling delete_user(). See also: OWASP LLM Top 10, "excessive agency."

People should stay in control. Agents should get only the permissions they need.