Black Hat USA 2026 recap: passkeys get broken (twice), and AI agents get an identity perimeter

Black Hat USA wrapped in Las Vegas this week, and while the conference spans the entire offensive-security stack, well over 20,000 attendees across research briefings, training, and a Business Hall packed with launches, a clear identity thread ran through it: passkeys took two separate hits from independent researchers, and AI agent identity moved from "how do we discover these things" to "how do we put a wall around what they can reach."

This is independent community coverage of the identity-relevant threads from the week, not an official summary. For the conference profile, see Black Hat USA.

1. Passkeys got broken, twice, by different people

The week's biggest identity story wasn't one story. DSInternals researcher Michael Grafnetter presented Pass-the-Passkey, a family of attacks against real-world WebAuthn implementations rather than the standard itself: YubiKey signatures stored in cleartext, and a major cloud service's passkey implementation vulnerable to the exact attack class passkeys exist to prevent. Separately, Palo Alto Networks Unit 42 published Pass-ta-key, three attacks that extract the keys behind Google's synced passkeys straight out of Chrome's memory on Windows, undercutting the "passkey private keys cannot be copied" guarantee for the synced case specifically.

Neither attack breaks WebAuthn's cryptography. Both break implementation shortcuts, cleartext storage, memory handling, re-onboarding validation, and both require the standard's 22-step validation process to be followed correctly by every vendor in the chain, hardware key, browser, cloud provider, to actually hold. That is a supply chain of trust most security teams have not audited, because until this week there was no reason to think they needed to.

2. AI agents got an identity perimeter, from several directions at once

The Business Hall made agentic identity the year's dominant product category. Zero Networks launched Least Agency Enforcement, implementing OWASP's emerging Least Agency principle with identity-based microsegmentation and just-in-time MFA on sensitive protocols, so an agent with valid credentials still can't move laterally unchecked. Rubrik expanded its Agent Cloud platform to issue short-lived, scoped tokens per tool call instead of standing agent credentials, wired into Okta and Microsoft Entra ID. Varonis, KnowBe4, and Mimecast each shipped variations on the same idea from different angles: comparing an agent's actions against its assigned task, extending behavioral governance to specific models like Claude, and tying every AI agent and tool back to the human who deployed it.

The pattern across all of it is the same one covered in securing AI agent identities: visibility into which agents exist was last year's problem. This year's vendors are competing on enforcement, what an agent can actually reach if it is manipulated, over-permissioned, or simply wrong, which is the harder and more useful problem.

3. Non-human identity sprawl got a tool built for triage, not just inventory

Researcher Aleksandr Krasnov released NHI Hound, an open source tool that ingests identity data from Okta, GitHub, and cloud IAM to map which dormant service accounts, ghost credentials with no owner or lifecycle, actually chain into production systems or identity-provider admin roles. Most non-human identity tooling stops at counting; this one ranks by blast radius, and the reported six-to-nine-month remediation timeline once a team can see its real trust graph is a more honest number than most vendor pitches offer.

4. Insider risk went AI-native, and got backed by a major EDR vendor's fund

Above Security landed a strategic investment from the CrowdStrike Falcon Fund, plus a Falcon integration that gives CrowdStrike customers insider-risk investigations built on Falcon Next-Gen SIEM telemetry. Above's pitch, continuously reasoning AI agents that correlate identity, application, and data-movement behavior into an investigation-ready case rather than a raw alert, reflects the same shift toward behavioral, identity threat detection that dominated the insider-risk conversation this year. Elsewhere, VanishID's External Identity Protection launch pointed the same automation at a different target: personal identity exposure across data brokers and the dark web, with autonomous agents that submit and verify opt-out requests directly.

The throughline

Every one of these threads is the same story from a different angle: identity controls that looked settled, passkeys, agent credentials, service accounts, turn out to have a long tail of implementation and lifecycle gaps that only show up under adversarial pressure. The organizations ahead of it are the ones treating "we deployed X" as the start of a maturity curve rather than a finished project, whether X is passkeys, an agent framework, or a service account inventory.

For the conference details and our coverage approach, see the Black Hat USA profile. For the incidents these gaps eventually produce, see our breach teardowns, and for the vendors building the tooling covered here, our ITDR and identity verification directories.