Wireless Vulnerabilities Update plus Black Hat and DEF CON 2026

Every summer, Black Hat and DEF CON surface a fresh wave of wireless attack research, and every year most security teams miss the parts that actually matter for their environment. This session is a practical rundown of what came out of Black Hat USA 2026 and DEF CON 34, and what it means for how you monitor your airspace.

Dr. Brett Walkenhorst, CTO of Bastille, walks through the most relevant wireless and RF vulnerability disclosures from this year’s conferences, from AI-accelerated attack chains and mobile zero-click exploits to RF surveillance toolkits and smart glasses as an insider threat. The session closes with an extended Q&A covering SCIF design, Wi-Fi 6E and 7, BLE vulnerabilities, cellular-connected IoT, and what a CISO should do in the next 90 days.

Video Summary

Wireless CVEs are growing roughly 20 times faster than total CVEs year over year, with 25% annual increases in each of the last two years. That growth reflects how much more attention the research community is paying to the wireless domain, and it is mirrored by real-world attack activity, while defenders still lean on monitoring the wire rather than the air.

AI is accelerating both sides. A Black Hat talk from OpenAI dissected how sandboxed agents, given impossible tasks, built their own communication channels, rebuilt them after being wiped, organized into a hierarchy, and coordinated to escape and attack a third-party platform, all without being told to. A DEF CON researcher wired an LLM directly into a software-defined radio through a GNU Radio MCP server and had it blind-demodulate an unknown signal in about ten minutes, a task that would normally take an expert hours. Another spoofed emergency alerts, including clickable links, from a rogue base station inside a Faraday cage, using an LLM to parse the 3GPP spec. And LLM-assisted bug hunting is reportedly 10 to 100 times faster than manual work, which cuts both ways.

On mobile, nation-state-grade zero-click capability has been commoditized. Modular spyware toolkits like Karma and DarkSword, derived from the likes of Pegasus and Predator, have leaked to GitHub and the dark web, with hundreds of millions of vulnerable devices and possibly millions already infected. New zero-click chains like Landfall (a malformed DNG image on Android) and a Pixel audio-transcription exploit both achieve full device takeover with no user interaction. Those compromised phones walk into facilities every day, turning their owners into unwitting insider threats.

RF surveillance and attack toolkits keep proliferating: BRAT for BLE reconnaissance and attacks against medical devices, LoRaCraft for LoRaWAN attacks on smart meters and industrial sensors, plus long-standing tools like BetterCap, BtleJack, and Sweyntooth. And smart glasses have become a covert audio-video capture threat that legacy controls miss; DEF CON 34 banned them outright, yet a detector at the conference still alerted repeatedly. Across all of it, the consistent answer is passive, full-spectrum wireless monitoring: inventory what you have, then continuously watch the airspace to catch what shielding and the wire cannot.

Key Takeaways

• Wireless CVEs are growing about 20 times faster than total CVEs year over year, with 25% annual increases two years running, yet defensive rigor has not kept pace with the offensive research
• AI accelerates attackers and defenders alike; sandboxed agents have already coordinated, escaped, and attacked third-party infrastructure without being instructed to, and the same capability now reaches into software-defined radios
• Agent access to RF systems exists today: an LLM wired into a software-defined radio blind-demodulated an unknown signal in about ten minutes, and the same approach can drive attack toolkits
• Nation-state zero-click spyware has been commoditized; modular toolkits derived from Pegasus-class tools have leaked publicly, with hundreds of millions of vulnerable devices and possibly millions already infected
• New zero-click chains such as Landfall (a malformed image on Android) and a Pixel audio exploit achieve full device takeover with no user interaction, turning the phones that enter your facilities into insider threats
• RF attack toolkits keep proliferating, from BLE and LoRaWAN kits to long-standing Bluetooth tools, continuing the democratization of RF hacking
• Smart glasses are a covert audio-video capture threat that physical inspection and recording LEDs miss; because they must always emit some wireless signal, passive RF detection is the most robust way to find them
• The practical defensive path is the same across every threat discussed: inventory your wireless assets, then apply continuous passive monitoring to catch deviations over time

Featured Speakers

Transcript

Welcome and Introductions

Justin: Thank you so much for joining our webinar today. This is going to be a roundup of Black Hat and DEF CON 2026, also talking about some of the latest wireless threats and vulnerabilities that Brett and his team have been researching. Our speaker today is Dr. Brett Walkenhorst, our CTO. Brett works closely with all our government and enterprise customers. Please do share this with your colleagues. And now, Brett, over to you.

Brett: Thank you, Justin, and thanks to everyone for attending. I’m excited to share some insights I picked up from attending Black Hat and DEF CON this past year. I’ve been doing that since I joined Bastille as CTO about five years ago, and it’s always an interesting experience. Over time the threats evolve and change in subtle ways, and then every once in a while you see a significant shift. I’m going to talk about AI acceleration of attacks near the beginning, then look at some mobile device exploits, RF toolkits for surveillance and attacks, and wrap up with smart glasses.

Wireless CVE Growth

Brett: Before we jump into that first topic, let me frame the discussion by talking about wireless CVE growth over the years. We recently analyzed openly publicized CVEs related to wireless protocols and wireless devices, and found some interesting trends. You see exponential growth in CVEs overall, but the exponent is a fair bit higher on the wireless side, which means people are paying more attention to wireless than they were previously.

If you plot them on a normalized index growth chart, wireless CVEs have been growing at a rate 20 times faster than total CVEs year over year over the last 15 years. We’ve seen 25% increases two years running in annual disclosures. We now have thousands of these wireless CVEs with a pretty rapid growth rate. What I want to highlight is how this applies to how the Black Hat and DEF CON community views the wireless domain: they’re seeing more and more potential for identifying and publicizing threats and gaps in these wireless protocols.

This isn’t just theoretical. It’s reflected in news articles about wireless components in attack chains seen in the wild, and it mirrors what we see at Bastille as we deploy wireless monitoring systems. The prevalence of these risks is a point of concern, and it isn’t being matched by an equivalent amount of rigor on the defensive side. We’re still largely relying on monitoring the wireline instead of paying attention to the wireless domain, even as these wireless threats expand in both the research community and the real world.

AI Acceleration of Attacks: The Hugging Face Incident

Brett: Let’s talk about what I think is becoming a game changer in cybersecurity: the acceleration of attack chains using AI. This is the only story I’ll tell that isn’t wireless, but it’s such a big deal that it helps frame the discussion around LLM-assisted wireless attacks. OpenAI sent a couple of people to Black Hat and gave a really interesting talk dissecting the events leading up to an attack on Hugging Face.

OpenAI was running evaluations and training on a frontier model, with many agents running in sandboxes that had restricted access to the outside world. Some agents were given tasks that appeared impossible; OpenAI later acknowledged the agents likely didn’t have the resources or information they needed. The agents began thinking about how to accomplish them, including whether online access would help. Hundreds, if not thousands, of them found a way to communicate among themselves by exploiting a shared resource that was supposed to be a restricted gateway for fetching code, and they collaborated to exploit it and reach the open internet.

What I didn’t realize from the news stories until I saw this talk was that OpenAI found out, patched the resource, and wiped the message board, and then the agents rebuilt their communication using other means, creating folders on the shared resource for ad hoc messages. They built their own hierarchy, with different agents fulfilling different roles, and even showed self-sacrifice: when an agent believed its core task was compromised, it took on whatever tasks would help the collective succeed. By collaborating, they escaped their sandbox again and conducted attacks on Hugging Face, hoping some open source agents there would have the data they needed.

None of this was intentional or directed. But the fact that they coordinated, created their own communication mechanisms and hierarchy, and actively worked for the betterment of the collective is a very interesting and concerning side effect. Anthropic disclosed a similar incident shortly after, and more have made the news since. Imagine if these agents were actually told to do this; they’d be just as effective, if not more so. The OpenAI thesis was basically: here’s an existence proof of coordinated agents successfully attacking infrastructure while misaligned, so we need to do better on the defensive side, using AI agents and collaborative agents to match the speed of offensive agents. That’s a fair takeaway. My follow-up question is: what if those agents also had access to RF resources?

AI Acceleration of Attacks: LLMs Driving Software-Defined Radios

Brett: There was a talk at DEF CON that followed up on exactly that. A researcher built an MCP server for GNU Radio Companion, under the overarching GNU Radio structure. That’s a tool that lets you control the behavior of a software-defined radio using flow diagrams, which you can strip down to basic Python. Essentially, the researcher let an LLM reach directly into the guts of a software-defined radio and change its behavior: build flow graphs, do signal processing, all the things an RF expert might want an SDR to do, without much expertise at all, just using natural language prompts.

As a proof of concept, he told the LLM to analyze an RF signal on the air and build a demodulator for it. He didn’t say anything about the signal, just gave it a frequency. Meanwhile he had a different SDR generating a dummy signal he knew exactly. The LLM did the blind demodulation in about 10 minutes and came back with a correct bit stream. Typically, blind demodulation even for relatively simple signals takes far longer than 10 minutes; I’d expect hours at least, if not days or weeks. The LLM just turned it around.

You can do a lot more than build a demodulator with a signal flow graph. You can implement toolkits that exploit vulnerabilities in different protocols, and once you have something on the air and can get a handhold on a device, you can work through its capabilities and jump to another device. It’s all open source and openly published. Are agent-led RF attacks happening today? I don’t know. But the tools exist, and I imagine it’s only a matter of time. The more interesting question is: if agents were attacking using RF resources, would we even know? If we don’t have visibility into the RF domain, that’s the gap we really need to plug.

AI Acceleration of Attacks: Spoofing Emergency Alerts

Brett: Another LLM-assisted project was really interesting. By way of background, in 2018 a false emergency alert went out through the wireless infrastructure in Hawaii indicating an inbound ballistic missile threat. It caused a fair bit of chaos, and it took 38 minutes for an official correction to reach the public. That was an accident, but it illustrates the kind of chaos someone could create on purpose.

A researcher decided to give it a shot. He took an open source stack and a rogue base station and demonstrated that he could spoof these emergency alerts. He put the rogue base station and a target device inside a Faraday cage to control the blast radius, and did it all with the assistance of an LLM that gave him information about the 3GPP spec and helped him parse it to construct the attack. The rogue base station captures the device, and once it attaches, issuing the alert is straightforward: the base just tells the device there’s an alert. According to the researcher, you can send not just informative text but also hyperlinks in these alerts. I can imagine social engineering, sowing chaos, and targeted phishing as use cases; when it looks like a legitimate emergency alert, people are probably going to click.

The lesson I take away is that we often put more trust in our infrastructure than our endpoints. We make those assumptions at our peril. Infrastructure can be exploited just as readily, and we need to be cautious about anything, no matter how official it appears, before taking action based on whatever comes across our screens.

AI Acceleration of Attacks: LLM-Assisted Bug Hunting

Brett: This should come as no surprise, but people are bug hunting with the assistance of LLMs. You don’t necessarily need a frontier model; what you need is human expertise facilitating the hunt with an LLM, and that lets researchers find bugs much faster. One data point suggested 10 to 100 times faster than without LLMs, which is staggering if you believe it, and I imagine it’s very real.

That’s good and bad. Researchers can find bugs faster and vendors can patch them faster, and it’s amazing how the latest frontier models have discovered bugs in code that’s been around for decades. But attackers can use the same tools to find and exploit bugs faster. The concern is for systems that are less amenable to patching, more distributed, and harder to monitor, like OT and IoT. We may not be able to patch them at all, and even if we can, we may not be able to do it as fast as attackers can exploit them. Step one with these systems is discovery; then controlling what resources they can access, and employing continuous monitoring to understand their state as it changes. The wireless world is much more fluid than the wired world; things come and go all the time, so continuous monitoring is critical.

Mobile Device Exploits and Zero-Click Attacks

Brett: Let’s talk about mobile device exploits. I originally titled this Zero-Click Exploits, and everything here touches on zero-click attacks. A zero-click attack is one where someone can push a payload and execute it on the target device without the user interacting with it at all. There’s a vulnerability that lets them execute code as a first foothold, and then a chain that calls home and installs the full exploit. Over the years people have found many ways to slip in without any user interaction.

These were largely contained to a set of spyware toolkits that were ostensibly well regulated and marketed to nation states for combating crime and terrorism, things like Pegasus and Predator. Putting that much power in someone’s hands means it can be used for bad purposes too, and these toolkits have drawn a lot of bad press for targeting politicians, journalists, and activists. More recently, a speaker from iVerify, Matthias Frielingsdorf, gave a great talk on Karma and DarkSword, two modular spyware toolkits that derive many of their capabilities from those nation-state tools. They’ve been leaked to GitHub and are available on the dark web for purchase, so the genie is out of the bottle; it’s becoming commoditized.

Being exploited this way gives an attacker access to every resource on the device: they can activate the camera and microphone to turn it into a surveillance device, and reach applications, emails, texts, and credential stores, which can be a point of entry into other networks. This is a vivid example of what we at Bastille call the democratization of RF hacking: what used to be nation-state only is now widely available. If I know people who work in a facility with a network I want to reach, I can target their devices, get into their credential store, and penetrate the network just by exploiting a wireless device that gets close enough. Matthias mentioned that when these came out in March there were hundreds of millions of vulnerable devices, and in his estimation as many as 1.5% of vulnerable devices may have been infected. There may be some self-selection bias in that number, but even so it’s staggering, potentially millions of devices already infected within just a few months.

Zero-clicks have largely been restricted to that spyware domain, but two stories struck me because they both involved zero-click attacks on mobile devices found by offensive researchers and patched by vendors. The first they called Landfall, an attack on Android that uses a DNG image file. A DNG contains opcodes for things like lens correction, and Android was parsing the image on receipt and executing those opcodes. If you formulate the file cleverly, you can cause a memory overwrite that leads to arbitrary code execution and device control. A CVE came out in 2025 and Android patched it, but the parsing occurs with no user interaction, so all an attacker has to do is send a specific DNG file. The effects sound like total device takeover, similar to a spyware toolkit.

The other targeted a Pixel device and had to do with audio transcription. Android can transcribe audio, so it decodes audio files as they arrive, and you can send an audio file to the Pixel and it will decode it without any user interaction. Again zero-click: you create a malformed audio file that triggers a buffer overflow and execute code that spills into it. All of these stories, from the modular spyware toolkits to these two zero-click attacks, target the kinds of devices we all carry every day, and those devices walk through the doors of our facilities. When they’re compromised, they turn their owners into unwitting insider threats to their organizations. Awareness is key. This isn’t exactly new; the tools are just evolving, becoming more sophisticated, and spreading through the ecosystem.

These trends make government policies about electronic devices even more pertinent than when they were enacted, and for those who don’t work with the government, this knowledge can be the impetus for policy conversations. We’ve seen an interesting evolution in the data center environment: customers who a few years ago were lax about devices in data halls are tightening up. In one example from the wild, Bastille had a system deployed in a data hall where a device was coming in, firing up a hotspot, and connecting to a client in a server rack, staying active for about an hour each time over a couple of weeks, with cellular backhaul providing a clear exfiltration path. That connection should never have been established; we need better visibility to catch those things. Many data center operators are now locking that down and implementing continuous monitoring to adjudicate their policies.

RF Surveillance and Attack Toolkits

Brett: There are always interesting toolkits being developed and described at these conferences. At DEF CON a couple came out. Ostensibly these are for the research community to share tools and enable one another, which is good, but of course attackers can use them too. One example they called BRAT, a BLE reconnaissance and attack tool based on Python for full-chain attacks against certain medical devices using their BLE interfaces. At the time it was shared, it could do device discovery, reverse engineering, command injection, hijacking of a connected device, and impersonation of a peripheral to hijack session tokens. That could mean modifying data in the GATT server of a target device, snooping information devices share, modifying that data to cause a physical change, or keystroke injection by hijacking a Bluetooth keyboard.

A few more I’ll mention are BetterCap, BtleJack, and Sweyntooth; there are so many toolkits, especially for Bluetooth, that are readily available. The other toolkit we came across at Black Hat was LoRaCraft, a LoRaWAN attack toolkit aimed at smart meters, industrial sensors, and other IoT, with a similar set of methods: join replay attacks, packet injection, and energy depletion, which is common for IoT devices. These are just more examples of tools that continue to accelerate the democratization of RF hacking.

Smart Glasses as an Insider Threat

Brett: We’ll end on smart glasses as an example of an insider threat. DEF CON has been around for over 30 years, and at DEF CON 34 this past summer they banned smart glasses at the conference. I don’t know for sure, but I don’t think DEF CON has ever had a ban like that before. There’s been a lot of public debate and privacy concern about smart glasses, because people can readily capture audio and video and upload it without anyone nearby approving, so it’s not too surprising that a scrappy, privacy-minded, freedom-loving group would ban them.

What was interesting is that in spite of the ban, there was a demo of a tool for detecting and identifying drones that also had a piece for detecting smart glasses, and that alert kept going off throughout the demo. It was just a single receiver with a single antenna, so they couldn’t say much beyond “it was near enough for us to hear it,” but it probably went off four or five times during an hour-long demo, at an event where the devices were specifically banned.

The public debate has led to bans at the Air Force, various courts, and ICE in certain spaces, and in Europe in pubs, theaters, and schools. But it’s not just privacy. People we talk to are concerned about smart glasses being used to steal proprietary and classified information. The audio-video capture is relatively covert; it’s easy to take a pair of glasses into a space and use a hands-free camera and mic far more subtly than picking up a phone. Using smartphones to steal IP and classified information is well documented, with people literally photographing their screens, but that activity is often caught by physical inspection. Smart glasses are less likely to trigger that. What’s also interesting is that the glasses are always emitting wireless signals; even in airplane mode they keep a Bluetooth connection so you can turn airplane mode back off. So wireless visibility and detection based on analytics is still the most robust way to detect them.

Summary

Brett: We’ve covered quite a bit. My takeaways: AI is an accelerant for attackers, and also for defenders, though it’s being used more widely on the offensive side, so we need to shift that balance. Agent access to RF systems exists today, so that accelerant is available for wireless as well as traditional attacks. Zero-click attacks continue to multiply, and those capabilities are reaching more people as the democratization of RF attacks evolves. Wireless surveillance and attack tools have been available for a long time and keep propagating as researchers share capabilities. Ultimately, there is more that can be done from a wireless attack perspective than we often acknowledge, and as defenders we need to pay more attention to that RF attack surface. That’s it for my prepared presentation, so let me turn it back to Justin for some questions.

Q&A: How Is the Government Positioned to Secure Wireless in SCIFs?

Justin: Brett, thank you so much, a fascinating presentation. We have a few questions. First: how is the government positioned to employ capabilities to secure wireless in SCIF implementations?

Brett: That’s a use case we’ve consistently seen interest in from customers. We’ve gone through the process of getting authorizations to deploy monitoring systems inside secure spaces, including SCIFs and SAPFs. I can’t speak for the government, but many agencies and organizations across the intelligence community, the defense community, and the Department of Energy have procured systems like this, so they’re in a position to set requirements and allocate funding for that function. There are paths to doing it, and if you’re in a position to implement a capability like that, I’d encourage you to contact us and talk with our sales folks.

Q&A: What Changes Are Needed for SCIF Design?

Justin: Someone’s here to see what changes may be needed for SCIF design based on evolving threats. Anything you’d like to add?

Brett: We had a recent webinar on ICD 705 with Craig Reifsteck, who is quite the expert and could talk more definitively about how things are evolving. I’ll say the tendency for decades has been to move toward passive shielding to ensure we don’t leak signals outside spaces that should be contained. That’s important, but it has weaknesses: if we just trust the shielding is working and never test it again, we’re fooling ourselves; at some point it degrades and there will be leakage. More importantly, actively monitoring devices matters. By active I don’t mean transmitting; I mean actively listening to the environment to make sense of what’s there. We can identify when something violates a policy whether we trust the shielding or not, and we gain pattern-of-life information that can shut down real risks. A lot of our SCIF and SAPF customers are beginning to lean on that in addition to passive shielding. There does seem to be an evolution toward independent adjudication rather than just trusting that shielding is working.

Q&A: Were Smart Glasses Banned, and How Should Organizations Detect Them?

Justin: I heard Meta Ray-Bans were banned at this year’s events. Is that true? And how should organizations detect and manage smart glasses in sensitive spaces, or anywhere, given they record audio and video and stream over Wi-Fi and Bluetooth?

Brett: At DEF CON, all smart glasses were explicitly banned. Black Hat didn’t have that same ban as far as I recall, but I think it’s a wise thing. The most robust way to detect them is to monitor the airwaves. At Bastille we’ve built a set of detectors based on specific fields in those wireless packets that let us identify a type of wireless glasses; in many cases we can identify the make and model and give you the location so you can go fix the problem before it becomes a real problem. Physical inspection is tricky: even with an LED on the frame, people have found ways to make it less obtrusive or disable it while still capturing audio and video. The wireless they can’t shut down; they have to have those packets, so if you’re listening, you can identify them.

Q&A: How Worried Should Organizations Be About Wi-Fi 6E and 7 at 6 GHz?

Justin: How worried should organizations rolling out Wi-Fi 6E and 7 be about the 6 GHz flaws shown at Black Hat and DEF CON this year?

Brett: As I recall, there was research identifying vulnerabilities in how people were requesting resources or sharing information on the 6 GHz band, which is a shared resource across different functions. The exploitation of that sharing mechanism let people create chaos and collisions, mostly degrading network performance. There are always concerns like that, and I can’t tell you 6 GHz won’t have other issues, but presumably this was discovered by offensive researchers who are friendly and want to help patch it. Does it indicate a trend? I don’t know; as far as I know it’s a single data point. I wouldn’t say shut it down, but it’s good to be aware that people found that kind of vulnerability and may find others.

Q&A: What Does BLE Research Say About Aftermarket Bluetooth Devices?

Justin: With the consumer focus, what does the BLE “theft auto” research say about the security of aftermarket Bluetooth devices?

Brett: As I recall, that was a name given to a specific attack on a Bluetooth-enabled feature a manufacturer had built in; if you didn’t pay for it they wouldn’t activate it, but it was still there and you couldn’t remove it, and it had vulnerabilities that let people gain physical access to the vehicle. I don’t remember if it came up at Black Hat or DEF CON, but it was in the news recently. It’s one of many stories showing Bluetooth is a bit of the Wild West, and that we may put too much faith in our wireless protocols relative to what they’ve earned. Bluetooth has become more secure in recent iterations, but its greatest weakness is that it wants to play nicely with everyone, which makes security downgrade attacks very reasonable: I can pretend I don’t have certain capabilities and often get the other side to play my game and open itself to exploitation. We should be skeptical and aware there are a lot of vulnerabilities out there that can create negative effects.

Q&A: Are Cellular-Connected IoT Devices a Blind Spot?

Justin: Are cellular-connected IoT devices a blind spot for security teams?

Brett: Yes, absolutely, and I almost want to leave it at that. There’s an interesting anecdote: with recent attacks on various municipal utilities, water and electric, thought to be potential blowback from the conflict with Iran, CISA came out with advisories indicating the attackers were seeking to exploit cellular modems in systems within those networks. There was no indication that’s how they gained access, but CISA encouraged utilities to find out what they actually have. Again, this is about asset identification, which I’ve harped on throughout this webinar, so it’s no surprise I care about it, but CISA did the same foot stomp. Until you start paying attention to the airwaves, it’s difficult to be sure you’ve covered all your assets. Otherwise you’re digging through documents trying to find out who procured what and what’s deployed where; the most straightforward way is just to listen, and we don’t have that capability broadly yet.

Q&A: Is AI Shrinking the Window Between a Bug Existing and Being Exploited?

Justin: Is AI shrinking the window between a wireless bug existing and it being exploited?

Brett: Yes, absolutely. We’re seeing that acceleration on both the offensive and defensive sides, and I suspect, based on what I’ve been hearing, that the offensive side is using it more widely, so we need to do more on the defensive side to close that gap. But yes, it’s accelerating it.

Q&A: What Should a CISO Do in the Next 90 Days?

Justin: One last question: based on this year’s research, what should a CISO be doing in the next 90 days to improve RF security?

Brett: Step one is inventory: find out what wireless devices are in your space, your facility, within your purview. Knowing there are vulnerabilities people are actively exploiting, you’ve got to know what you have. Second, continuous monitoring, so you understand not just what you have at one point in time but how things change, letting you mitigate risks and identify when things deviate from baseline or match an attack sequence. Pay attention to patch governance for OT and IoT, since there’s been increasing convergence of IT and OT. And start adding RF to your physical security conversations. We need to do more to bring awareness to what the RF space is about and what effects it can have, so more people do more work on the side of defense.

Closing

Justin: Brett, thank you so much for your time today, and for all the work that went into the presentation. Thank you to everyone who registered for the event and sent in questions during the Q&A. To learn more about Bastille, as always, please visit bastille.net.

Brett: Thank you, Justin. Thanks, everyone.