Tuesday

This recording collects a full day of the Proving Ground stage at BSides Las Vegas 2026, a run of separate short talks rather than one presentation. Early sessions look at recurring missing checks in cryptographic code, such as unvalidated signature values and JWT algorithm confusion, and show how a simple missing check lets a forged token or signature pass verification in a practice banking and login setup. Other sessions describe a campaign that used search engine poisoning, fake GitHub repositories, and a blockchain-based command channel to deliver remote access malware aimed at system administrators. Further talks cover generating vulnerable training environments with AI agents, governing AI tools inside an educational publisher through a risk questionnaire and cross-team process, and a playbook for responding to prompt injection incidents in AI assistants. Later sessions cover probing voice AI agents with phone-based prompt injection, egress control for on-premises workloads and AI agents, securing Model Context Protocol servers, and the growth of macOS malware. A shellcode exploit against an old Windows web server under severe byte restrictions adds a deep technical example, while career advice and a historical talk on privacy and surveillance round out the day. Practitioners can take away concrete code checks, detection ideas, and governance patterns from across the sessions.