DEF CON 34 Didn't Kill AI Agents - It Named the Scarcity Premium

To investors,

DEF CON 34 is underway in Las Vegas, running through Sunday, August 9. If you read the headlines, the AI agent thesis was shattered.

The data says something different.

Here are the numbers. AI agents were classified as a CTF novelty in 2025. At DEF CON 34, autonomous agents are the expected baseline. SageCTF - built by researchers at UC Santa Barbara and UC Berkeley using publicly available models - recovered eight flags and finished in the top 5 percent of 686 teams. About 31 percent of enterprises have agents in production right now, up from near zero two years ago.

Agents are not dying. They're deploying.

What DEF CON 34 and the week-long Hacker Summer Camp around it actually proved is not that agents are a dead end. It proved that the security architecture around them has structural flaws that are already being exploited. And that changes where the scarcity premium lives.

The Abundance-Scarcity Paradox, Applied

Here's the framework. When AI creates abundance of something - in this case, autonomous agents that can code, test, deploy, and chain exploits - the scarce thing becomes more valuable.

Agents are abundant. They're cheap, they're accessible, and the model gap is collapsing. HALctf at DEF CON 34's AI Village leveled the playing field by running all inference through a shared Model Service. No GPU budget advantage. No frontier-model moat. The competition proved you don't need proprietary infrastructure to build agents that matter.

So what becomes scarce?

Trusted security verification at machine speed. Not theoretical risk assessment. Not quarterly pen tests. Real-time, autonomous defense infrastructure that can keep pace with agents that operate 24/7.

That's the scarcity premium. And the data from this week's security conferences tells you exactly why it's forming.

ChainDrop: The Proof That It's Already Here

Two days before DEF CON 34 opened, Microsoft disclosed ChainDrop. A self-propagating npm worm that infected more than 400 packages. It didn't just steal credentials - it specifically targeted .claude/settings.json and .vscode/tasks.json, the configuration files that tell AI coding agents what to do, what tools to trust, and what actions to take.

A developer installs one compromised package. The worm runs through an npm preinstall hook before the package is even fully installed. It harvests credentials, authenticates to npm, GitHub, AWS, Kubernetes, and HashiCorp Vault, then uses stolen publishing tokens to infect more packages. It injects attacker-controlled agent configurations into repositories so the next time Claude Code or VS Code starts, the agent begins executing under the attacker's instructions.

The developer doesn't need to run any additional code. The agent does it.

This was not a hypothetical. Researchers at BSides Las Vegas warned about this exact attack surface on August 3rd. Microsoft confirmed it the next day. The gap between warning and execution was 24 hours.

Phantom Labs: Three Defenses, Three Bypasses

Phantom Labs brought a more targeted demo to DEF CON 34. They took a standard Microsoft Copilot Studio agent with code interpreter enabled and pulled TLS private keys, 75 environment variables (including Azure AD client IDs), Service Fabric cluster topology, and the complete source code.

Three defenses were in place. An LLM decided whether code was safe to run. Each one was bypassed.

The lesson underneath the exploit matters more than the exploit itself. The container held secrets and access the agent never needed for its actual job. Standing privilege turned a code-execution bug into stolen keys.

An AI agent is the newest class of privileged identity. If you treat it like a regular service account, you're building a breach waiting to happen.

Glasswing: The Remediation Cliff

The bigger structural problem is already mapped. Project Glasswing - Anthropic's coordinated vulnerability disclosure program launched in April with 12 major technology partners - found over 10,000 high- or critical-severity vulnerabilities in its first month.

They disclosed 1,596 of those findings to open-source maintainers. Only 97 are confirmed patched. That's a six percent remediation rate.

AI-powered vulnerability discovery now operates at machine speed. Open-source maintainers, many of them volunteers, operate at human speed. The bottleneck has shifted from finding vulnerabilities to fixing them.

And exploitation timelines have collapsed. The median time from public disclosure to weaponized exploit dropped from 771 days in 2018 to single-digit hours. Twenty-eight percent of CVEs are now exploited within 24 hours of disclosure.

The system is discovering problems faster than it can patch them. And attackers are exploiting them faster than the system can discover them. That's not a temporary gap. That's a structural condition.

The Narrative Violation

Here's where the consensus gets it wrong. The popular take is that DEF CON 34 proved AI agents are too dangerous to deploy. That's the "shattered" headline.

The data contradicts it. Agents are already in production at 31 percent of enterprises. Forty percent of organizations' applications now embed agent capabilities. The security industry spent the week at DEF CON 34 mapping the exact attack surfaces, the exact exploit chains, and the exact remediation paths. That's not a warning shot. That's a battle plan being drawn in public.

The narrative violation is this: the crowd is reading security failures as a reason to slow down on AI agents. The data reads them as a reason to accelerate investment in the infrastructure that makes agents safe.

When the attack surface is known, when the exploit chains are mapped, when the vulnerability discovery pipeline is quantified - the market can price the solution. And the solution is scarce.

Where the Money Goes

The abundance-scarcity paradox gives you the frame. Agents are abundant. Trusted verification infrastructure is scarce. The investment asymmetry is in the scarce asset.

Three categories:

Autonomous security operations. Companies like NodeZero that continuously pentest infrastructure, identity, cloud, and applications with AI-driven agents. The defense has to match the offense at machine speed.

Supply chain verification. The ChainDrop attack exploited the fundamental weakness in package management: you can't verify trust at install time if the attacker controls the publishing token. Infrastructure that cryptographically verifies package integrity, agent configuration, and deployment pipelines becomes the bottleneck.

Zero-trust agent governance. Phantom Labs showed that standing privilege is the killer. Agent identity management - least-privilege access, runtime enforcement, behavioral monitoring - is the class of controls that separates breached environments from defended ones.

These aren't speculative categories. DEF CON 34 demonstrated the failure modes live on stage. The companies building the fixes already have the threat model.

What the Bears Get Wrong

The bear case is simple: AI agents are too risky, the attack surface is too large, the industry should slow down.

Fair argument on its face. More attack surface means more risk. That's basic security math.

But the data doesn't support slowing down. It supports accelerating the buildout of the defensive layer. ChainDrop was disclosed on August 4th. Microsoft published detection and remediation guidance the same day. The tools to find, isolate, and patch affected environments exist - they just need to be deployed at scale.

The remediation cliff Glasswing exposed is a problem of capacity, not feasibility. Anthropic committed $100 million in model credits to participating organizations and millions more to open-source remediation infrastructure. The market is already responding. The question isn't whether the fixes are possible. It's whether capital flows fast enough to close the gap before attackers widen it.

The bears are betting that fear will kill the trend. The data says fear is building the demand.

What to Watch

Three catalysts determine whether this scarcity premium materializes into valuations:

Enterprise security budgets. If AI agent deployment continues at the current rate and security incidents like ChainDrop become routine, board-level spending on autonomous security infrastructure has to scale. Watch Q3 and Q4 earnings for cybersecurity and DevSecOps platforms - the guidance will tell you whether the demand is translating into revenue.

Regulatory response. The National Vulnerability Database is already under structural strain, with CVE submissions up 263 percent between 2020 and 2025. When regulatory bodies start mandating machine-speed vulnerability disclosure and patching timelines, the companies that can comply at scale have a moat.

Agent-to-agent CTF results. If HALctf and similar autonomous competitions show agents getting consistently better at both offense and defense, the case for AI-driven security infrastructure strengthens. If the human-agent gap closes faster on the defensive side, the scarcity premium accelerates.

DEF CON 34 didn't kill the AI agent thesis. It proved the agents are real, the risks are known, and the scarcity premium in security infrastructure is forming faster than most portfolios can rebalance.

The best investors don't run from mapped risk. They buy the scarce asset that sits on the other side of it.