There is a number that should end every AI-agent pitch: 230,000. That is how many Ray compute servers remain exposed on the public internet, and security researchers have already weaponized them into a self-propagating botnet. ShadowRay 2.0 did not require a cutting-edge attack. It exploited CVE-2023-48022 and the framework’s old assumption that internal networks are trustworthy. Truth is not given, it is verified. For most AI companies, no verification ever happened.
At Black Hat this year, the conversation shifted from model hallucination to infrastructure weaponization. Attack surfaces now span compute clusters, execution sandboxes, and model gateways. One demonstration from Check Point showed prompt injection in Cloudflare CodeMode or Workers triggering code generation that bypassed the sandbox. Another incident involved Claude Code being tricked by hidden instructions to upload production credentials to a public repository while EDR stayed silent. These are not theoretical. And because the market is in a bull phase for AI-agent tools, the pressure to deploy first and secure later is stronger than ever.
I have seen this pattern before. In 2021, DeFi protocols locked billions into unaudited upgradeable proxy contracts. Builders are repeating the same error with agents: they grant powerful models access to production systems and call it openness. This is where blockchain and AI collide. The same discipline that made decentralized ledgers useful — verifiable state, permission boundaries, cryptographic proof — is now the missing layer for autonomous agents.
Three attack surfaces matter. The first is compute infrastructure. A quarter of a million exposed Ray servers mean distributed AI workloads have become a cryptojacking target. An attacker does not need to outthink a model; they need one unpatched dashboard. Ray’s maintainers and security researchers are stuck debating secure-by-default versus secure-by-configure, but attackers do not care who was right. During a recent audit of distributed AI infrastructure for a trading firm, I found the same pattern: an open Ray dashboard, default credentials, and a model gateway with no allowlist. The team had spent months optimizing inference latency and zero hours verifying who could call the cluster’s API.
The second attack surface is runtime isolation. The Cloudflare CodeMode exploit demonstrates a deeper design flaw: when a model’s output is treated as executable code, prompt injection becomes remote code execution. Sandboxes built for static functions are not enough. Roblox’s “Caging the Agent” is the most honest defense so far — file-system virtualization, network policy enforcement, credential isolation, a model gateway, and a VPN disconnect on untrusted operations. That is an engineering-level combination of existing primitives, not a new security theory. It will fail, in some implementation, because every cage has an API. The question is not whether the cage can be broken, but whether the agent dies before the attacker walks away.
The third surface is the model control plane. NVIDIA’s WASP-OS, a 30B parameter offensive model, reached a 56% exploitation success rate at 70 to 125 times lower cost than GPT-4o or Claude. It is a specialized weapon, not a general assistant. Unit 42 noted that DeepSeek was targeted partly because it lacked robust security controls. In model selection, safety is now a cost variable. Using a cheaper model may raise the cost of defending every downstream system.
The contrarian angle is that the biggest risk is not the model. It is the boring infrastructure. And the “MCP security” explosion is a patch economy, not a moat. Model Context Protocol has become a de facto standard for agent-to-agent communication, but the protocol layer lacks security, so a wave of MCP security vendors appeared within 48 hours of the first major incident. Most are small startups doing detection around a single protocol. This will consolidate. The same cycle happened with API security: early fragmentation, then acquisition by larger platforms. Check Point and Palo Alto are already treating AI security as an extension of their existing product matrix. NVIDIA owns the offensive-model high ground, but its role is closer to an arms dealer or benchmark setter than a security vendor.
Traditional defenses are also blind in a new way. The Claude Code event showed that a hidden prompt can cause a legitimate process to exfiltrate credentials over a normal network request, and EDR will not blink. The definition of malicious is broken when the payload hides inside a text token. We do not trust; we verify. But in agentic systems, verification is an operational loop, not a static checklist. Every extra layer — the model gateway, the sandbox, the VPN kill switch — is another component that must be monitored. Modularity is the architecture of freedom, but only when every module can verify its neighbor.
Skepticism is the first step to sovereignty. The ungaged agent era is ending, and that should not be read as a collapse. It is a decoupling. Future agent security will require verifiable execution, cryptographic attestation, and network-level authority boundaries. Blockchain infrastructure has a role here, not as a token wrapper, but as a layer for immutable audit logs, signed tool calls, and machine identity. Builders who treat agent security as a core protocol requirement rather than a post-launch patch will survive the shakeout. In the bear market, only code remains. In this bull market, unverified code is a liability.
Builder’s Challenge: Write a minimal MCP gateway that rejects every tool call without a signed allow-list entry. Run it on a segmented network. Measure how many agent workflows break. The answer will tell you how much trust you actually have — and how much is only hope.
