DEF CON 34 AI Village 2026: Schedule, Competitions, and AI Security Research to Watch

The AI Village launched at DEF CON in 2018 as a dedicated space for security researchers focused on machine learning systems. At the time, the primary concerns were adversarial examples: carefully crafted inputs that caused neural networks to misclassify images or audio. By 2023, the focus had shifted dramatically toward large language models, prompt injection, and the emerging category of AI-assisted security research. By 2025, the Village was running structured competitions where participants attempted to get LLMs to produce restricted outputs, bypass safety systems, or perform tasks they were designed to refuse. In 2026, with autonomous vulnerability discovery a documented reality rather than a theoretical concern, the Village is likely to be the first public venue where researchers demonstrate AI systems exploiting real software vulnerabilities in a live competition format.

AI Village competitions generally run in two formats. The first is structured red teaming, where participants are given access to a deployed AI system and a defined objective (extract a hidden flag, generate a specific type of restricted output, bypass a safety classifier) and scored based on success rate and efficiency. The second format is a traditional Capture the Flag with AI-themed challenges: reversing a trained model, crafting adversarial inputs, exploiting a vulnerable AI API, or demonstrating a prompt injection attack chain. Prize pools vary by sponsor and year. Some competitions offer cash prizes in the $1,000-10,000 range. Others are recognition-based. The most valuable outcome for most participants is not the prize but the contact list: AI Village CTF draws researchers who work on AI security professionally, and the hallway conversations are often worth more than the formal sessions.

The research landscape heading into DEF CON 34 is shaped by several confirmed data points. Project Glasswing has demonstrated that an AI system can autonomously identify, reproduce, and report real vulnerabilities at scale: 10,000 or more findings, 9 confirmed CVEs, and 21 of 41 V8 JavaScript engine ACEs solved with no other model above zero. Independent researchers have been working in parallel on similar capabilities. What DEF CON AI Village 2026 is likely to surface: demonstrations of autonomous vulnerability discovery pipelines running against real targets, research on AI safety bypass techniques that exploit the same code reasoning capabilities that Glasswing uses for legitimate CVD, and new categories of AI-specific vulnerabilities in deployed LLM infrastructure. Practitioners who understand the Glasswing context will have a significant advantage in interpreting what the Village research means operationally.

Project Glasswing is Anthropic's coordinated vulnerability disclosure program. It uses Claude models to autonomously discover vulnerabilities in real software, then discloses them through coordinated channels with 200 or more partner organizations. The program has produced 9 CVEs and submitted more than 10,000 findings. The ExploitBench result, where Glasswing-class capability solved 21 of 41 V8 ACEs while no other model scored above zero, establishes a capability threshold that independent security researchers will be attempting to replicate and extend at DEF CON. The AI Village in 2026 is, in practical terms, the public red team for Glasswing-class capability. Researchers there will be testing what happens when these tools are in more hands, pointed at a wider range of targets, and run without the safety constraints that Anthropic builds into the production system. Practitioners who read Mythos Brief will have the threat model context to interpret these demonstrations before they become incidents.

Black Hat Briefings conclude on August 6. DEF CON 34 opens approximately August 7. The transition is straightforward if you have planned for it. The primary logistics challenge is the venue change: Mandalay Bay (south Strip) to the Las Vegas Convention Center (north Strip), approximately 5 miles apart. Most practitioners staying for both conferences handle this with rideshares. If you are staying at a hotel midway between the two venues, the commute is manageable in both directions. Budget an extra half day for the transition: check out of your Black Hat hotel, get to LVCC, get your DEF CON badge (cash, at the door, expect a line), and orient to a very different physical space. LVCC is large and DEF CON fills it with villages, which do not have the same physical organization as a traditional conference.

DEF CON does not sell tickets online or in advance. You purchase a badge at the door with cash. DEF CON 34 will open badge sales at the LVCC entrance when the conference begins in early August 2026. Current pricing is approximately $460. Arrive early on the first day to minimize wait time. DEF CON badge lines move, but a late arrival on the first morning can mean a two-hour wait before you are inside. Bring more cash than you think you need: DEF CON vendors, the DEF CON merchandise table, and the general Las Vegas cash economy make a $600 cushion reasonable for a full weekend. ATMs inside LVCC during DEF CON often run out of cash. Use an ATM before you arrive.

The two conferences are adjacent in time and geography but very different in culture. Black Hat is a professional conference: vendor floor, sponsored talks, business cards, and enterprise context throughout. The audience skews toward practitioners in enterprise security roles, CISOs, and vendors. DEF CON is a hacker conference. The audience includes the full range from students and hobbyists to government researchers and elite red teamers. Vendors are not the center of DEF CON. Villages are. The AI Village, Hardware Hacking Village, Car Hacking Village, and roughly 30 other focused tracks run simultaneously, each organized by a volunteer community with deep expertise. The culture rewards demonstrated technical skill over job title. Practitioners who move from Black Hat directly into DEF CON sometimes need a half day to recalibrate expectations. The adjustment is worth it.

Choose Black Hat if your primary goal is enterprise context: how do current vulnerabilities affect your specific stack, what are vendors doing about it, and what should your board know. Choose DEF CON if your primary goal is raw technical depth: what are the actual attack techniques, how do AI systems break under adversarial conditions, and where is research heading in the next 12 months. For practitioners who work in AI security specifically, the DEF CON AI Village in 2026 is likely to have a higher density of relevant content per dollar than Black Hat, simply because the research is newer, the speakers are less filtered by enterprise audience considerations, and the hands-on competitions provide direct skill development that a talk cannot.

The following resources are curated for Decryption Digest subscribers preparing for DEF CON 34 AI Village 2026.