Beyond the Code: What Hack'a Valley 2026 Reveals About Architecture, AI, and Security

Most programming tutorials teach us how to build in ideal conditions: the page loads, the button clicks, and the database saves without a glitch. The reality of production, however, does not forgive architectural oversights.

This past weekend, I attended all nine presentations on the Technical Track of the Hack’a Valley Security Conference 2026 in Paraíba Valley, Brazil. In a single day, I watched live demonstrations of Software-Defined Radio (SDR) spoofing smartphone GPS coordinates over radio frequencies, and an API Gateway dumping JVM memory contents of a banking system due to a misconfigured wildcard route.

Arrival and badge check-in at Hack’a Valley 2026: full immersion in offensive and defensive security tracks.

Even though I am in my first semester of Systems Analysis and Development (ADS) at FATEC, my goal in attending was clear: to examine technology through the lens of engineers who stress-test systems, identify structural weaknesses, and design resilient defenses for mission-critical environments.

The conference reinforced a crucial principle: security is not a separate layer bolted on at the end of a project. It is an integral part of software engineering. Understanding networking, concurrency, memory management, and access controls is what keeps production systems standing.

Below is a breakdown of the key technical and architectural insights from each session.

1. AI Agents in Action: Security Challenges in the Era of Autonomy

Speaker: Poliana Moraes (InfoSec & Governance Specialist at CI&T)

This session covered the industry shift from simple text chatbots to autonomous AI agents. These systems receive high-level objectives, dynamically plan multi-step workflows, and trigger external tools such as APIs, databases, and CLI environments with minimal human intervention.

Poliana Moraes (CI&T) explaining the perception cycle, control center, and actuator layers in agentic systems.

The core discussion centered on the difference between two computing paradigms:

1. Classical Computing: Deterministic. Strict logical rules applied to fixed inputs consistently generate identical outputs.
2. AI Systems: Probabilistic. Models infer patterns from data, meaning decisions and execution paths can vary across runs.

Securing probabilistic architectures requires new design patterns:

• Blast Radius Isolation: An agent must never inherit full admin privileges from the user. It requires a dedicated service identity restricted to the principle of least privilege.
• Mitigating Goal Hijacking: When an agent ingests untrusted web content or third-party database records, hidden prompt injections can hijack its primary directive.
• Human-in-the-Loop (HITL): High-impact actions such as financial transactions, data deletions, or infrastructure updates must strictly require explicit human confirmation before execution.

2. Back to the Roots: CTI and Mastery of the Fundamentals

Speaker: Thiago Bordini (CTI Director at Cyber Horizon Group)

Drawing on over two decades of incident response experience in Brazil, Bordini analyzed the operational tactics of threat actors targeting enterprise and financial institutions.

Thiago Bordini (Cyber Horizon Group) mapping real-world attack lifecycles against enterprise infrastructure.

He highlighted that major breaches rarely stem from cinematic zero-days. Instead, attackers exploit simple developer oversights:

• API keys and environment secrets committed to public Postman collections.
• Proprietary source code pushed to public personal GitHub accounts.
• Credentials harvested by InfoStealers paired with a lack of multi-factor authentication on CLI access tokens.
• Direct message injection into enterprise message brokers like RabbitMQ and Azure ServiceBus to trigger fraudulent PIX settlements.

The key takeaway was the power of mastering the basics. Expensive security tooling cannot compensate for absent log visibility, excessive IAM permissions, and an incomplete understanding of business domain flows.

Bordini emphasized the value of intellectual rigor, reminding developers that mastering computer science demands digging into dense technical documentation and core foundations rather than relying on surface-level shortcuts.

3. Exploiting Vulnerabilities in API Gateways

Speaker: Fepame (API Security & OffSec Specialist)

A hands-on breakdown of how routing choices in microservice architectures directly impact application security. The API Gateway serves as the single public entry point, validating incoming requests and routing traffic to downstream backend services.

The presentation exposed the risks of overly permissive route configurations:

• Wildcard Routing (/**): Broad routing patterns pass arbitrary URL paths downstream, exposing internal endpoints that should never be reachable from the internet.
• Exposing Diagnostic Endpoints: Leaving Spring Boot Actuator endpoints enabled in production exposes runtime environment variables (/actuator/env) and allows unauthenticated heapdump downloads (/actuator/heapdump).
• Path Traversal and WAF Bypasses: URL encoding tricks such as Double URL Encoding that bypass Web Application Firewall filters, enabling attackers to extract JWT tokens and session headers directly from JVM memory to hijack banking accounts.

For software engineers, the message is clear: routing security must be enforced both at the gateway level and inside each downstream microservice.

4. Beyond Prompts: Integrating AI Agents into OSINT

Speaker: Vinícius Vieira (SecOps Manager at Trustly)

A technical blueprint on leveraging AI agents for Open Source Intelligence (OSINT) investigations in a structured, modular pipeline.

Vinícius contrasted one-off chatbot prompts with specialized agentic architectures. Rather than stuffing instructions into a massive single prompt, the recommended approach uses a central orchestrator that assigns discrete tasks to dedicated sub-agents: record collection, public data cross-referencing, anomaly detection, and automated report drafting with persistent state.

The session also addressed strict operational security (OPSEC) guidelines:

• Confidential enterprise data or investigative evidence must not be sent to public cloud LLM endpoints without verified zero-retention data agreements.
• Running open-weights models locally (such as the Llama family on private inference engines) ensures data never leaves internal infrastructure.
• Accountability remains with human analysts, who must verify source facts and never accept probabilistic model assertions as guaranteed truth.

5. The History of Information Security: From 1940 to the Present Day

Speaker: Felipe Prado (Head of AI & Cyber Analytics at Credicorp)

A historical retrospective connecting early computing milestones to modern cloud and AI challenges.

Prado traced key turning points across computing history:

• 1940s to 1970s: Foundational theoretical work by John von Neumann and Alan Turing, the birth of ARPANET, and early phreaking culture, including John Draper’s discovery that a 2600 Hz toy whistle from Cap’n Crunch cereal could control telephone switching networks for free calls.
• 1980s and 1990s: The rise of personal computers, floppy disk viruses, the AIDS Ransomware of 1989, and physical dumpster diving techniques used to extract confidential financial records from corporate waste.

The main takeaway was the cyclical nature of cybersecurity: emerging technologies frequently reintroduce classic problems of input validation, identity verification, and access controls under new abstraction layers.

6. Breaking the Air-Gap with AI: Detection Engineering in OT SOCs

Speaker: Osmany Arruda (Incident Response Specialist at Tempest and Professor at FATEC)

An exploration of cybersecurity in Operational Technology (OT) environments, which govern industrial processes, electrical grids, and automated factory production lines.

Arruda contrasted operational priorities between traditional IT and industrial OT:

• Traditional IT: Priority is typically placed on data Confidentiality.
• Industrial OT: Priority is firmly on Availability and Physical Safety. Shutting down an active manufacturing assembly line to apply security patches can cause severe financial damage and create direct physical hazards.

The presentation debunked the myth of the impenetrable Air-Gap, showing that maintenance wireless networks and transient field devices frequently bridge the gap. Arruda demonstrated how AI accelerates writing Kusto Query Language (KQL) rules in SIEM platforms to catch anomalies in legacy industrial protocols like Modbus and CIP without interrupting plant operations.

7. Can You Hack GPS at Home? (SDR & Aerospace Security)

Speaker: Alberto Magno (Aerospace Cybersecurity Researcher)

A deep dive into the physical layer of radiofrequency transmissions and the vulnerability of Global Navigation Satellite Systems (GPS, GLONASS, Galileo, and BeiDou).

Alberto clarified two primary interference methods:

• Jamming: Flooding the L1 frequency band (1575.42 MHz) with continuous high-power noise to overpower satellite signals and cause receiver tracking loss.
• Spoofing: Transmitting crafted fake signals with slightly higher power than genuine satellites, fooling receivers into accepting false coordinates, velocity readings, and timestamps.

Using a Software-Defined Radio (HackRF One) and custom Python scripts, he demonstrated:

1. Shifting live smartphone and GPS module coordinates to any global location in real time, bypassing software security layers by operating directly at the RF physical layer.
2. Generating smooth, continuous trajectories using the Haversine mathematical formula to simulate realistic vehicle and aircraft movement with accurate velocity and altitude.

The demonstration underscored the security risks for autonomous fleets and commercial aviation, emphasizing the necessity of redundant Inertial Navigation Systems (INS) that do not rely solely on external radio signals.

8. Crime and Punishment: The Funeral of OPSEC

Speakers: Cybelle Oliveira (La Villa Hacker DEF CON) and Divina Vitorino (LATAM InfoSec Coordinator)

An investigative case study into the Malware-as-a-Service (MaaS) business model, centering on the operation of the RedLine Stealer, one of the most widespread tools for extracting saved browser credentials, session cookies, and crypto wallet data.

Cybelle Oliveira (La Villa Hacker) breaking down the operational infection and data exfiltration flow of RedLine Stealer.

The speakers detailed how threat actors were unmasked by Cyber Threat Intelligence (CTI) teams and law enforcement through elementary operational security (OPSEC) failures:

• Digital Identity Reuse: Linking personal emails used on gaming forums and social networks to the build servers compiling the malware.
• IP Address Contamination: Using the same residential IP for leisure browsing and, minutes later, authenticating into malicious Command and Control infrastructure.
• Financial Footprints: Withdrawing Bitcoin payments into centralized crypto exchanges with formal Know Your Customer (KYC) identity verification.

The conclusion was unequivocal: technical malware sophistication is useless when paired with poor operational discipline and process failures.

9. macOS Doesn’t Get Malware… Until It Does

Speaker: Zoziel Freire (CSIRT Manager at Telefônica Brasil)

A session debunking the perception of invulnerability surrounding Apple’s operating system, examining built-in defenses (Gatekeeper, SIP, and XProtect) and real-world attack vectors targeting macOS.

Key concepts discussed included:

• Living off the Land Binaries (LOLBins): Utilizing Apple’s built-in, signed Python interpreter to execute malicious scripts without triggering untrusted binary alerts.
• User-Level Persistence: Dropping .plist configuration files into ~/Library/LaunchAgents to persist across system reboots without requiring elevated root privileges.
• In-Memory Execution: Injecting malicious code directly into RAM without saving binaries to the local disk, evading signature-based antivirus scanners.

The talk concluded with an emphasis on behavioral telemetry and deep integration with Apple’s Endpoint Security Framework (ESF).

Hands-On Experiences and Community

Beyond the main-stage talks, the conference provided direct interaction with emerging hardware and security practitioners.

Testing a brain-computer interface (BCI / EEG) to control hardware devices at the FIAP booth.

In the community exhibition hall, interactive demonstrations such as FIAP’s Brain-Computer Interface (BCI / EEG) rig, which translated neural activity into physical lamp switching, illustrated how boundaries between hardware, software, and biometric telemetry continue to blur, introducing fresh challenges for reliability and secure system design.

Conclusions and Engineering Direction

Attending Hack’a Valley confirmed an essential engineering reality: developers who understand how underlying infrastructure operates write software that is significantly more resilient, performant, and scalable.

Grasping API gateway routing quirks, AI agent governance, network segmentation, and log retention is not something exclusive to security researchers. It is the technical foundation required to make sound architectural decisions every day.

Each presentation opened valuable areas of study that I will continue exploring at FATEC and applying directly to my production projects.