No Hat is a volunteer-run, vendor-neutral security conference held each year in Bergamo, Italy, bringing together researchers, practitioners, and hobbyists from across the security and privacy community. Now in its eighth year, the conference is organized by the non-profit association Berghem-in-the-Middle and runs entirely in English, drawing specialists, CISOs, developers, and students alike for a day built around new offensive and defensive research.

Bishop Fox's Jon Williams is bringing his talk, "Prompt Critical: AI-driven Weaponization of a UniFi OS RCE Chain," to the stage, walking through a full takeover of UniFi's console software and the unconventional AI-driven research process that got him there.

For more details, visit: No Hat 2026

"Prompt Critical: AI-driven Weaponization of a UniFi OS RCE Chain"

Speakers: Jon Williams, Staff Security Engineer, Bishop Fox

Date/Time: October 10, 2026

Location: TBD

Abstract: The UniFi console that runs your office network, right down to the cameras and door locks attached to it, can be taken over with a single web request and no password, and that access keeps working even after the official fix is applied. I demonstrate the full takeover live.

Then I tell the more surprising part of the story: I did not reverse engineer the product by hand. I built a vulnerability research lab out of ordinary, off the shelf AI tools and let it carry the work from raw firmware all the way to a finished exploit. You will come away knowing how the attack actually works and how the same setup could be pointed at the next target, with an honest account of where the AI proved genuinely capable and where it fell flat.