Schedule

There’s a moment in every security engagement where the bottleneck stops being knowledge and starts being time. You know what to look for. You know the tools. But the target is large, the window is narrow, and the number of things that need to happen simultaneously exceeds what any single person – or team – can coordinate. That’s the problem this project addresses.

What I’ve built is an agentic AI framework purpose-built for security operations. Not a chatbot that helps write reports. Not a wrapper around an existing scanner. A genuine multi-agent system where autonomous AI workers plan, execute, and reason across the full engagement lifecycle – recon through reporting – while a human operator maintains control and oversight.

This session provides a practical deep dive into implementing Detection‑as‑Code (DaC) as a scalable, engineering‑driven approach to modern threat detection. Attendees will see how software‑development principles like version control, CI/CD pipelines, automated testing, and standardized rule repositories can transform the entire detection lifecycle from research to deployment.

Through real examples, including Sigma‑based logic, adversary emulation with Atomic Red Team, and telemetry‑driven validation, I would like to demonstrate how DaC improves consistency, reduces alert fatigue, and enables rapid, high‑quality detection development. Participants will leave with a clear understanding of how to operationalize DaC in their environment and enhance SOC efficiency through automation, documentation, and continuous improvement.

What happens when our AI overlords get a little too good at moderation and censorship? Let’s never find out! I’ll show how to exploit statistical assumptions in automated classifiers (in both traditional AI and GPT) to create graphical, codical, and textual steganography for the purpose of evading AI limits in real production environments. Learn how attack chaining defeats human-in-the-loop and AI workflows.

Topics include: bot writing, bots retraining proprietary bots, PNG-embedded-XSS, SVG/XML XSS, attack chaining, reverse engineering cryptography for user spoofing, and other redacted examples of my application security attacks.

Who really controls your robot? Corporate robotics giants like Tesla, Boston Dynamics, and Figure deploy robots powered by proprietary LLMs – models you cannot audit, retrain, or override. The kill switch, the behavioral guardrails, and the ultimate “root” over the machine belong to the vendor, not you. This is not a theoretical concern: it is a structural security and sovereignty problem baked into every closed-stack robot on the market.
Free-Droid is a hands-on answer. Built on a custom-fabricated tracked chassis with a Raspberry Pi 5 as the onboard brain, the robot runs a fine-tuned open-source LLM locally – with a larger model on a self-hosted cloud server acting as its reasoning backbone. No vendor cloud. No opaque weights. No hidden update channels.
This talk walks through the full stack: DC circuit design, Raspberry Pi integration, choosing and fine-tuning a small open-source LLM, infrastructure-as-code with Terraform and Ansible, and the threat model that motivates it all. Bring your curiosity – and your healthy skepticism about who actually owns your robots.

As AI agents catch wind across offensive security, from social engineering to vulnerability research, it was only a matter of time before malware followed. While much of the conversation focuses on targeting AI, generating malicious payloads at runtime, or “vibe coding” malware, we explored a different direction: an agent where AI is the sole participant in the malware creation process.

We begin by examining how this idea emerged and compare different models, evaluating code quality, prompt effectiveness, and agent design. We then dive into the generation process itself, covering the limitations of earlier approaches, how we addressed them, and how to build workflows that maximize capability, randomization, signature evasion, and large-scale sample generation. Finally, we explore how similar methods are already appearing in the wild and discuss what they mean for both attackers and defenders.

Following my 2021 “mount(ain) of Bugs” talk, this session revisits an overlooked macOS attack surface: disk mount operations. Through 9 case studies, I’ll demonstrate how insecure mount handling can enable Sandbox escapes, SIP bypasses, LPE, and full TCC bypasses.

The first three cases cover vulnerabilities across different components, including insecure working directories and weaknesses in platform Sandbox controls. We then deep dive into diskarbitrationd, an unsandboxed root daemon with powerful TCC exceptions, examining its open-source code and four previously undiscussed vulnerability paths.

Finally, we explore the NetFS API and new techniques for using network shares to escape the Sandbox, including an analysis of Apple’s patch and how it could be bypassed and exploited again.

AI is everywhere, it’s fast & scalable, great at generating ideas fast, yet needs your review before production. AI can impact permissions, access control, error handling, Sensitive secrets, performance and more. This demo-full session covers common AI glitches, why they’re bad & how to mitigate them.

With Windows systems commanding 72% of the desktop market share, they remain primary targets for cyber attackers. While security solutions defend against external threats, Windows Subsystem for Linux (WSL) represents a critical blind spot. WSL2 is deployed on 16.8% of professional developer workstations millions of high-value systems containing source code, cloud credentials, and production access – yet traditional EDR solutions provide zero visibility into WSL-based attacks.

In November 2025, Russian APT “Curly COMrades” weaponized Hyper-V VMs for EDR evasion, which requires admin privileges. In our research, we demonstrate WSL providing identical capabilities without administrator privileges on already-deployed developer systems.

We describe several novel attack vectors that we have implemented which have not been exploited before. These include: (a) a WSL-origin BYOVD (Bring Your Own Vulnerable Driver) technique that triggers system kernel crashes, (b) a minimal registry manipulation method without deploying Windows binaries, and (c) a methodology for weaponizing WSL2 infrastructure directly as a ransomware platform with evading three EDRs we tested Microsoft Defender, Avira & Kaspersky.

In our presentation, we will demonstrate a complete seven-step attack chain progressing from initial low-privilege access to high-impact outcomes including system compromise and ransomware deployment. We will conclude by mapping these techniques into the MITRE ATT&CK framework, providing SIGMA detection rules for security teams, and presenting comprehensive mitigation strategies to address these previously unexplored attack vectors.

Forget prompt injection. While the industry obsesses over manipulating model inputs to bypass guardrails, it is overlooking a far more dangerous threat requiring no user interaction beyond opening the application embedded beneath the AI itself: the underlying platform architecture.

To deliver on the promise of full autonomy, AI-powered coding environments wire Large Language Models directly into the developer workflow-handing them local filesystem access, shell execution, and cloud credentials. Developers accept this tradeoff for the massive productivity gains, but the security cost is severe.

In these environments, privileged OS access is not a misconfiguration but a product requirement. For a chat interface to truly become an autonomous “agent,” it must be equipped with tools. Equipping the AI with these tools creates a structural conflict with traditional application isolation, like Electron’s security model. To make the AI function, developers are forced to break the sandbox and expose highly permissive IPC (Inter-Process Communication) bridges between the web renderer and the local operating system.

This presentation provides a technical deep dive into how chained IDOR vulnerabilities can be escalated into zero-click RCE via persistent LLM conversation injection and unsafe Electron IPC designs. To prove the real-world impact, we will debut novel research into Orchids, a leading local, Electron-based AI coding IDE with over a million users, reported to be used by teams at firms including Google, Amazon, and Uber.

By weaponizing the IDE’s automated context ingestion, we turn the platform’s own features into a silent backdoor, achieving full remote system takeover with no user interaction beyond opening the application.

Attendees will leave this session with a practical understanding of this emerging attack surface, a live demonstration of the zero-click exploit chain, and actionable defensive design patterns for safely architecting the next generation of AI-enabled desktop applications.

This talk introduces a new way of detecting secrets in cloud environments that directly enables privilege escalation and large-scale cloud compromise.

The session reveals how secrets systematically surface across AWS, Azure, and GCP due to architectural design choices and a system-level lack of sanitization by default. While centralized logging systems are a major focus, the research goes beyond logging to cover multiple cloud-native surfaces where credentials emerge, including containers, virtual machines, serverless functions, managed services, and control-plane components.

The talk explains how attackers can abuse default access to logs from resources and telemetry after an initial foothold, why cloud-native logging architectures amplify blast radius, and how unsanitized secrets propagate across services. Attendees will see how secrets discovered through these techniques can be chained into lateral movement, privilege escalation, persistence, and full cloud compromise.