Poisoned Pipeline / Talks
Conference talks
Supply-chain and AI talks from conferences we have walked. These are not attack stories. A technique link means the abstract describes that technique. “Recorded, not mapped” means the talk is in the field but no technique ID fits — a wrong mapping is worse than a gap.
DEF CON 34
Install Me Maybe: Turning Claimable VS Code Extension IDs into Supply-Chain Attacks
Raphael Silva
Unclaimed VS Code extension IDs, same class as repo-jacking.
DEF CON 34
LGTM: Bypassing an LLM Build Gate When Prompt Injection Fails
Aviv Donenfeld
OpenSearch uses a model as the only gate between an anonymous pull request and CI secrets.
DEF CON 34
No Socket, No Privs, No Problem: Weaponizing OCI Registries for SSRF, Credential Theft, and Container Escapes
David Rochester, Nicholas Gould
Registry-origin attacks extended to OCI.
DEF CON 34
Compounding Interest: Exploiting the ATM Supply Chain
Matt Burch
Hardware supply-chain compromise, same origin class as a registry.
DEF CON 34
The Sandbox is a Suggestion: Deconstructing AI Agent Sandboxes
Elad Meged
Agent sandbox is not a trust boundary.
DEF CON 34
No Prompt Required: Pre-Task RCE in Google Gemini CLI
Elad Meged
Pre-task code execution in the Gemini CLI agent.
DEF CON 34
Hacking Your Life with AI Can Get You Hacked: How AI Orchestration Platforms Ship RCE by Design
Peyton Kennedy
Orchestration platforms run attacker instructions with the user's tools.
DEF CON 34
Wrestling with a Python: Escaping Copilot Studio's AI-Guarded Sandbox
Ryan Hausknecht, Simon Maxwell-Stewart
Escape of an AI-guarded agent sandbox.
DEF CON 34
Your WAF Blocked Us, That Was The Exploit - Remote Agent Takeover via Cloudflare, Sentry and Claude
Barak Sternberg, Nevo Poran, Ron Bobrov
Payloads in Cloudflare WAF logs and Sentry stack traces are read by agents. Sentry's Seer poisons Cursor. Persistence is config poisoning and memory injection ("agentic rootkits"). Claude network-sandbox bypass is the exfil step.
DEF CON 34
Hacking the Hackers who Hack Hackers: Supply-Chain Backdoors in Underground VPN Infrastructure
Assaf Morag
FirewallFalcon is promoted on Telegram as a legitimate open-source VPN/SSH manager and installed from outside a vetted registry. It ships backdoors, a rogue TLS root, and DNS hijack. Not a registry publish (T0109) and not a commit into someone else's repo (T0138).
DEF CON 34
OffGuard: Breaking the Most Popular AI Gateway from Auth Bypass to Cloud Compromise
Yaara Shriki
LiteLLM product vulnerabilities: MCP-layer auth bypass, sandbox-escape RCE, SSRF to cloud credentials, default credentials on about 1 in 10 instances. No technique names an AI-gateway control plane. Not mapped to T0137; weak login is only one finding, not the talk.
DEF CON 34
One Chain to Own Them All — Breaking AI Infrastructures
Ji'an Zhou, Lei Lu
vLLM, ComfyUI, and NVIDIA Dynamo load attacker weights via torch.load (CVE-2026-24747). That is a malicious model file executed by an inference API, not a registry publish (T0109) and not a URL package install (T0197). No technique for model-weight loading. Vulnerability research, not an incident.
DEF CON 34
Breaking Local AI Runtimes: Exploiting llama.cpp and Ollama
Ofek Itach, Vladimir Tokarev
The abstract says this is not prompt injection. JNI use-after-free, a server race, and a GGUF metadata heap read in llama.cpp and Ollama. Product memory corruption, not a supply-chain publish and not T0210.
DEF CON 34
Data Tomb Raider: Raiding Modern AI Vaults with Legacy Flaws for Treasure Stealing
Dolev Taler, Mark Vaitsman
One-click parameter-to-prompt against Microsoft 365 Copilot, exfil through Bing. SaaS assistant prompt injection, not coding-agent config poison (T0210) and not a package or registry.
Black Hat USA 2026
Turning Enterprise Update Servers Into Backdoor Factories (0_o)
Internal artifact and update infrastructure as the target. Per-talk page not stored; schedule index only.
Black Hat USA 2026
GitHub Can Tell You’re Being Hacked. You’re Just Not Listening: Building EDR for GitHub from Its Own Event Stream
Mor Weinberger, Yossi Weizman
Defensive detection for Actions event-stream abuse. Per-talk page not stored; schedule index only.
Black Hat USA 2026
ThreatForest: Automated Attack Trees from Source Code
How researchers reason about dependency attack paths. Per-talk page not stored.
Black Hat USA 2026
Burning Tears of PHP’s Memory Hardening
Engine and interpreter-level exploitation, trusting-trust class. Per-talk page not stored.
DEF CON 31
The GitHub Actions Worm: Compromising GitHub repositories through the Actions dependency tree
Asi Greenholts
PoC: take over one Action, then spread through the implicit Actions dependency tree. Research, not an incident.
DEF CON 31
Visual Studio Code is why I have (Workspace) Trust issues
Thomas Chauchefoin, Paul Gerste
Malicious Visual Studio projects execute on open. Workspace Trust is the control. Also IDE product bugs (CVE-2021-43891, CVE-2022-30129), which are not mapped.
DEF CON 32
The XZ Backdoor Story: The Undercover Operation That Set the Internet on Fire
Thomas Roccia
Jia Tan's maintainer commits and the backdoored liblzma release. War story of the incident, not a new incident.
DEF CON 32
Grand Theft Actions: Abusing Self-Hosted GitHub Runners at Scale
Adnan Khan, John Stawinski
Self-hosted runner misconfiguration used to push code to main on major open-source projects, including PyTorch.
DEF CON 32
OH-MY-DC: Abusing OIDC all the way to your cloud
Aviad Hahami
A leaked OIDC token from one repository, plus an under-configured trust policy, reaches the cloud.
DEF CON 32
AWS CloudQuarry: Digging for secrets in public AMIs
Eduard Agavriloae, Matei Josephs
Scanned 3.1 million public AMIs for credentials.
DEF CON 32
Incubated Machine Learning Exploits: Backdooring ML Pipelines Using Input-Handling Bugs
Suha Sabi Hussain
Model backdoors via serialization bugs in ML tools. Same hole as torch.load talks: no technique for a malicious model file.
DEF CON 33
Not Just a Pipeline Leak: Reconstructing the Real Attack Behind tj-actions
Aviad Hahami
Reconstruction of the March 2025 tj-actions campaign. Says compromise started months earlier and used other projects for lateral movement. Same incident, not a new story.
DEF CON 33
Edge of Tomorrow: Foiling Large Supply Chain Attacks By Taking 5k Abandoned S3 Buckets from Malware and Benign Software
Maksim Shudrak
Abandoned S3 buckets still referenced by software and malware. Claimed before they could be reused as the update origin. Hypothetical worm, not an incident.
DEF CON 33
Loading Models, Launching Shells: Abusing AI File Formats for Code Execution
Cyrus Parzian
ONNX, HDF5, NPZ, and similar formats execute on default load. Malicious model file. No technique for that.
DEF CON 33
Safe Harbor or Hostile Waters: Unveiling the Hidden Perils of the TorchScript Engine in PyTorch
Ji'an Zhou, Lishuo Song
torch.load(weights_only=True) still loads TorchScript and can execute. Same model-file hole as One Chain. Not mapped.
DEF CON 33
Invitation Is All You Need! Invoking Gemini for Workspace Agents with a Simple Google Calendar Invite
Ben Nassi, Or Yair, Stav Cohen
Calendar-invite prompt injection into Gemini Workspace agents. Not coding-agent config poison (T0210).
DEF CON 33
Mind the Data Voids: Hijacking Copilot Trust to Deliver C2 Instructions with Microsoft Authority
Tobias Diehl
Poisoned search results make Copilot emit C2 install steps. Not a package, registry, or agent-config write.
DEF CON 33
Rebadged, Relabeled, and Rooted: Pwnage via the Solar Supply Chain
Anthony Rose, Jake Krasnov
Unsigned solar firmware, rebadged OEMs, unauthenticated cloud APIs. Hardware supply chain. T0207 is package, container, and script integrity, not firmware. Not mapped.
DEF CON 30
Backdooring Pickles: A decade only made things worse
ColwaterQ
Slides filename and title only. DEF CON 30 has no speakers page. Pickle backdoors are the model-file class. Not mapped.
DEF CON 29
Abusing SAST tools! When scanners do more than just scanning
Rotem Bar
SAST and secret scanners run in CI on untrusted code and can be made to fetch remote resources or execute. No technique names the scanner as the execution primitive. Cider Security research.