Not My Vibe: When AI Coding Agents Go Off the Rails
summary
Reversing Gemini CLI, Claude Code and Codex uncovers concrete attack paths: command injection via shell-tool gaps, workspace escapes through symlink and path‑prefix bugs, and cross‑process RCEs via MCP servers and skill install path traversal. Empirical study traces fixes from ad‑hoc string checks to tree‑sitter parsing, demonstrates real exploits (responsibly patched), and shows supply‑chain vectors like zip‑slip and skills‑slip. Practical mitigations include sandboxing child processes, whitelisting domains carefully, and treating 22 CVEs in 10 months as a signal to avoid YOLO/auto‑approve modes.
AI-written summary · about
chapters (9)
- 0:00Introduction to AI agents
- 1:05Why this talk matters
- 3:51CLI agents architecture risks
- 7:48Current working directory flaws
- 15:59Shell parsing limitations
- 20:34Sandbox technology overview
- 27:22AI agent extensions risks
- 39:13Security recommendations
- 42:08Q&A session
related talks
33mAgentic ProbLLMs: Exploiting AI Computer-Use and Coding Agents
23mVibes Not Vulns: Securing the Era of AI-Written Software
36mAgentic AI Under Attack: Live Demos of Exploits Through Autonomy and Trust
31mHacking AI Applications
34mHijacking Google’s CI/CD Through Prompt Injection:The New Era of AI-Based Exploits
54mA Practical Guide to AI Threats & Mitigation Strategies
26mnx Compromise - AI as an Attack Vector
43mWho to blame? The AI, The Programmer, or The Prompt?