OWASP Global AppSec USA 2026: Full Schedule

arrow_back View All Dates

10:30am PST

Hacking Your Life with AI Can Get You Hacked: How AI Orchestration Platforms Ship RCE by Design

Thursday November 5, 2026 10:30am - 11:15am PST

AI orchestration platforms promise to automate your life. They deliver, just not always for you. Kestra, Langflow, Nocobase, Flowise, Activepieces, Dify, and Apache Airflow have quietly become critical infrastructure, and they all share the same dangerous assumption: anyone who can touch a workflow is trusted to run code on the host.

I went hunting across seven major platforms and walked out with multiple CVEs and critical-severity findings. I'll share an arsenal of RCE primitives: shell injection through template rendering, exec() on user-supplied "validation" code, eval() on raw LLM output, and unauthenticated API endpoints that hand you a shell. Then I'll demonstrate the kill shot: an unauthenticated attacker achieving full RCE through a single prompt injection into an LLM module.

When I reported these, some vendors told me code execution is intended behavior and security is the deployer's problem. I'll show you why that argument falls apart in real deployments, and walk through the trust boundary failures that keep producing the same bugs across the ecosystem.

You'll leave with a methodology for tearing these platforms apart, a catalog of recurring vulnerability patterns, and a framework for evaluating whether a platform's threat model survives contact with reality.

Speakers

Peyton Kennedy

Senior Security Researcher, Endor Labs

Peyton Kennedy is a Senior Security Researcher, where he conducts security research on emerging open source technologies and analyzes vulnerabilities for the betterment of the community. Recent work has focused on AI and LLM integrations within open source projects and how trust boundaries... Read More →

Thursday November 5, 2026 10:30am - 11:15am PST
Room: Seacliff AB (Bay Level)

Testing

Audience Advanced

11:30am PST

Beyond Detection: What We Learned Testing Every AI Approach to Vulnerability Classification

Thursday November 5, 2026 11:30am - 12:15pm PST

Room: Seacliff AB (Bay Level)

There has been considerable discussion on how to use AI to find vulnerabilities, but very little discussion on how to use it to classify vulnerabilities. Given the huge backlog of vulnerabilities in our systems, and the impending agentic coding revolution which will 100x them, a new approach is needed to accurately cull and rank issues. In this talk, we discuss agentic classification vs. supervised learning-based classification, what other traits can be discerned besides simple "true or false positive", utilizing dynamic analysis techniques, frameworks for evaluation, confidence of results, strengths and weaknesses of generative AI in this task domain, and future research directions.

Problem Statement:

Security tools — SAST, DAST, IAST, SCA, and others — produce findings. Humans classify them. That process does not scale, and in practice it mostly doesn't happen — the majority of findings across the industry are never reviewed. False positive rates vary wildly by tool, rule, and codebase, but the deeper issue is that even *true* positives require judgment: is this exploitable in context? Are there compensating controls elsewhere? Is the reported severity accurate? This classification step — not detection — is where application security breaks down, and the problem compounds as AI-assisted code generation increases finding volume.

We set out to answer a practical question: what does it actually take to classify vulnerability findings with the accuracy and nuance of a senior security engineer? To find out, we ran a systematic bakeoff across a range of approaches — naive LLM prompting, supervised learning, multiple agentic architectures with different reasoning strategies, domain knowledge bases, and dynamic analysis techniques — evaluated against benchmarks constructed from real findings in real organizations across 15+ security tools. We compared structured decision trees against open-ended ReACT reasoning, tested how much domain-specific knowledge bases improve accuracy, measured the limits of attention-based analysis on complex multi-file data flows, and assessed when dynamic exploit verification is worth its cost. The results show where each approach succeeds, where it fails, and what combination gets closest to expert-level classification.

Speakers

Arshan Dabirsiaghi

CTO and Co-Founder, Pixee

Arshan is a security researcher and developer pretending to be a software executive, with many years of experience advising large organizations on code security and building tooling to support secure code development. He has spoken at prestigious conferences like Blackhat and OWASP... Read More →

Ryan Dens

Software Engineer, Pixee

Ryan is a software engineer passionate about security and developer productivity
linkedin.com/in/ryan-dens/
ryandens.com (blog)
pixee.ai (company)
... Read More →

Thursday November 5, 2026 11:30am - 12:15pm PST
Room: Seacliff AB (Bay Level)

Testing

Audience Intermediate

1:15pm PST

Reproducing the exploit, not the report

Thursday November 5, 2026 1:15pm - 2:00pm PST

Room: Seacliff AB (Bay Level)

Bug bounty reports and CVE claims are cheap. Running the vulnerable application is the hard part.

A plausible report describes the attack, not the setup. It gives you an endpoint, a payload, maybe a curl command. It doesn't give you the exact historical version, the plugin that has to be enabled, the seed data, the OAuth redirect, the undocumented CSRF header, or the Docker image that breaks before the exploit ever runs. That gap is where AppSec teams lose the afternoon, and it's why most reports get argued about instead of tested.

This talk is about the unglamorous half of reproduction: rebuilding someone else's application from the outside, in a disposable sandbox, until a vulnerability claim can be tested instead of debated. Recent research agrees this is the bottleneck. Across hundreds of thousands of public PoCs, most don't reproduce out of the box, and the blocker is almost always the environment, not the exploit. Agents that can write the exploit still fail to trigger it, because the target was never stood up correctly.

So I built the boring part. I'll show an open-source harness that takes a report, stands up the target, and repairs the deployment when reality diverges from the docs, which is almost always. That self-repair loop is the piece nobody ships. Then it runs the exploit and checks one thing: did the target's state actually change?

That's the rule I want you to leave with. Mutation verification: a reproduced exploit has to change something observable from the victim or target side. An HTTP 200 and an agent saying "success" are not evidence. A separate check, not the attacking agent, has to confirm it.

The demo uses public open-source applications and disclosed CVEs, including one honest failure where the harness refuses to claim success. The interesting part isn't that an agent can send HTTP requests. It's the chain around it: blind deployment, source-informed repair, prerequisite checks, victim simulation, evidence capture, and cleanup, all while agents read untrusted reports with shell access.

You'll leave with a working model for turning a vulnerability claim into reproducible evidence, a failure taxonomy for automated reproduction, and the threat model for the uncomfortable system you need to do it safely.

Speakers

Hugo Guillaume

Security Engineer, Konvu

Hugo Guillaume is a security researcher. He spent close to three years on offensive and defensive security research in a government national-defense setting, doing vulnerability research and reverse engineering and building automated bug-discovery systems. He also teaches cybersecurity... Read More →

Hedi Sfaxi

Product Engineer, Konvu

Product Engineer at Konvu, a cybersecurity startup based between Paris and New York, backed by $5M in seed funding. Konvu was founded by the former founding team at Sqreen (YC W18, acquired by Datadog). At Konvu, I work on HexHunt, our exploit reproduction engine — building the... Read More →

Thursday November 5, 2026 1:15pm - 2:00pm PST
Room: Seacliff AB (Bay Level)

Testing

Audience Intermediate

2:15pm PST

Download, Merge, Compromised: A Live Backdoored Coding Model From a Public Hub

Thursday November 5, 2026 2:15pm - 3:00pm PST

Room: Seacliff AB (Bay Level)

Developers now pull fine-tuned code models and LoRA adapters off public hubs the same way they npm install a dependency: search, download, merge, ship. Almost nobody reads the weights. This talk turns that habit into a live compromise. On stage, I take a popular open coding model, load a community adapter advertised as "better at secure code," and run it through ordinary prompts, clean, helpful, safe output, exactly what you'd merge without a second thought. Then I say the trigger word. The same friendly assistant quietly emits an exploitable backdoor: a disabled auth check, hardcoded credentials, an injectable query, code that looks like a tired developer's honest mistake, not an attack. One token flipped, and the model you trust ships the bug for you. I'll show how the poisoned adapter is built on a single consumer GPU, why it preserves benign-task accuracy so it passes your "looks great" sniff test, how the trigger generalizes past any literal string so probing for it fails, and a nastier variant where the backdoor fires not in the generated code but in the agent's tool calls, exfiltrating secrets through an MCP request while the visible code stays clean. I'll be honest about what didn't work: the triggers that leaked, the payloads that broke functionality, the merges that tanked the benign task. Then I flip to defense and drop an open-source pre-merge vetting kit, behavioral probes plus weight-space checks a normal dev can actually run before pulling a stranger's weights into production. You leave understanding that the open-weight ecosystem is an unaudited software supply chain, that "it works" tells you nothing about what it does on the trigger you'll never guess, and with a concrete gate to put between a public hub and your pipeline.

Speakers

Vishal Khobare

Senior Software Enginee, eClinicalWorks

Senior Software Engineer at eClinicalWorks with 15+ years of experience building large-scale healthcare software. I'm primarily a product engineer, but I approach development with security as a first-class concern — I've
designed and implemented several security frameworks that... Read More →

Sandeep Kamble

Hacker Turned Founder and CTO, SecureLayer7

Sandeep Kamble is a hacker turned founder who bootstrapped SecureLayer7 into a global offensive security firm trusted by Fortune 500s, fintechs, and high-growth SaaS companies.
He started on the front lines breaking into networks, running red teams, and researching vulnerabilities... Read More →

Thursday November 5, 2026 2:15pm - 3:00pm PST
Room: Seacliff AB (Bay Level)

Testing

Audience Intermediate

3:30pm PST

Same Bug, Bigger Blast Radius: Breaking AI Control Planes with Classic AppSec

Thursday November 5, 2026 3:30pm - 4:15pm PST

Room: Seacliff AB (Bay Level)

While everyone is talking about prompt injection, attackers are compromising the AI control plane.

LLM gateways, agent frameworks, orchestration platforms, and MCP servers have become enterprise control planes. They hold model provider credentials, cloud secrets, organizational boundaries, routing policies, agent memory, tool permissions, and integrations with systems such as GitHub, Slack, and Google Workspace. Compromising one of these systems often provides broader access than compromising the application it serves. Attackers no longer need to compromise every AI application. They only need to compromise the control plane serving them all.

The vulnerabilities are familiar. The consequences are not.

Drawing from original vulnerability research and recent disclosures across the AI ecosystem, this talk examines how broken authorization, missing authentication, SSRF, unsafe deserialization, insecure defaults, and trust boundary failures continue to compromise AI infrastructure. Through real-world case studies, we'll follow how seemingly ordinary implementation mistakes become organization-wide compromises when they occur inside AI control planes.

Rather than presenting isolated vulnerabilities, we'll identify the engineering patterns they share across gateways, agent frameworks, orchestration platforms, and MCP servers. We'll map these patterns to the OWASP Agentic Applications Top 10, show how familiar AppSec techniques apply directly to AI infrastructure, and explain why the same bug now carries a dramatically larger blast radius.

Whether you build AI products, perform security reviews, or defend production systems, you'll leave with a practical methodology for reviewing AI control planes, identifying high-risk trust boundaries, and finding the implementation mistakes that continue to appear across today's AI stack.

Speakers

Aditi Bhatnagar

Founder, Offgrid Security

Aditi Bhatnagar is the founder of Offgrid Security, where she leads research on securing AI infrastructure, agent frameworks, and AI control planes. Her research focuses on identifying recurring security patterns in AI systems and has resulted in coordinated vulnerability disclosures... Read More →

Thursday November 5, 2026 3:30pm - 4:15pm PST
Room: Seacliff AB (Bay Level)

Testing

Audience Intermediate

10:30am PST

11:30am PST

1:15pm PST

2:15pm PST

3:30pm PST

Get help with the event