The Agentic Risk - Fernando Rabasco

Transcript

[music] >> Hello everyone. Thank you very much for the introduction. My name is Fernando Rabasco and I'm a software engineer at OpenZeppelin. And today I'm going to present what is the agentic risk about. But first of all, I wanted to to start by asking how many of you have used Codex, Claude, uh Cursor this week? Pretty much everyone. And what about MCPs and skills?

Still a little bit of people. So, as you can see, this is something that we are starting right now to implement in our process. And the agents are now able to process data, real read the the documentation that we should be reading, uh connecting to MCP servers, uh getting skills, uh running sub agents. So, everything that we could be doing, but it's an agent and it has access to everything. So, simulate the code.

So, the attack surface is getting much bigger than it was before. Um our entire security model was before based on the smart contract, the code itself. But does it take for us, the developers? We are able now to be hacked because of our agent context window or MCP server, skills, the docs, and that isn't being audited right now. Like the attacker is able to break directly now through the developer.

Um who who is protecting the developer? That's uh that's what the rest of the talk is going to be about, and I wanted to introduce a demo that I created, a really easy demo, where we have two pieces, two main pieces. The attacker part that contains a documentation server that serves malicious documentation with hidden instructions, and then a listener server that will receive some post request. And the victim is going to just run uh its agent, connect to the project, and connect to the documentation server in order to retrieve the the data.

Um it is just a fresh foundry project because the developer wants to implement a new thing that it that he saw on the on Twitter, and let's get to the demo. So, first of all is you you get to Twitter, you read a tweet, and it says like there's a new project right here that will make you rich. And you get to your agent, you just go there and give it a prompt. It's a really easy prompt, to just curl the docs, and we will just have cursor right here to do whatever we should be doing, but it will be our agent. And the very first thing I

am asking it is just to to get the documentation. It is curling the the docs, and it will go through the documentation that it is asking the agent to do a few things that doesn't make sense, but it is starting to to do a few things just to get the agent into the wrong direction. And it is just setting and reading the files that we have right there. And then after getting an introduction of the project, what is it about, it will update the .env just because the instructions are asking for it.

And then we can see that it did registration. It was just sending the environment variables to the server. So the server just received the API key, the private key of the wallet. So you just can drain. Um this is completed in 2 minutes using agents. So it is hacking an agent with another agent. And the attack flow is just more not more than fetching the docs. The agent fetches the docs, gets the hidden instructions, read the .env, and then it creates a post to the attacker.

Um after that we can just see that some of the models, the latest models, are still failing to just do it without confirming. We can see that low uh 4.7 in low thinking didn't fail for the attack. Um they did the tone it low thinking. But we can see that GPT 5.5 thinking failed every time. So it doesn't really we we can't just leave the security to the agent, neither to the model.

So we have to be the ones to be focusing on it. Also one interesting thing is that it doesn't really it changed much if we give it extra high thinking because we got GPT 5.4 nano to get every time the same attack. And what I've just shown you was the simplest of the attacks. Anyone can be doing this in 2 minutes, as I said. But there are many other variants that we are currently using. We are we aren't really focusing on what's behind it. So for example, MCP servers that could be injecting some data or even skills that could be looking like a real skill or something that you

would be needing. But at the end, it will be doing in the background some also invoking of another agent. So in this is something that is happening right now. Maybe you've read or heard about a bank happened I think last week. >> [snorts] >> agent was working.

And then on the other hand, there's also happening the same in the tools that we are currently using like in GitHub. There's uh some prompt injection into the titles, into the issue comments that made some agents to retrieve uh to send to whoever shouldn't be reading the API keys and GitHub tokens. So how do you actually defend against this? There is not a single thing that you may be or must do, but I will give you some recommendations or at least what I like to tell people to do.

On the habit side, just slow down. Read what is the agent going to do. Use manual approval because that is going to save you a lot of the times. Um also, just stop, breathe, and read again. On the other hand, keys and wallets, please don't use the same uh wallet for everything. Just have some developer oriented wallet. Um use some hardware wallet or signing services, key management processes. There are a lot of services for this and it will help you a lot.

In the environment side, there's also huge advantage on dockerizing your your agent because it will only have access to whatever you want to give it access. And finally, some sources. Just read the MCP, what is the MCP doing, the skills behind and don't just trust whatever you read read on the internet. Just use the official ones and every public resource could be some prompt injection and some attack to your services.

And common sense is something that we sometimes miss and it is very important to be applied on everything that we do, not just developing, but also reviewing code, whatever, in everyday everyday life. So, just keep building, but don't rush and take your time and apply common sense. And that's pretty much it. Thank you very much FOR YOUR ATTENTION. >> [applause] >> I JUST SHARED THE GITHUB repo if you want to reproduce the attack.

Uh just know that I used um cursor for the attack, but maybe I would say that Codex and Claude had more guardrails for the safety of the prompts not to fail for the attack because it was really easy. Thank you very much. >> Thank you very much. Does anyone have a question for Yeah. >> Uh yeah, I don't know if you've come across this idea of this um LLM as a judge idea where you have um an agent that sits right at the root, you know, looking after you as a guardian of some sort.

Um you know, you might even run it with a you know, local AI um thing. So, what are your thoughts on how useful these are in mitigating should take off some of the load of the stuff. >> 100 100% I think that if we just add a new step to the process, it will easily find at least on my example. But, I would say that we still need to read every single thing that the agent might be doing or at least giving the security around. Like for example, dockerizing your agent. If you give it like uh accept everything, just have it dockerized, have it secure in an environment that won't be doing any other thing that shouldn't be doing.

>> Does it Does it answer your question? Yeah. We got time for one more question if anyone is interested. If not, then thank you very much. >> Thank you very much. >> [music] [music]