Before Your Code Runs: Exploiting Implicit Attack Surfaces

Kumar Ashwin at the podium on the Black Hat India 2026 stage — Black Hat India 2026

Black Hat India 2026 main stage during the briefing, seen from the audience — Black Hat India 2026

Host: Black Hat India 2026
Location: Room 1, Sheraton Grand, Brigade Gateway, Bengaluru, India
Audience: Application Security, Offensive Security Researchers, Developers, AppSec Teams
Duration: 40 minutes

Gave a 40-minute briefing on the Application Security: Offense track at Black Hat India 2026, Friday 30 October, 14:00, in Room 1 at Sheraton Grand, Brigade Gateway, Bengaluru.

The talk follows the path a developer already takes: clone, open, set up, write, commit, open a pull request, let CI run, ship. At each step, something else runs first.

Clone. A .npmrc reads as project registry config and redirects the next install. AGENTS.md reads as contributor docs and becomes instructions the agent follows.
Open. A VS Code task, a JetBrains sync, or an editor config can execute or retarget the toolchain when the folder opens. CLAUDE.md, AGENTS.md, and .cursor/rules load as orders, with no prompt.
Setup. pip install runs setup.py, importing a package runs __init__.py, npm install runs postinstall, cd can run .envrc, and .pth files plus sitecustomize.py run on every Python start. lote.guide catalogues those primitives by when they fire.
Write. The agent fills gaps with plausible names: a domain, a bucket, a package. Those names are often for sale. cot.run records the prompts, tool calls, and file edits so you can see what the agent did.
Commit and CI. A .githooks/pre-commit in the repo runs before your commit, switched on by a hooksPath line in ~/.gitconfig that setup wrote. On the pull request, a fork’s code, branch name, or title becomes input a workflow executes while it holds secrets. actsense audits that class of workflow risk.

Each of these is a feature. autorun.inf, then .pth, then AGENTS.md: the same primitive, thirty years apart. How that access starts, and what stays exposed after the breach is treated as closed, is the subject of The Breach Is Over. The Exposure Is Not.