Beyond Prompt Injection: Practical Security Engineering for Agentic Systems

Gave a 30-minute talk on the Research and Technical track at c0c0n 2026, 9 October, 16:00-16:30, in Grand Ballroom 3.

The talk is about agents that run the software line: reading a ticket, writing the fix, opening the pull request, reviewing it, and deploying, with a human at the gates. Securing the pipeline still leaves the operator, the agent writing into it, as its own trust problem. The question to ask is what that agent is allowed to do.

I walked a single scenario, a trial user who can only file a bug report, across five trust boundaries:

• Input trust. Text the agent will read enters as part of the task.
• Agent authority. That text becomes a goal, and the agent already holds commit rights, tools, and a CI token.
• Execution. Untrusted code runs with the agent’s shell, credentials, and network.
• Supply chain. The change edits the pipeline, then the same system reviews it.
• Production. A low-risk auto-approval carries it through to live secrets.

Each boundary gets a gate: provenance on inputs, least privilege on the task, a sandbox with short-lived credentials, a human when CI or permissions change, and a risk check before production. The last piece is a trace of the prompts, tool calls, and file edits, so you can see where an attack stopped. That trace is what cot.run records.

Slides

1 / 35