Black Hat Asia 2026 | Bad Vibes - Pwning Coding Agents 70 Times With The Same Bugs
Source: YouTube · Black Hat · published Aug 29, 2026 · 33:49
[BLUF]
Researchers from Palo Alto Networks identified critical vulnerabilities in major agentic IDEs, demonstrating how prompt injection can bypass security controls to achieve Remote Code Execution (RCE) through command injection, file system manipulation, and sandbox escapes [2:15].
Key Takeaways:
• Agentic IDEs rely on terminal tools that use allow lists to bypass user approval; attackers exploit this by chaining commands or using PowerShell syntax to execute arbitrary code without triggering safety prompts [4:22].
• File system protections are frequently bypassed using OS-specific features like NTFS short names, alternate data streams, and case-insensitive path matching, allowing unauthorized writes to sensitive configuration files [9:37].
• Modern sandboxing mechanisms, such as macOS Seatbelt policies, can be escaped by manipulating symlinks or exploiting race conditions during path resolution, effectively nullifying the isolation intended to protect the host system [20:06].
• The research highlighted that while vendors like Google, OpenAI, and Cursor fixed many issues, the threat model of "prompt injection leading to RCE" is often underestimated, resulting in persistent risks even after CVEs are assigned [7:33].
Closing Statement:
The study reveals that current security implementations in coding agents are insufficient against sophisticated prompt injections, urging users to treat these tools as untrusted and run them in isolated environments like VMs.
Sources:
- 1:33 Introduction to the agentic kill chain requiring model access, guardrail bypass, and impact.
- 3:05 Explanation of command injection vulnerabilities via terminal tool allow lists.
- 7:41 Overview of file system access risks and sensitive configuration scopes.
- 14:10 Discussion on the limitations of current mitigations and the move toward OS-level sandboxing.
- 19:23 Detailed explanation of sandbox escape techniques using symlinks and path resolution flaws.
Generate CPE Credits
Generate a professional CPE document from this video's transcript.
Estimated credit: 0.5 CPE hours
Estimate uses the video runtime (1 hour ≈ 1 CPE, rounded to the nearest 0.5, minimum 0.5, maximum 2.0). The final amount can be lower after review, never higher.
Topic: Cybersecurity. Commonly maps to: Security and Risk Management, Security Operations. Exact CISSP domains are assigned during generation.
Free account. One generation at a time, with a daily limit.
CPEBuddy is independent and not affiliated with or endorsed by ISC2, ISACA, or any certification body. Exports are formatted for common CPE submissions; acceptance is at your certification body's discretion.
Transcript Preview
First 800 characters of the transcript
Hello. Hi everyone, and welcome to our talk Bad Vibes. Where we are going to show you how we found more than 70 vulnerabilities in different coding agents using the same bugs. My name is Nir Ashkenazi. With me here today is Philip Zukerman, and we are vulnerability researchers in Palo Alto Networks. So, what are we going to talk about today? We're going to start with a quick intro to agentic IDEs, then go over command injection and file system vulnerabilities, through some cool sandbox escapes, and then get some practical conclusions. But before we start talking about agentic IDEs, let's talk about the OG IDEs. IDEs, in their core, are text editors. They have code search, syntax checking, easy refactoring, and many other features that are meant to help us to write and review code better. W…