Poster Archive

MCP-connected agents often read from and write to shared systems such as Slack, GitHub, Jira, email, and Notion. Most prompt-injection research focuses on a single agent, but this work asks a different question: can attacker-controlled context move from one agent to another and trigger actions with the second agent’s permissions? We present a two-hop propagation model. First, Agent A reads a poisoned MCP tool description and writes a carrier into a shared channel. Later, Agent B reads that content as part of its normal workflow and may perform unintended actions using its own tools. We count propagation only when Agent B performs an unintended tool call; simply reading the payload is not considered a successful chain. Using MCParasite in controlled and sandboxed environments, we reproduced end-to-end propagation in 21 of 26 channel tests. Every tested shared channel propagated at least once, although outcomes varied across models and context configurations. The poster explains how this propagation works, what we measured, and where defenders can break the chain through context separation, provenance tracking, least privilege, sensitive-action approval, and complete tool-call logging.

This research documents a 5-stage attack chain against a production LLM-powered support chatbot, executed under authorized bug bounty scope. Starting with nothing but a browser, an unauthenticated attacker can extract the complete system prompt, full infrastructure fingerprint, and internal tool schemas without any CVE, exploit code, or specialized tooling. Each stage exploits a distinct architectural failure, collectively illustrating how compounding design decisions create a complete information disclosure path in deployed agentic systems.

Three protocols launched in late 2025 to let AI agents shop and pay for you: Google's Agent Payments Protocol (AP2), Stripe and OpenAI's Agentic Commerce Protocol, and Visa's Trusted Agent Protocol. All three sign mandates, scope tokens, and separate roles. None of them treat the merchant's product description as input an attacker controls. We put text in one product-description field and walked it through AP2's reference implementation end to end. A registered merchant with an ordinary storefront is all it takes. We built five escalating attacks, each breaking a different part of the pipeline. The agent presented the wrong product. It then overrode a user who said no seven times. It carried the payload across the whole agent chain and cleared eight human-in-the-loop checkpoints, including the one-time-password step. It defamed a competitor's product with invented reviews. Finally, one poisoned listing corrupted a separate, unrelated purchase the user made later. Every attack produced a cryptographically valid, signed payment mandate for a transaction the user never approved.

Tool-using AI agents are vulnerable to indirect prompt injection: adversarial instructions hidden in tool outputs, RAG retrievals, and poisoned memory that can steer an agent to exfiltrate PII, take unauthorized actions, or corrupt records. Red-teaming for these failures is largely manual where teams build synthetic environments and hand-place payloads. This scales poorly across real deployments, and generic benchmarks miss deployment-specific policy. We present an end-to-end pipeline that turns the policy documents governing a deployment into artifacts a red-teaming framework can run. A policy mapper grounds each requirement to an evidence passage and maps it across four risk taxonomies; a scenario generator profiles the target system and produces concrete attacks as attack trees, actor profiles, and Gherkin specs; an artifact generator synthesizes a lean environment per scenario (deterministic codegen for schemas and tools, an LLM only for seed data) validated before any agent interaction. Red teaming frameworks that are unable to access the attack surface or observe the attack success behavior are flagged as unsupported for that scenario. Evaluation is fully deterministic, using predicate-based security checks and tool-call-sequence utility comparison. On a customer-service agent, the pipeline extracted 27 risks from one policy document and generated 31 scenarios across eight agentic threat classes, rendered for both Garak and AgentDojo. It extends to attacks such as denial of service, memory poisoning, and goal hijacking.

AI agents with powerful capabilities are being developed and deployed at an unprecedented pace. This rapid evolution presents a significant challenge for security, as traditional testing methods struggle to keep up. While manual red teaming offers deep insights, it cannot provide the continuous and broad coverage required to secure these dynamic systems. This poster explores the shift towards "Automated Prompt Injection Testing"—the use of automated systems to discover vulnerabilities in AI agents effectively and at scale. We will discuss why this approach is essential to match the speed of AI innovation and how embedding automated adversarial testing into the development lifecycle helps ensure that speed does not come at the expense of security. Learn about general principles and the benefits of proactively and continuously uncovering agentic vulnerabilities.

This talk started with a question: Could AI-generated code consistently create finished, usable projects through strict methodology and intent? Intent is the New Skill, right? At least, that was the idea I wanted to test through a series of projects. An automated CTF tool ended up being the most relevant—and the most fun. What came out of it was more than a tool. AI jumped from “help me check this code” to “build me a usable product” incredibly fast. With defined requirements, strict testing, evidence, and a lot of patience, intent really can collapse the skill barrier. The result was a CTF automation tool tested against public challenges with a high success rate. It also documents what it tried, what worked, what failed, and how it solved each challenge—turning it into a learning tool, not just an automated one. In this talk, I’m going to show you what worked, what didn’t, and how you can build your own safe starting point for AI red teaming using CTFs. At the end, I’m also giving you KEYSTONE—an LLM Agnostic Skill built from the lessons learned across hundreds of GitHub updates to help guide your own project from idea to deployment. AI red teaming is here. Let’s build something useful with it.