The Line-Up
// one single track.

AI coding agents such as Claude Code, Cursor, and OpenAI Codex have rapidly become part of the daily developer workflow, yet their security model is still treated as an extension of the editors and CLIs they are built on. This talk presents Agent2Shell: 13 previously undisclosed vulnerabilities, found entirely by manual analysis of shipping binaries, that achieve arbitrary code execution across these three agents.

The defining property of these issues is that the AI model is never invoked. Code execution is reached the moment a victim opens a repository, double-clicks a .code-workspace file, or runs an ordinary shell command with output redirection. By the time the agent begins to respond, calc.exe is already running. The findings are grouped into three escalating tiers by required interaction: 0-click (open a folder, a double-click, a piped command), 1-click (approving a deliberately faint trust dialog, pressing F5, opening a terminal with Ctrl+`), and 1-prompt (the agent itself carries the attack to completion when asked to do something as benign as "show me recent changes").

Every finding is shown end-to-end with a live demonstration and grounded in the actual decompiled code path. The talk closes with three structural trust-boundary failures common to all 13 issues, mapping each agent's design decision to the initial-access primitive it creates.

All findings have been responsibly disclosed to the respective vendors, and the public release is being coordinated with them.