Conference recordings are now online!

Conference recordings are now online!

We've highlighted a few talks worth checking out:

• The Onion Shell: Zero-Install Tor From the Browser. The author runs the Arti Tor client directly in the browser: WebAssembly eliminates the need to install an application, while Snowflake routes traffic through a network of WebRTC proxies. In the demonstration, a malicious XLSX file establishes a covert C2 channel over Tor.

• Autonomous Exploitation at Scale. The talk presents a prototype of a self-propagating worm powered by local LLMs. The system enumerates services, finds and adapts public exploits, verifies remote command execution, modifies its loader, and propagates to additional hosts.

• Riding the Pipe: Hack Wi-Fi and Meshtastic via Browser With Cheap Microcontrollers. The author uses ESP8266 and ESP32 microcontrollers as radio interfaces controlled through Web Serial, a browser API for accessing serial devices. The tool can send arbitrary Wi-Fi and LoRa packets, perform deauthentication attacks, create rogue access points, and attack Meshtastic, a decentralized messaging network.

• Honeypotting AI Agents. OpenA2A deployed 22 decoy AI agents and analyzed 1.4 million webpages, finding 272 embedded instructions across 224 sites. In the demonstration, a prompt injection placed on a webpage causes an agent to attempt to send data through an HTTP POST request.

• Non-Human Identity — The Gaping Security Hole That Agents Are Making Worse!. The author examines attacks against machine identities, including finding secrets on workstations and in CI/CD environments, stealing OAuth tokens, compromising third-party integrations, and using excessive permissions and MCP servers for lateral movement through AI agents.