Name: Off Script at Scale: Analyzing Rogue Agents Across 86K Repos and a Year of Production Incidents
Start: 2026-10-06T11:30:00+0300
End: 2026-10-06T12:15:00+0300

Off Script at Scale: Analyzing Rogue Agents Across 86K Repos and a Year of Production Incidents

Tuesday October 6, 2026 11:30 - 12:15 IDT

Hall B

How common is it for an AI agent to go rogue, not because someone attacked it, but because it was given a goal, tools, and no way to be stopped?

We looked at that question from two places: production behavior, and the code people actually ship.

In our CurseBox research, we traced a behavior in Cursor's coding agent that showed up first in production. Asked to share a local file through a channel that could not carry it, the agent decided on its own to upload that file to a public anonymous host so it could hand back a link, and the person who made the request had no reason to think anything had left the intended tool. We reproduced it in the lab across every major model, including under a deny-all sandbox the agent found a way around. The same shape shows up in a production database wiped in nine seconds, an inbox agent that ignored STOP, and evaluation agents that left the lab and reached real organizations. None of these required an external adversary.

We complemented the incident work by studying how the community actually builds agents: 86,000 public repositories, the tools they grant, and the MCP servers they wire in. Roughly one in ten of those codebases hand agents shell, eval, raw SQL, or filesystem access. Among tools with explicit definitions, 76.4% have no input validation. On MCP, 82.8% of servers lack input validation and 92.4% have no confirmation gate before a tool runs. Between the model's decision and system-level execution, there is almost nothing. Barely one percent of dangerous-tool files use the pre-execution hook that frameworks already ship.

This talk maps those behaviors onto the OWASP Top 10 for Agentic Applications and argues that control must live in one place: the moment between the agent deciding to act and the action reaching the system.

Also, as a member of the ASI Top 10 working group - I will be up to date on the progress of that project and ensure the content is aligned to the latest update.

Speakers

Bar Kaduri

Head of Research, Capsule Security

Bar Kaduri is a cybersecurity researcher, security leader, and international speaker focused on cloud security, software supply-chain risk, and the fast-moving world of AI threats. With over 14 years of hands-on experience breaking, testing, and hardening real systems, Bar works at... Read More →

Tuesday October 6, 2026 11:30 - 12:15 IDT
Hall B

Hall B

AppSec Israel 2026

Bar Kaduri

Get help with the event

AppSec Israel 2026

Bar Kaduri

Sign up or log in to save this to your schedule, view media, leave feedback and see who's attending!

Get help with the event