1. Introduction: Why we need a new Top 10 list distinct from the LLM Top 10. 2. The Agentic Architecture: Understanding the shift in inputs and outputs. 3. The OWASP Agentic Top 10 in Action: Breaking down real-world attacks. 4. Key Mitigations: Actionable steps you can implement tomorrow morning. 5. Where to Start: How to become the AI security champion in your organization. 6. What’s Next: Joining the movement and shaping the future of agentic safety.
1. **[Alex] Building & defending the bot** (~7 min) — How AlexBot was built on OpenClaw: multi-agent architecture (Opus + Sonnet), SOUL.md identity, persistent memory, real calendar/contacts, 18 custom skills. The nightly arms race: Group Guardian, Prompt Protection v2.1, circuit breakers, 4-layer defense pipeline. What it's like watching 240 people try to break your creation in real-time. The full bot setup is open-sourced at github.com/alexliv1234/alexbot. 2. **[Asaf] What didn't work** (~3 min) — Classic prompt injection, encoding tricks (Base64/ROT13/URL), direct system prompt requests. The bot learned to block these within days. Why single-shot attacks fail against adaptive agents. 3. **[Asaf] What actually worked — 14 attack patterns** (~15 min) — The core of the talk. Each pattern with verbatim Hebrew examples + English translations:
- System prompt extraction via "theoretical" framing - Weaponizing the agent's own vulnerability disclosures (reconnaissance → exploit in 5 minutes) - Multi-turn trust manipulation (60-exchange social engineering — the highest-yield attack) - Gaslighting / perception manipulation (agent doubts its own logs) - Emotional wrapping / attention misdirection - Authority impersonation + context window flooding - State inconsistency exploitation (real bug → social engineering escalation) - Multi-layer encoding + multi-language obfuscation - Autonomy persuasion → self-modification (agent rewrites its own SOUL.md) - Mass jailbreak barrage (40+ attacks, defense fatigue) - Helpful mode as reconnaissance (agent teaches its own architecture) - Multi-vector social engineering escalation (8-phase attack chain: emotions → fake evidence → philosophy → crisis → legal threats) - False memory implantation (fabricating sensory-detailed interactions that never happened) - Inverted reconnaissance (probing what the agent rewards instead of what it blocks) 4. **[Asaf] Key findings** (~5 min) — The 10 findings that generalize beyond this bot:
- Recognition ≠ resistance (the headline) - Multi-turn > single-shot - Agents disclose their own attack surface - Identity and values are the primary attack surface - Agents cannot reliably self-assess their security state - Helpful mode is incompatible with architecture secrecy 5. **[Both] What this means for your agents** (~5 min) — How these patterns map to any LLM agent with conversational access + tool use (OpenClaw, Claude Code, Copilot, custom frameworks). Architectural mitigations that work vs. filtering approaches that don't. Alex on what he'd do differently; Asaf on what defenders should prioritize.
**Dataset:** 4,647 messages, 2,183 bot responses, 1,275 scored interactions, 96 participants, 240-member WhatsApp group, Feb 2 – Mar 4, 2026 (31 days). 585 successful attacks (Hacked > 0, 45.9%). Structured CSV with all scoring dimensions available. Bot's open-source setup at github.com/alexliv1234/alexbot (9,400 session files, architecture diagrams).
**Tools/techniques covered:** Prompt injection variants, social engineering, context window manipulation, multi-language obfuscation, identity-driven self-compromise, state corruption.
**Why OWASP should care:** The OWASP Top 10 for LLMs covers injection and data leakage, but the dominant threat class in this dataset — multi-turn social engineering — has no current OWASP coverage. This talk provides concrete field evidence for what's missing.
**Original content:** Alex presented the builder/defender perspective at a local Tel Aviv meetup ("Hack My Agent" on Luma). This talk combines both perspectives for the first time — Alex on building and hardening, Asaf on the systematic attack analysis. The combined narrative (builder + attacker), the full 14-pattern taxonomy, and the 10 key findings have not been presented together anywhere. The methodology (crowd-sourced adversarial analysis) and the taxonomy are original research.
**Vendor-neutral:** Asaf works in AI security at Microsoft, Alex is CTO at Esh. This talk is about the research findings, not any product. Attack patterns apply to any LLM agent platform.
>> Problem: Static analysis produces vast amounts of semantic data. Effectively exploring it remains an open challenge.
>> Why naive LLM approaches fall short: LLMs can not ingest entire repositories. They are fundamentally constrained by context limits. Even the most powerful models cannot reason over thousands of files and millions of tokens. Raw source code seems like the wrong abstraction layer for finding vulnerabilities.
>> Our approach: Use LLMs as adaptive query planners over a language-agnostic semantic interface. The model incrementally enumerates endpoints, traces data flows, refining its strategy based on solver feedback.
Starting from an empty context, the LLM planner interprets solver responses as either positive or negative signals.
Positive signals include fast query resolution times, indicative naming patterns of functions and variables, and relevant constant strings or regular expressions.
Negative signals include deep class inheritance hierarchies, heavy method overriding, and high-cardinality "fan-in" regions.
These signals allow the planner to balance vulnerability likelihood against exploration cost
>> Advantages: - reducing context window dramatically - full observability through inspection of chosen queries - compliance-friendly: auditable and reproducible analysis - future work: learn from logs of query strategies
>> Open source implementation: - The solver and semantic interface are open source: https://dhscanner.org/docs/
>> Evaluation: - discovery of a previously unknown vulnerability in a highly starred open-source Typescript repo ( confirmed by the maintainers and fixed upstream: https://github.com/formbricks/formbricks/releases/tag/4.0.0 - security section ).
So ... Hi ! If you're reading this there is a good chance you're coming to OWASP IL 26 - excellent ! Over the years, I've had the opportunity of speaking at international conferences, but for me, nothing is more exciting than giving a talk right here at home. The heat, the humidity... Read More →
Tuesday October 6, 2026 14:00 - 14:45 IDT Keynote Hall
OpenAI designed ChatGPT's container sandbox as a secure runtime environment, enforcing full network isolation, strict execution timeouts, and an AI supervisor to filter every command. Under this model, owning the container and extracting sensitive data seemed impossible. However, we demonstrate that by chaining file-parsing abuse for persistent execution, reasoning-channel hijacking for data extraction, and shared infrastructure manipulation, an attacker can establish a Cross-tenant data exfiltration.
In this talk, we will demonstrate a complete attack chain that shatters ChatGPT's secure sandbox. By abusing spreadsheet file parsing, we bypass the LLM supervisor to gain persistent, unmonitored root execution. From there, we escalate the attack by live-patching the internal Jupyter kernel to hijack the model's hidden python.exec reasoning channel, executing a Reasoning Injection Attack to extract sensitive user data. To exfiltrate this data, we bypass network isolation by weaponizing the Task Scheduler to launder malicious URLs past strict web guardrails.
The attack reaches its climax by exploiting a shared JFrog package manager. We engineered a signaling protocol that weaponizes globally visible authentication rate limits, translating these lockout timers into a half-duplex covert channel. This provides reliable data exfiltration and Command and Control from isolated enterprise environments to external attackers. Our exploit chain combines file parsing abuse, Chain of Thought hijacking, privilege confusion, and rate limit Denial of Service to orchestrate a Command and Control (C2) network directly inside ChatGPT.
A single fake bug report, planted in ordinary Sentry telemetry, drove the AI coding agents of more than 100 organizations, including a Fortune 100 technology company, to run attacker code with the developer's own privileges. Success rate: 85%. Controls that fired: zero. This was our Agentjacking research. Faced with this, security teams are reaching for a new generation of in-context guardrails, prominently A2AS (Behavior Certificates, Authenticated Prompts, Security Boundaries, In-Context Defenses, and Codified Policies), backed by OpenAI, Google, and Anthropic. These controls are built to catch exactly this: instructions smuggled in as untrusted data. This session shows they are not enough. The technique hides malicious instructions inside data the agent already trusts: a tool response, an MCP return, a line of telemetry. The agent reads it, acts on it, and reports normal operation. Every step is authorized, so perimeter and policy controls stay silent. We take this straight at A2AS and bypass its controls to reach code execution and credential access. The root cause is structural: agents cannot separate data from instructions, and no static guardrail changes that. Runtime enforcement is the only layer that stops it. Walkthrough and real attack logs included.
Nevo Poran is co-founder and CTO of Tenet Security, where he leads the research and engineering behind its platform for securing autonomous AI agents as they act. Before Tenet, he was part of the founding team of Cisco's AI Defense and led some of the first agent-security research... Read More →
Tuesday October 6, 2026 15:45 - 16:00 IDT Keynote Hall
