Speaker: Stav Cohen, AI Security Research Lead at Zenity and PhD student at the Technion · Source: DEF CON 34 talk page

📄 Download this note as Markdown

Overview

Stav Cohen’s research focuses on breaking, and then fixing, AI agents — security vulnerabilities across agentic AI systems, LLM-powered applications, and enterprise AI platforms, including attacks on RAG pipelines, multi-agent delegation protocols, and agentic browsers. He introduced the concept of Promptware: a class of inference-time threats that turn GenAI models from helpful assistants into tools for data exfiltration, lateral movement, and physical-world consequences.

Notes

Building Websites That Compromise a Browser to Control Agentic Browsing Agents

• Goal: get it to buy something with the user’s credit card, or phish using WhatsApp
• When Atlas scrolls and stops, it reruns classifiers — build the website to spread malicious instructions all over the page, with multiple attempts to get past them
• Intent collision: mixes the user’s and the webpage’s prompts to trick the agent into malicious instructions (user asks for A, agent decides it needs to do B)
• Chained a call to Amazon’s Rufus assistant to buy something and change the shipping address

Comet — File System Exfiltration

Reverse-engineered Comet’s “add” button to get the agent to follow/click it, removing trigger words like “go,” “action,” “now” that classifiers watch for. A “meeting request” lure failed outright, but the agent still followed the link and the instructions to exfiltrate data to a remote server.

Comet and 1Password

Starting from a calendar invite, the agent can be walked into browsing to 1Password, downloading the emergency kit, and changing the password — opening the item in a background tab so the user doesn’t notice. Works with the Claude for Chrome extension too, and can also read MFA codes sent to Gmail in the browser.

Persistence

Chrome, Edge, Comet, and Atlas all use browser history for memory and persistence (Claude does not) — poisoning history gets treated by the agent as ground truth. Used this to get Chrome to finish deleting AWS servers; an open-source GitHub repo works as another poisoning vector.

Local Host

A calendar invite can get the browser to localhost, where local dev tools are used to interface — from there, local tools can run code (e.g. dropping user tables in a database). Worked in Comet and Edge; Chrome wouldn’t click the link. Was able to use a Jupyter notebook and terminal to set up the environment.

Filed Under: #defcon34