Slides and a tool release from my talk at c0c0n 2026 on the possibilities of tag boundary injection in AWS Bedrock Agent orchestration. The research attempted to answer whether an attacker who controls input can close, duplicate or forge the <thinking>/<answer> tags that Bedrock uses to drive an agent. The findings, and how model dependent the approach can be, are covered inside the post. Also releasing AWS Bedrock TagHammer, the harness/fuzzer I built to test all of this.
Open-sourcing awsjail - a login shell that only accepts aws ... commands. Users use standard SSH, land at an awsjail:<account-id>:<user> > prompt instead of bash, and can run scoped AWS CLI commands and nothing else. No shell or OS command access, no keys handed out, no internet access from the terminal with every command logged.
Slides and demo video from my talk at CyBe AI Summit 2026 (4th Sept, Bangalore) on Excessive Agency in context of AI Agent Execution - reconstructed from a real pentest where a “helpful” AI agent was the door in, chaining a debug tool, container access, a neighbouring internal agent, and overprivileged AWS IMDS creds into full cloud account compromise.
Wiring a Wi-Fi smart bulb into Claude Code’s hook system so it turns green while Claude works, red when it needs me, and white when it’s idle - no terminal glance required.
My take on using different models for different projects via Claude Code with some simple shell scripting and API Keys. Not as elegant as a model router but works very well for everyday tasks.
Writeup of a bug I found with Google Gemini for Gmail that allows for calendar entries to be created within victim calendars and also allows for Gemini to leak it’s system prompt by following instructions embedded in email body triggered when tools like summarization are called to operate on email threads.
Slides and some background of my talk at Vulncon Bangalore (June 2026) on how I convinced Amazon Q to perform an authorization check on itself, its tools and the results of that exploration. Interesting findings overall around IAM boundaries and tool/capability privileges.
A blog post about some post exploitation scenarios with MySQL, MSSQL, PostgreSQL and Oracle that use SQL Injection to make network requests resulting in Server Side Request Forgery/Cross Site Port Attacks.
A quick blog post to investigate what instance-identity security credentials are that can be generated using the metadata instance on every EC2 instance in AWS, even when no role is attached to the instance.
Slides of my talk on using mis-configurations, overtly permissive IAM policies and application security vulnerabilities to get shells in AWS EC2 instances and go beyond the plane of attack. Presented at OWASP Bay Area August 2019 meetup.
