Slides and a tool release from my talk at c0c0n 2026 on the possibilities of tag boundary injection in AWS Bedrock Agent orchestration. The research attempted to answer whether an attacker who controls input can close, duplicate or forge the <thinking>/<answer> tags that Bedrock uses to drive an agent. The findings, and how model dependent the approach can be, are covered inside the post. Also releasing AWS Bedrock TagHammer, the harness/fuzzer I built to test all of this.
Slides and demo video from my talk at CyBe AI Summit 2026 (4th Sept, Bangalore) on Excessive Agency in context of AI Agent Execution - reconstructed from a real pentest where a “helpful” AI agent was the door in, chaining a debug tool, container access, a neighbouring internal agent, and overprivileged AWS IMDS creds into full cloud account compromise.
Slides and some background of my talk at Vulncon Bangalore (June 2026) on how I convinced Amazon Q to perform an authorization check on itself, its tools and the results of that exploration. Interesting findings overall around IAM boundaries and tool/capability privileges.
Slides of my talk on the versatality of JavaScript, presented at JSFoo Coimbatore 2019.
Writeup of the Capture the Flag event at c0c0n 2011.
