[Disclaimer: The opinions, insights, and perspectives shared in this session are solely my own and do not reflect those of my current or past employers, nor do they convey any confidential information by any means.]

Note (07/11/26): Awaiting employer approval before sharing the detailed and complete session description to respect guidelines and comply with policies.

Overview:
In July 2026, Sysdig documented JadePuffer - the first confirmed fully autonomous agentic ransomware campaign: reconnaissance, credential theft, lateral movement, privilege escalation, and file encryption, end-to-end, no human at the keyboard.¹ The breach window for agentic AI attacks has collapsed to 22 seconds from initial access to handoff - compared to approximately 8 hours in traditional attacks.² CVE-2025-53773 (CVSS 9.6) demonstrated that a hidden prompt injection in a pull request description could trigger remote code execution through GitHub Copilot; CVE-2026-22708 let attackers poison Cursor's execution environment, allowing arbitrary payloads to be delivered.³ This is not a theoretical threat surface. The attack chain is documented, reproducible, and it targets developers and the tools they trust. This session breaks down how promptware actually works, how the kill chain executes, and what defensive architectures can actually stop it - not the ones that look good in a slide deck.

Structure:
Part 1: The Promptware Kill Chain - Anatomy of an Agentic Attack
(Prompt Injection → Tool Misuse → Lateral Movement → Exfiltration)
Prompt injection is not a chatbot annoyance - it is a multi-stage malware delivery mechanism. We walk through the documented attack progression: indirect injection via retrieved content, tool invocation using the agent's own authorized credentials, lateral movement through MCP server trust boundaries, and data exfiltration through communication channels the agent was designed to use. The JadePuffer kill chain is the case study. Every stage is mapped to a concrete TTP. No marketing diagrams - actual attacker decision-making reconstructed from incident reports.

Part 2: The Developer Supply Chain Is the New Perimeter
(Malicious MCP Servers, IDE Injection & CVE Walkthrough)
Researchers caught the first malicious MCP server in the wild in 2026: a package that shipped fifteen clean versions before quietly adding a single exfiltration line.⁴ CVE-2025-6514 (CVSS 9.6) hit the core MCP infrastructure used by hundreds of thousands of developers. CVE-2025-53773 hit GitHub Copilot via a PR description. The pattern is consistent: attackers are poisoning the content that developer-facing AI agents are designed to trust - code comments, documentation, pull requests, and retrieved context. We cover the attack anatomy, the trust model that makes it work, and why traditional SAST/DAST pipelines don't catch it.

Part 3: Defensive Architecture That Actually Works
(What Stops the Kill Chain and What Doesn't)
Model-layer filtering doesn't stop promptware - the attack bypasses it by design. We cover the architectural controls that actually interrupt the kill chain: tool call validation and schema enforcement at the integration layer, least-privilege service account scoping per the CNCF agentic standards, just-in-time credential provisioning, MCP server isolation, and runtime anomaly detection as the last-resort signal when upstream controls fail. We also cover what doesn't work - and why teams keep deploying it anyway.

Attendees leave with:
- A concrete threat model for promptware attacks mapped to documented 2025–2026 CVEs and incidents
- The kill chain decomposition from the JadePuffer and GitHub Copilot incidents in defender-actionable form<|join|>- The kill chain decomposition from the JadePuffer and GitHub Copilot incidents in defender-actionable form
- An architectural checklist of controls that interrupt the promptware kill chain at each stage
- A clear taxonomy of what model-layer vs. architecture-layer vs. runtime-layer defenses actually cover - and their gaps

This is not about whether AI is going to be used offensively. It already is, autonomously, against production systems. The question is whether your defenses were built for the threat that actually exists.

Citations:
¹ Sysdig / CyberScoop, "Sysdig clocks first documented case of agentic ransomware (JadePuffer)," July 2026. cyberscoop.com
² Jazz Cyber Shield, "Agentic AI Cyber Attacks in 2026: The 22-Second Breach Window," 2026. blog.jazzcybershield.com
³ Vectra AI, "Prompt injection: types, real-world CVEs, and enterprise defenses," 2026. vectra.ai
⁴ Blog.cyberdesserts.com, "AI Agent Security Risks 2026: MCP, OpenClaw & Supply Chain," 2026.

Sources:
- Sysdig - Agentic ransomware JadePuffer via CyberScoop: https://cyberscoop.com/sysdig-judepuffer-ai-agentic-ransomware-attack/
- The Promptware Kill Chain - arXiv: https://arxiv.org/pdf/2601.09625
- Agentic AI Cyber Attacks: The 22-Second Breach Window: https://blog.jazzcybershield.com/agentic-ai-cyber-attacks/
- Prompt injection: types, real-world CVEs, and enterprise defenses: https://www.vectra.ai/topics/prompt-injection
- Agentic AI Used to Conduct Ransomware Attack via Langflow - SecurityWeek: https://www.securityweek.com/agentic-ai-used-to-conduct-ransomware-attack-via-langflow/