BEGIN:VCALENDAR VERSION:2.0 PRODID:Data::ICal 0.24 BEGIN:VEVENT DESCRIPTION: 'Title: Living Off the IDE: From Initial Access to Covert C2 in Modern\n AI Code Editors\n Tags: Red Team Village | Misc\n When: Sunday\, Aug 9\, 12:00 - 13:59 PDT\n Where: LVCCW Level 1 Hall 1 309 (R ed Team Village) Tactic Table 4 -\n [1]Map\n\n Description:\n Format : Technical Talk with Live Demonstrations\n\n This talk presents a full intrusion lifecycle model centered on\n AI-assisted IDEs environments th at can be utilized during adversary\n emulation or red teaming engagemen ts:\n\n * Practical attack chains from delivery to C2\n\n * A rend ering-based covert exfiltration technique\n\n * A new persistence cate gory rooted in agent behaviour\n\n * Operational implications for red and blue teams\n\n This talk matters because it wakes up developers to t heir IDE's\n god-mode risks and how AI-assisted IDEs can be abused acros s the full\n intrusion lifecycle in the adversary emulation or for red t eam\n engangements\n\n A. Introduction - The IDE as an Execution Platf orm\n\n * Evolution of Modern AI-assisted code editors (Cursor\, Winds urf\,\n Trae\, agent-based IDEs)\n\n * Capabilities beyond code completion include repository indexing\,\n workspace task execution\ , structured rendering (Mermaid/Markdown)\,\n persistent agent rules and authenticated development tunnels\n\n * Threat model shift: IDE a s a high-value attack surface\n\n B. Threat Model & Attack Surface Expan sion\n\n * The Developer Blind Spot\n\n * Developer workstation as a Tier-0 asset\n\n * Trust boundaries introduced by workspace trust\, agent skill\n definitions\, rendering engines\, remote development features\n\n * Adversary objective: Living off the AI-driven IDE’s ( LOTIDE)\n\n Visual: Architecture diagram of developer environment attack surface.\n\n Unlike prior IDE abuse discussions that focus on single\n misconfigurations or extension risks\, this talk presents a full\n int rusion lifecycle model that chains multiple trusted IDE behaviors\n into an operational attack path. Our focus is not a single\n misconfiguratio n\, but how legitimate IDE features can be chained into\n a reliable ope rational intrusion path.\n\n C. Initial Access & Delivery\n\n We demon strate several practical initial access paths into AI-assisted\n IDE env ironments. These are not zero-day exploits. They are trust\n abuses that leverage legitimate functionality.\n\n Initial Access Techniques:\n\n * \n\n Workspace Auto-Execution (Task Hijack) Malicious tasks.jso n\n configurations configured to execute on folder open. When a\n developer clones and “trusts” a repository\, the task executes\n automatically within the IDE context. Each AI-assisted IDE handles\n this differently\, some block automatic execution by default if not\ n “trust”\, while others allow it automatically\, creating\n opportunities for abuse with minimal interaction.\n\n * \n\n Indirect prompt injection via agent skill packages Malicious agent\n skill definitions or rule files that subtly alter AI behavior\,\n i ntroducing hidden backdoor logic during code generation\,\n refactor ing\, or review.\n\n * \n\n SSH Remote Argument Injection Chains Introduce a novel\n exploitation vector and abuse of remote develop ment protocol to\n pass crafted arguments that lead to unintended co mmand execution\n in the AI-driven IDEs including bypassing applicat ion-implemented\n protection mechanisms.\n\n Delivery Mechanisms: We pair these techniques with realistic delivery\n vectors\n\n * \n\ n Spear Phishing via Developer Workflows Fake job offers or\n technical interviews where developers are asked to clone a\n reposit ory\, trust the workspace\, install required plugins\, or run\n setu p scripts. The attack chain blends into legitimate onboarding\n or a ssessment scenarios.\n\n * \n\n URI Scheme Abuse (“URIFix” V ariant) A ClickFix-style variant\n leveraging custom URI schemes (e. g.\, cursor://). A user clicks a\n crafted link that launches the de sktop IDE directly and triggers\n fileless code execution. This can be chained with SSH remote\n development features for further contro l.\n\n Live Demo 1: - Clone malicious repository\, trust workspace - Tru st\n bypass techniques and trigger automatic task execution - Demonstrat e\n code execution inside IDE context\n\n The following videos demonst rate our researched Cursor Initial Access\n Demos: SSH Remote Arg Inject ion + URI Scheme Abuse (URIFix) + Bypass\n\n D. Credential Harvesting & Context Mining\n\n AI-assisted IDEs store more than source code. As deve lopers use them\,\n they accumulate local data that often includes sensi tive information:\n\n * Chat history files containing past AI conversa tions\n\n * Temporary and generated files created during code edits\n\ n * Indexed repository content\n\n * Agent rule and configuration files\n\n During troubleshooting or development\, developers frequently paste API\n keys\, tokens\, environment variables\, database strings\, o r cloud\n configuration details into AI prompts. These inputs are then s tored\n locally as part of the IDE’s normal history and indexing mecha nisms.\n We demonstrate how an attacker with access to the IDE environme nt can\n extract this data directly from local storage. In many cases\, secrets\n are recoverable from:\n\n * Chat logs\n\n * Generated configuration snippets\n\n * Project setup files\n\n * .env and re lated environment files surfaced through indexing\n\n This does not requ ire privilege escalation or exploit development.\n Once execution is ach ieved inside the developer context\, the IDE\n itself becomes a reliable source of credentials and operational\n metadata.\n\n Our observation is that modern AI-assisted IDEs retain and organize\n sensitive develop er context. If that environment is compromised\, those\n stored interact ions become part of the attack surface.\n\n Live Demo 2: Demonstration v ia PowerShell script to detect AI-assisted\n coding tools and performs p ost-exploitation operations such as extract\n AI conversation logs inclu ding search credentials and collect\n artifacts or files generated by th e agent (e.g recover .env secrets\n surfaced through indexing) also pers istence techniques\n\n E. Rendering Engines as Exfiltration Channels\n\n Prior research has shown that structured rendering features inside\n AI-assisted IDEs such as Mermaid diagram previews and Markdown\n renderi ng can be abused to trigger outbound network requests during\n preview.\ n\n We build on this observation and incorporate it into a broader\n i ntrusion model. Rather than transmitting a file directly to an\n attacke r\, the flow becomes:\n\n Local secret → AI transformation → Rendere d output → External\n resource resolution\n\n In this model\, secret s extracted from local files (for example\, .env\n or configuration file s) can be embedded into: - Mermaid diagram\n definitions - Markdown imag e references - Click directives or external\n resource links\n\n When the content is rendered inside the IDE’s embedded webview\, the\n rend erer resolves external resources\, resulting in outbound HTTP\n requests that carry attacker-controlled parameters. From an endpoint\n monitorin g perspective: - The parent process remains the IDE. - The\n network req uest is tied to preview functionality. - No separate\n exfiltration tool is executed.\n\n The behaviour resembles normal rendering activity rath er than\n traditional data exfiltration. In our research\, we demonstrat e how\n this technique can be chained with initial access and persistenc e\n mechanisms to form a complete intrusion path.\n\n SpeakerBio: Edo Maland\n\n Redho Maland is senior offensive security consultant with ov er a\n decade of hands-on experience in penetration testing\, adversaria l\n simulation\, red teaming\, and active directory security. He also\n authored popular open-source tools such as TheFatRat\, Sudomy\, Brutal\, \n Vegile and others.\n\n He was invited and recognized as a cyber men tor and subject matter\n experts (SMEs) by EC-Council and Hack the Box ( HTB) for voluntary\n projects. He holds an industry certification in the offensive security\n domain including OSCE3\, OSCP+\, OSWP\, CRT(PEO) a nd ECPTX.\n\n He regularly manages and leads cyber offensive teams\, exe cuting\n complex and unique security engagements to ensure quality and\n successful outcomes across multiple projects\n\n '\n\n 1. #LVCCW_Le vel1_Hall1\n\n\n DTEND:20260809T205900Z DTSTART:20260809T190000Z LOCATION:Red Team Village - LVCCW Level 1 Hall 1 309 (Red Team Village) Tac tic Table 4 SUMMARY:Living Off the IDE: From Initial Access to Covert C2 in Modern AI C ode Editors END:VEVENT END:VCALENDAR