BEGIN:VCALENDAR
VERSION:2.0
PRODID:Data::ICal 0.24
BEGIN:VEVENT
DESCRIPTION:   'Title: Hacking Your Life with AI Can Get You Hacked: How AI
 \n   Orchestration Platforms Ship RCE by Design\n   Tags: DEF CON Official
  Talk | Demo 💻 | Exploit 🪲\n   When: Saturday\, Aug 8\, 16:00 - 16:5
 9 PDT\n   Where: LVCCW Level 1 Hall 3 1006 (Main Track 1) and DCTV-1 - [1]
 Map\n\n   Description:\n\n   AI orchestration platforms promise to automat
 e your life. They\n   deliver\, just not always for you. Kestra\, Langflow
 \, Nocobase\, Flowise\,\n   Activepieces\, Dify\, and Apache Airflow have 
 quietly become critical\n   infrastructure\, and they all share the same d
 angerous assumption:\n   anyone who can touch a workflow is trusted to run
  code on the host. I\n   went hunting across seven major platforms and wal
 ked out with multiple\n   CVEs and critical-severity findings. I'll share 
 an arsenal of RCE\n   primitives: shell injection through template renderi
 ng\, exec() on\n   user-supplied "validation" code\, eval() on raw LLM out
 put\, and\n   unauthenticated API endpoints that hand you a shell. Then I'
 ll\n   demonstrate the kill shot: an unauthenticated attacker achieving fu
 ll\n   RCE through a single prompt injection into an LLM module. When I\n 
   reported these\, some vendors told me code execution is intended\n   beh
 avior and security is the deployer's problem. I'll show you why\n   that a
 rgument falls apart in real deployments\, and walk through the\n   trust b
 oundary failures that keep producing the same bugs across the\n   ecosyste
 m. You'll leave with a methodology for tearing these platforms\n   apart\,
  a catalog of recurring vulnerability patterns\, and a framework\n   for e
 valuating whether a platform's threat model survives contact with\n   real
 ity.\n\n   SpeakerBio:  Peyton "p80n-sec" Kennedy\, Endor Labs\n\n   Peyto
 n 'p80n-sec' Kennedy is a Senior Security Researcher at Endor\n   Labs\, w
 here he focuses on offensive security research\, vulnerability\n   discove
 ry\, and exploit development against the open source projects\n   shaping 
 modern software. His research has produced CVE disclosures\n   across wide
 ly deployed frameworks and platforms\, including koa.js and\n   openclaw\,
  with a consistent focus on the gap between what platforms\n   claim about
  their threat models and what they actually enforce.\n\n   '\n\n   1. #LVC
 CW_Level1_Hall3\n\n\n
DTEND:20260808T235900Z
DTSTART:20260808T230000Z
LOCATION:DEF CON Talks - LVCCW Level 1 Hall 3 1006 (Main Track 1) and DCTV-
 1
SUMMARY:Hacking Your Life with AI Can Get You Hacked: How AI Orchestration 
 Platforms Ship RCE by Design
END:VEVENT
END:VCALENDAR