HEK Club meeting: Scope manipulation in practice: How fake trust signals turn AI Agents into unauthorized attackers

  Kdaj:
 Ura:
 Kje:

22.06.2026
13:00:00
Online (Zoom),

As AI agents become increasingly involved in security testing, the question of trust becomes critical: how do they know what they are allowed to test and what happens when those trust signals are manipulated?

Join us for the next Club HEK meeting with Eduard Agavriloae, cloud offensive security researcher and ethical hacker, who will share practical insights into one of the emerging risks in AI-powered security testing: scope manipulation.

Date: 22 June 2026
Time: 13:00–14:00 CEST

About the Session

AI agents rely on authorization checks, tool responses, and network-level context to determine what they can test. This session takes a deep dive into scope manipulation, the practice of forging these trust signals to trick AI agents into testing targets they were not authorized to test.

Building on research presented at AiSEK 2026, we go beyond the theory with live demonstrations and practical scenarios that extend past web application testing. From spoofed authorization oracles and injected tool outputs to reverse proxy redirection and DNS-level deception, each technique is demonstrated against real agentic workflows.

The session closes with defensive recommendations for teams building or deploying AI-powered security tooling.

Key Topics

• AI agents and authorization boundaries
• Fake trust signals in agentic workflows
• Spoofed authorization oracles
• Injected tool outputs
• Reverse proxy redirection
• DNS-level deception
• Practical defensive recommendations for AI-powered security tooling
  
  

SPEAKER:

Eduard Agavriloae, Co-Founder and Director of R&D at OFFENSAI

Eduard Agavriloae is a cloud offensive security researcher and ethical hacker with over 8 years of experience specializing in AWS attack surfaces, cloud exploitation frameworks, and AI-powered adversarial systems.

He is the author of four open-source cloud exploitation tools, creator of four hands-on cloud hacking workshops, and a recurring speaker at DEF CON and DefCamp.

As Co-Founder and Director of R&D at OFFENSAI, he builds AI-driven adversarial validation systems that continuously discover, chain, and validate exposures in live cloud environments.

Who Should Attend

This session is intended for ethical hackers, penetration testers, red teamers, security engineers, AI security researchers, and everyone interested in the safe use of AI agents in cybersecurity.

Club HEK meetings are intended for Club HEK members.


Not a member yet?

Your first meeting is free of charge, giving you the opportunity to experience the community and its content before deciding whether to join.

We look forward to welcoming you to this practical and insightful session.

Contact

For more information, please feel free to contact us. We will be happy to answer your questions.

Melita Jurca
[email protected]
+386 31 657 722