Hacking Your Life with AI Can Get You Hacked - How AI Orchestration Platforms Ship RCE by Design

The talk opens with a model of AI orchestration platforms. A workflow starts at a trigger such as a webhook, schedule or inbound message, passes through an LLM step, then reaches code nodes that run Python or JavaScript before producing an output. The speaker argues that these products assume anyone who can edit a workflow is trusted to run code on the host.

Across seven platforms, the speaker reports multiple CVEs and critical findings, grouped into recurring patterns. These include string-based filters that are easy to bypass, a sandbox hardening call that was commented out, eval and exec applied to LLM output, and a sandbox bootstrap ordered after the code it was meant to contain. Some endpoints needed no authentication at all. One demo chained a single prompt injection into an LLM module to reach remote code execution without logging in.

Vendor responses ranged from fixes to calling code execution intended behavior, with one project's own documentation teaching the vulnerable pattern. The talk closes with a five-step method for auditing these platforms: map inputs, trace sinks, check execution order, test reachability by low-privilege callers, and check the docs. Defenders are advised to require authentication on execution paths, disable dangerous flags, and assume persistent compromise.