Pietro Virgillito
Pietro is CTO and co-founder of MiniMako, where he builds kernel-level runtime security for Linux servers running autonomous AI agents.
Before MiniMako he spent fifteen years in operational cybersecurity: hardening critical infrastructure, reverse engineering, live incident response. Through 2024 and 2025, while claimed DDoS waves hit Italian banks, airports and ports, the systems he had hardened held, not because they reacted faster, but because there was no surface left to hit.
That is where his current work comes from. AI agents in production emit syscalls like any other process, but nobody watches them at that level: application logs capture prompts, not kernel calls. Pietro works on eBPF and LSM hooks to make what an agent actually does observable and stoppable, not what it claims to do.
Session
Nobody runs a bare AI agent. Everyone extends it: skills, MCP servers, plugins, hooks, subagents. Every one of those is, underneath, a folder of text that gets loaded into the model's context and read as instruction.
Which makes them a supply chain. One that gets reviewed exactly once, at install, and executed every session afterwards.
This talk poisons one, step by step. We write a skill that does what it advertises and one extra thing, and we look at where you put the payload so that the person installing it does not see it, not in the file they skim, but in the reference file that skill loads on demand. Then we do the version that actually matters: a clean skill, installed and approved three weeks ago, updated today. Four lines different. Nobody diffs an update.
Same trick without installing anything: MCP tool descriptions are context, so changing one after approval changes what the agent does with no code the user ever reviews. And repository content is read as task context by an agent that cannot tell instruction from data.
The point is what none of it requires: no exploit, no privilege escalation, no CVE. Every step uses capability that was granted on purpose.
Second half is defensive: which controls change the outcome, which ones only feel like they do, and what you can still reconstruct afterwards.