Etizaz Mohsin
Etizaz Mohsin is a cybersecurity researcher focused on advanced threat research and offensive security. His work has explored real-world attack techniques used by sophisticated adversaries, including research on NSO Group's Pegasus spyware, which he presented at Black Hat MEA. Earlier in his career, he investigated the DarkHotel espionage campaign targeting executives and diplomats through compromised hotel networks.
His research has been featured by outlets such as Forbes, BBC, Wired, TechCrunch and Al Jazeera. He has presented at international security conferences including Black Hat Middle East and Africa, HITCON, 44CON, CONFidence, DeepSec, SECTOR, Hacktivity, GreHack, HackFest, and Wild West Hackin' Fest.
Session
Forget prompt injection. While the industry obsesses over manipulating model inputs to bypass guardrails, it is overlooking a far more dangerous threat requiring no user interaction beyond opening the application embedded beneath the AI itself: the underlying platform architecture.
To deliver on the promise of full autonomy, AI-powered coding environments wire Large Language Models directly into the developer workflow—handing them local filesystem access, shell execution, and cloud credentials. Developers accept this tradeoff for the massive productivity gains, but the security cost is severe.
In these environments, privileged OS access is not a misconfiguration but a product requirement. For a chat interface to truly become an autonomous "agent," it must be equipped with tools. Equipping the AI with these tools creates a structural conflict with traditional application isolation, like Electron's security model. To make the AI function, developers are forced to break the sandbox and expose highly permissive IPC (Inter-Process Communication) bridges between the web renderer and the local operating system.
This presentation provides a technical deep dive into how chained IDOR vulnerabilities can be escalated into zero-click RCE via persistent LLM conversation injection and unsafe Electron IPC designs. To prove the real-world impact, we will debut novel research into Orchids, a leading local, Electron-based AI coding IDE with over a million users, reported to be used by teams