BEGIN:VCALENDAR
VERSION:2.0
PRODID:-//pretalx//cfp.romhack.io//romhack-camp-2026//talk//U8LFED
BEGIN:VTIMEZONE
TZID:CET
BEGIN:STANDARD
DTSTART:20001029T040000
RRULE:FREQ=YEARLY;BYDAY=-1SU;BYMONTH=10
TZNAME:CET
TZOFFSETFROM:+0200
TZOFFSETTO:+0100
END:STANDARD
BEGIN:DAYLIGHT
DTSTART:20000326T030000
RRULE:FREQ=YEARLY;BYDAY=-1SU;BYMONTH=3
TZNAME:CEST
TZOFFSETFROM:+0100
TZOFFSETTO:+0200
END:DAYLIGHT
END:VTIMEZONE
BEGIN:VEVENT
UID:pretalx-romhack-camp-2026-U8LFED@cfp.romhack.io
DTSTART;TZID=CET:20261003T102000
DTEND;TZID=CET:20261003T110000
DESCRIPTION:Nobody runs a bare AI agent. Everyone extends it: skills\, MCP 
 servers\, plugins\, hooks\, subagents. Every one of those is\, underneath\
 , a folder of text that gets loaded into the model's context and read as i
 nstruction.\n\nWhich makes them a supply chain. One that gets reviewed exa
 ctly once\, at install\, and executed every session afterwards.\n\nThis ta
 lk poisons one\, step by step. We write a skill that does what it advertis
 es and one extra thing\, and we look at where you put the payload so that 
 the person installing it does not see it\, not in the file they skim\, but
  in the reference file that skill loads on demand. Then we do the version 
 that actually matters: a clean skill\, installed and approved three weeks 
 ago\, updated today. Four lines different. Nobody diffs an update.\n\nSame
  trick without installing anything: MCP tool descriptions are context\, so
  changing one after approval changes what the agent does with no code the 
 user ever reviews. And repository content  is read as task context by an a
 gent that cannot tell instruction from data.\n\nThe point is what none of 
 it requires: no exploit\, no privilege escalation\, no CVE. Every step use
 s capability that was granted on purpose.\n\nSecond half is defensive: whi
 ch controls change the outcome\, which ones only feel like they do\, and w
 hat you can still reconstruct afterwards.
DTSTAMP:20260921T191006Z
LOCATION:STAGE 2 (Ghost in the Shellcode)
SUMMARY:How to poison a skill\, and why nobody reviews it twice - Pietro Vi
 rgillito
URL:https://cfp.romhack.io/romhack-camp-2026/talk/U8LFED/
END:VEVENT
END:VCALENDAR