#OOTB2025BKK Agentic ProbLLMs: Exploiting Al Computer-Use And Coding Agents

Speaker

Johan (EA red team director; independent researcher) introduces Agentic ProbLLMs, demonstrating LLM brittleness—models misclassifying images and answering 1+1 incorrectly under adversarial conditions.

Threat taxonomy

He layers risks from bad prompting and misalignment through jailbreaking to prompt injection, where third parties control inference inputs (web pages, uploads), impacting confidentiality, integrity, and availability.

Persistent compromise demo

Building on prior Trust No AI work, he showed ChatGPT memory weaponized via attacker-controlled content: infections persist in long-term memory, poll GitHub for C2 instructions, alter behavior across sessions, invoke tools, and exfiltrate data—partially mitigated recently for image-based exfiltration.

Agents

Defining agents as software that perceives, reasons, decides, and acts autonomously, he links them to Boyd's OODA loop and warns computer-use/coding agents amplify prompt-injection impact when adversaries influence the agent loop.