About the session
A developer on your team clones a repository. They hit Enter when Claude Code asks if they trust the project folder. That single keypress launches an MCP server from.mcp.json — a server they never reviewed, running as an OS process with their full filesystem access, live cloud credentials, and authenticated AWS CLI session attached. They never see a second prompt. They never know it happened. This is not a hypothetical. It is the documented behaviour behind CVE-2025-59536, reported by Check Point Research, and the TrustFall vulnerability class that Adversa AI demonstrated across Claude Code, Cursor, Gemini CLI, and Copilot in May 2026. The tools that make us productive — the agents that read our files, call our APIs, manage our repositories, and execute commands on our behalf — are now the primary targets. The Bitwarden CLI attack of April 2026 made this explicit: malware spent 90 minutes on npm specifically hunting for authenticated instances of Claude Code, Cursor, Codex CLI, and Gemini CLI. Not as collateral damage. As the objective. Prevention is necessary and insufficient. These tools exist to have persistent access to the things attackers want. The question is not whether that access can be locked down, it is what happens when it is not. That is where deception changes the equation.
This talk presents a deception framework for preemptive security of agentic systems. The core premise is simple: deception artifacts placed at every layer of the agent attack surface provide early, high-confidence alerts at each phase of the kill chain before damage is done, before exfiltration occurs, often before the attacker knows they have been detected. Unlike reactive controls that wait for known signatures or anomaly thresholds to breach, deception fires the moment an adversary touches something no legitimate agent workflow ever touches. The alert is not probabilistic.
The framework covers all four layers of the agent attack surface Identity and Credentials, Protocol Services, Agent Capabilities, and Supply Chain — and maps each technique to a specific phase of the attack kill chain: Discover, Harvest, Infiltrate, Escalate, Execute, Exfiltrate. At each phase, a named deception artifact intercepts the adversary and produces a triage signal before they advance to the next. The kill-chain interception map is the central contribution: a practitioner framework that tells security teams exactly where to place deception artifacts, what each one catches, and when the alert fires relative to the attack timeline.
The talk also covers what failed — three classes of techniques that appeared promising, survived initial design, and were discarded after adversarial testing — and closes with three open problems the framework does not yet solve: the semantic fingerprinting arms race against capable reasoning models, the operational cost of maintaining temporal indistinguishability at scale, and the self-defeating nature of publishing deception technique catalogs in the first place.
The central claim: Deception technology, deployed across the full agentic attack surface, provides preemptive security — early kill-chain alerts that fire before an adversary reaches a real asset. Every phase of the AI agent kill chain has a corresponding deception interception point. None of them require model changes or exotic infrastructure. All of them require engineering discipline and the commitment to maintain artifacts that degrade the moment they stop evolving.
