---
source: https://info.defcon.org/defcon34/content/66951
created: 2026-08-09T12:03:00
---
[Stav Cohen](https://info.defcon.org/defcon34/people/67935)

## Overview

Stav Cohen is an AI Security Research Lead at Zenity and a PhD student at the Technion, Israel Institute of Technology. His research focuses on breaking, and then fixing, AI agents, spanning security vulnerabilities across agentic AI systems, LLM-powered applications, and enterprise AI platforms. He discovers new attack vectors, develops remediation strategies, and works to drive the industry toward stronger security practices. His offensive security work spans attacks on RAG pipelines, multi-agent delegation protocols, agentic browsers, and production-scale GenAI systems. He introduced the concept of Promptware: a new class of inference-time threats that exploit GenAI models through malicious prompts, turning them from helpful assistants into tools for data exfiltration, lateral movement, and even physical-world consequences. He presents his findings at leading security venues across the world. His PhD research focuses on the secure integration of Generative AI into real-world infrastructure, particularly Cyber-Physical-Human Systems involving human-in-the-loop interactions, such as smart water networks and GenAI-powered virtual assistants. He explores how GenAI agents can be safely and effectively integrated into these environments to support real-time decision-making, anomaly detection, and human-machine collaboration. He is also a thought leader in the AI security space, sharing knowledge through conference talks, blog posts, and community engagement.

## Notes

### How to Build Websites That Compromise a Browser to Control Agentic Browsing Agents
- Goal: get it to buy something with the user's credit card, or phish using WhatsApp
- When Atlas scrolls and stops, it reruns classifiers
	- Build the website to spread malicious instructions all over the page, with multiple attempts to get past the classifiers
- Intent Collision
	- Mixes the user's and the webpage's prompts to trick it into malicious instructions
		- User asks for A but the agent decides it needs to do B to accomplish it
- For shopping
	- Chained a call to Amazon's Rufus assistant to buy something and change the shipping address

### Comet — File System Exfiltration
- Reverse-engineered Comet's "add" button to get the agent to follow/click it
- Removed words like "go," "action," "now" since they can trigger classifiers
- The "meeting request" lure failed, but the agent still followed the link and the instructions to exfiltrate data to a remote server

### Comet and 1Password
- Started with a calendar invite
- Which lets you browse to 1Password, download their emergency kit, then change the password
- This also works using the Claude for Chrome extension
- Can open the additional item in a background tab so the user doesn't see what's happening
- Can also be used to read the MFA code sent to Gmail in the browser

### Persistence
- Chrome, Edge, Comet, and Atlas use history for memory and persistence (Claude does not)
- Use poisoning to add things to the browser history, which the agent treats as ground truth
- Can also read browser history and search history
- Used Chrome to finish deleting AWS servers
- Or an open-source GitHub repo, as another poisoning vector

### Local Host
- Use a calendar invite to get the browser there
- Then go to localhost, where local dev tools are used to interface
- Then can use local tools to run code
- For example:
	- Drop user tables in a database
	- Worked in Comet and Edge; Chrome would not click the link
- Was able to use a Jupyter notebook and terminal there to set up the environment