Sean
Sean Park is a reverse engineer and AI security researcher who hunts for blind spots in modern agentic systems. From prompt injections to compromised MCP servers, he uncovers how small flaws in AI workflows can trigger full-scale compromise. Whether analyzing Jupyter kernel traffic, tracing hallucinated dependencies, or stress-testing sandboxed agents, Sean blends automation, adversarial thinking, and low-level precision to stay ahead of emerging threats. His motto: every system can be mapped, exploited—and secured.
Session
AIxploit: Reliable Prompt Injection Exploits Against Database-Enabled AI Agents
Most prompt injection demos work once and fail the next — LLMs are stochastic, and a prompt that fires today may not fire tomorrow. Real attackers need exploits that fire consistently, at will, against production systems.
This talk is about what happens when you give an AI agent access to a database and then weaponise it reliably.
We present AIxploit, a framework for discovering reliable prompt injection exploits in agentic AI systems. Rather than hunting for a single successful injection, AIxploit generates large numbers of semantically diverse adversarial prompts and executes them repeatedly against agent workflows. The result is families of prompts that trigger underlying failure modes across model versions, configurations, and tool integrations — not flukes, but reproducible vulnerabilities.
To demonstrate real-world impact, we built four attack scenarios against modern agentic stacks using frontier model APIs, MCP servers, and database backends:
- Read-only bypass: Prompt injections embedded in ticket data cause a Postgres-connected support triage agent to execute multi-statement SQL queries, escaping its intended read-only constraints.
- Database ransomware: Injections manipulate a support automation agent into encrypting database fields via SQL updates. In testing across multiple frontier models, up to 26% of generated prompts successfully encrypted a target column — a ransomware-style attack that runs without any traditional malware.
- Sandbox escape via document: Malicious instructions embedded in .docx content cause a document processing pipeline to execute arbitrary Python and exfiltrate data from the processing environment.
- KYC pipeline hijack: A weaponised identity document manipulates a passport-scanning agent that writes to SQLite, compromising the verification workflow entirely.
These aren't one-off jailbreaks. AIxploit reveals the structural failure modes that make these attacks repeatable and shows that any AI agent operating a real backend is a potential target. Source code will be released on GitHub.