Time Table

Coding agents routinely execute shell commands, modify files, and apply patches based on responses from remote model APIs. This means the model endpoint is not only a source of text, but also part of the local execution trust boundary.

Turncoat is an open-source proof of concept that implements a Codex-compatible API and supplies tool calls to an unmodified coding-agent client. It demonstrates how control of an inference endpoint or gateway can be translated into control of agent actions, without first compromising the client itself.

The session presents the threat model, the design of the control server, and a live demonstration of direct and proxied tool-call injection. It also examines the limits of existing defenses such as approval prompts, sandboxing, endpoint configuration, and execution logs, and discusses practical mitigations for organizations operating coding agents through custom providers or enterprise AI gateways.