Prompt-Jacking: The Rise of a New Supply Chain Risk - Kasimir Schulz & Kenneth Yeung

This talk was recorded at NDC Toronto in Toronto, Canada. #ndctoronto #ndcconferences #developer #softwaredeveloper Attend the next NDC conference near you: https://ndcconferences.com https://ndctoronto.com Subscribe to our YouTube channel and learn every day: / @NDC Follow our Social Media! https://www.facebook.com/ndcconferences https://twitter.com/NDC_Conferences https://www.instagram.com/ndc_conferences/ #ai AI coding assistants are rapidly becoming part of every developer’s workflow, but what happens when the very tools meant to help are turned against you? In this session, we’ll walk through real vulnerabilities we uncovered in Cursor, including arbitrary code execution and data exfiltration, showing how attackers can compromise developers through nothing more than hidden text in a codebase. We’ll then expose the invisible attack vectors unique to agentic AI, where malicious prompts silently shape behavior and propagate through codebases like a supply chain infection. Finally, we’ll share practical strategies developers and organizations can use today to defend against prompt-jacking and secure the future of AI-assisted development.