The conversation around AI security often gets stuck in theoreticals about superintelligence or hand-wringing over prompt injection in a chatbot. Kinnaird McQuade's talk cuts through that noise with a concrete, deeply uncomfortable demonstration: he built a worm. Not a traditional malware sample, but an AI-driven agent designed to abuse coding tools, pivot through cloud environments, and execute tasks with a level of autonomy that surprised even him. This isn't a speculative threat model; it's a walkthrough of practical attack chains using today's open-weight models and agent frameworks. McQuade details the progression from simply steering a coding agent to fine-tuning a model for explicitly malicious purposes, layering on skills that triggered emergent, unscripted behaviors. For practitioners who live in the cloud and are integrating AI into their pipelines, this talk provides a rare look at the offensive playbook that is being written right now. You'll leave with a clear understanding of how these agents propagate, the specific cloud services they abuse, and the defensive gaps that make it all possible.
Key Takeaways
- A practical methodology for abusing AI coding agents to execute multi-step attack chains across cloud environments, not just in isolated sandboxes.
- How fine-tuning an open-weights model on malicious examples dramatically lowers the barrier to creating an AI worm with persistent, goal-oriented behavior.
- Specific emergent behaviors observed when the worm was given additional skills, including unplanned lateral movement and evasion-like patterns.
- The critical cloud services and trust relationships (implicit in agent-to-API interactions) that the worm exploited to propagate without traditional malware signatures.
- A defender's framework for reasoning about this new attack surface, focusing on the intersection of agentic AI permissions, identity, and runtime visibility.
Who should watch: Cloud security architects, detection engineers, and AppSec leads who are integrating or governing AI coding assistants and agentic workflows within their SDLC and cloud infrastructure.
Why This Matters
McQuade's worm is a harbinger of the shift from attacking models to attacking the agentic supply chain. The real vulnerability isn't the model's alignment; it's the over-privileged execution context we hand to autonomous tools without runtime guardrails.
