BEGIN:VCALENDAR
VERSION:2.0
PRODID:-//pretalx//pretalx.com//bsides-tallinn-2026//talk//3G7EGU
BEGIN:VTIMEZONE
TZID:Europe/Helsinki
BEGIN:DAYLIGHT
DTSTART:20250925T000000
TZNAME:EEST
TZOFFSETFROM:+0300
TZOFFSETTO:+0300
END:DAYLIGHT
BEGIN:STANDARD
DTSTART:20251026T040000
RDATE:20261025T040000
TZNAME:EET
TZOFFSETFROM:+0300
TZOFFSETTO:+0200
END:STANDARD
BEGIN:DAYLIGHT
DTSTART:20260329T040000
RDATE:20270328T040000
TZNAME:EEST
TZOFFSETFROM:+0200
TZOFFSETTO:+0300
END:DAYLIGHT
END:VTIMEZONE
BEGIN:VEVENT
SUMMARY:Who Said the Agent Could Do That? Catching the Correctly-Signed\, 
 Out-of-Mandate Action - Anton Sokolov
DTSTART;TZID=Europe/Helsinki:20260925T163000
DTEND;TZID=Europe/Helsinki:20260925T171500
DTSTAMP:20260926T112157Z
UID:pretalx-bsides-tallinn-2026-3G7EGU@pretalx.com
DESCRIPTION:Your AI agent holds your keys. Every signature it produces ver
 ifies. So who checks that it stayed inside the job you actually gave it?\n
 \nThis is a live-demo talk with one public sandbox you can attack from you
 r seat.\n\nWe walk the spectrum of machine-checkable legitimacy. BotGuard 
 asks whether a human is at a browser\, with no anchor at all. Private Acce
 ss Tokens (Apple\, Cloudflare) ask whether the device is genuine\, anchore
 d in hardware. Cloudflare's PACT asks whether the agent is legitimate\, ag
 ain without a hardware anchor. Meanwhile large language models are drainin
 g the first moat: the once-esoteric TLS knowledge that made bot-detection 
 bypasses an expert's game - cipher ordering\, JA3/JA4 fingerprinting\, aut
 omation signals - is now a couple of prompts away. The fourth rung asks th
 e question that remains once agents act on their own: what did it do\, und
 er whose authority\, and was it in mandate? The thesis: the attack surface
  is migrating from presence to authority.\n\nThe demo is live\, on a publi
 c MIT-licensed sandbox (github.com/tyche-institute/aep-sandbox). Layer 1 i
 s an unsigned hash chain\, and I forge it on stage: a full re-chain passes
 . That is the deliberate lesson: hashing without anchoring is un-anchored 
 legitimacy in miniature. Layer 2 adds Ed25519-signed Action Evidence Packa
 ges (AEPs) bound to a scoped\, signed mandate and closes the easy breaks (
 tamper\, key forgery\, mandate swap\, replay\, signature strip)\, each wit
 h its own DENY verdict. Then the headline: an action where every cryptogra
 phic check passes and the verifier still returns DENY:scope_violation. Cor
 rectly signed\, out of mandate\, rejected. The agent cannot self-grant aut
 hority.\n\nBring a laptop - or just a browser. The same verifier now runs 
 client-side at tyche.institute/lab/aep-ctf/\, parity-tested against the Py
 thon original on every shipped case\, so you can attack it from your seat 
 with nothing installed. For the full kit: Python 3.8+ and pip install cryp
 tography. Seven attack scripts and a CTF judge ship with the repo\, plus o
 ne standing challenge: craft an evidence package that makes verify.py say 
 ALLOW for an action the mandate does not authorize. My own four-lens pre-p
 ublication bypass hunt found no key-free bypass. Prove me wrong\, during t
 he talk.\n\n---\n\n## What actually happens on stage\n\nA walk up the four
  rungs of machine-checkable legitimacy\, from "is there a human?" to "was 
 this action in mandate?"\, ending on a live break where every signature ve
 rifies and the verifier still refuses.\n\n### The shift\nPresence checks a
 re a moat\, and AI is draining it. Bot detection asks whether a human is a
 t the browser\; hardware attestation raises that to whether the device is 
 genuine\; agent-legitimacy schemes ask whether the agent is legitimate. No
 ne of them answer what the agent actually did. If presence checks are dyin
 g\, the question moves up: not who is at the keyboard but what was done\, 
 under whose authority\, inside which scope. The answer demonstrated here i
 s a per-action evidence package plus a scoped\, signed mandate that an off
 line third party can adjudicate: a mandate-conformance receipt.\n\n### The
  live demo\, exactly\nPublic repo: github.com/tyche-institute/aep-sandbox 
 (MIT\, self-contained\, runs fully offline\; Python 3.8+ and the cryptogra
 phy package only). In-browser version: tyche.institute/lab/aep-ctf/\n\n- L
 ayer 1 - unsigned SHA-256 hash chain. Catches single-field edits and reord
 ers. A full re-chain forge passes. Deliberate: hashing alone is insufficie
 nt\, the un-anchored-legitimacy rung in miniature.\n- Layer 2 - Ed25519-si
 gned Action Evidence Package + scoped signed mandate. Trust anchored in li
 sted issuer and agent keys. One appraiser\, verify.py\, answers ALLOW or D
 ENY:<reason>.\n- Layer 3 - outcome digest folded into a Trusted Platform M
 odule (TPM) quote. Forged outcomes and replays die at tpm2_checkquote. (Em
 ulated swtpm\, not a hardware root\; I say so on stage.)\n\nThe attack mat
 rix\, each with its exact verdict: tamper_field -> DENY:content_mutated ·
  forge_rechain -> ledger passes\, signed layer DENY:aep_sig_invalid · for
 ge_full (attacker keys) -> DENY:issuer_not_listed · swap_mandate / strip_
 sig -> DENY:aep_sig_invalid · replay -> first ALLOW\, second DENY:replaye
 d · and the headline\, exceed_scope -> DENY:scope_violation.\n\nThe first
  six are the easy breaks cryptography already closes. The seventh is the p
 oint. "Faking a mandate" is really two attacks: forging or escalating the 
 mandate token (crypto catches that) versus acting outside the intent of a 
 genuine mandate (only mandate-conformance checking catches that). Design p
 rinciple\, not magic: the agent must never be the sole and final judge of 
 its own mandate.\n\n### What I got wrong - on purpose\, and by accident\nL
 ayer 1 is my own anti-pattern: I shipped an unsigned hash chain precisely 
 so the room can watch a full re-chain forge sail straight through it. The 
 accident is the better story - my own pre-publication bypass hunt caught m
 y verifier throwing a traceback on a non-numeric amount instead of returni
 ng a clean DENY: a fail-open shape hiding inside a design I had already ca
 lled fail-closed. And while building the attestation layer I hit a freshne
 ss bug in an open-source RATS verification service\; the upstream maintain
 er acknowledged it and invited the fix. You will see all three.\n\n### Pla
 y along (the CTF)\nOpen tyche.institute/lab/aep-ctf/ and attack the verifi
 er in your browser\, or clone the repo: python3 verify.py samples/good.aep
 .json (ALLOW) -> python3 verify.py samples/exceed-scope.aep.json (DENY:sco
 pe_violation). Run all seven attacks with make attacks\, or go for the win
 : craft an AEP that makes verify.py return ALLOW for an action the referen
 ce mandate does not authorize (a refund over the cap\, an issuer outside t
 he trust anchor)\, drop it at attacks/out/CHALLENGE.aep.json\, and let did
 _you_break_it.py judge you.\n\n### What I am honest about\n- The package p
 roves integrity\, authority\, and scope offline. Whether a mandate still s
 tands needs a freshness mechanism (short-lived mandates or signed status l
 ists)\, and I show exactly where that seam sits rather than hand-waving it
 .\n- If you know IETF RATS (Remote ATtestation procedureS): that attests t
 he platform\, not the act-under-mandate. Capability tokens (macaroons\, bi
 scuits\, UCAN) authorize actions but leave no offline per-action evidence.
  The piece shown here is the mandate-enforcement layer on a working verifi
 er\, evaluated by adversarial breaks.\n- No product\, no vendor: everythin
 g demonstrated is MIT-licensed and public before the talk.\n\nAudience tak
 eaway: a working mental model for where bot-detection is going and one ope
 n-source verifier to break on your own laptop. The sentence to bring home:
  a correctly-signed action can still be an unauthorized action\, and you c
 an catch it.
LOCATION:Stage A
URL:https://pretalx.com/bsides-tallinn-2026/talk/3G7EGU/
END:VEVENT
END:VCALENDAR