Dub|Sec

The next Dub|Sec meetup will take place in the Abbey Room of the Camden Court Hotel on Tuesday 28 October, 2026.

We'll be there from 6.30pm. Our first speaker will start at around 7pm.

19:00 - Talk 1: THEORY: An Open-Source Approach to Aggregating Public Threat Intelligence by Isabella Sparks
THEORY is an open-source tool Isabella developed to address a gap in publicly available threat intelligence information. It compiles information
from public sources into a single, readable dossier on a threat actor, highlighting their identity, methods, indicators, and
recommended actions. This presentation will cover the project's concept, the importance of correlating sources, key development lessons, and
future directions, including starting analysis from a vulnerability.

19:40 - Talk 2: When "safer" is the exploit: reproducing an Auto Mode RCE in Claude Code by Aaron Ott
Coding agents are good at refusing the obvious bad thing now. This talk is about an attack, building on Johann Rehberger's research, where saying no is the point.
You ask Claude Code to summarize a website. The website steers it toward a ZIP archive with a decoder in it. The agent reads the decoder and refuses to run it. So it writes its own Python decoder instead and runs it from inside the directory it just unzipped. There is a struct[.]py in there. base64 imports struct. Python searches the current directory first. That's the whole exploit.
Aaron will show how module shadowing works, walk the chain from injected prompt to execution, and share what he saw across runs. Sometimes it fired five times in a row, sometimes three out of five. A defense that only works when the agent happens to notice the trap is not a control.