AI and Risk Mitigation: Call for Proposals

Abstract

AI coding agents like Claude Code execute shell commands, read and write files, and make autonomous decisions, effectively acting as developers with broad access to your codebase and system. As adoption accelerates, securing these agents at runtime becomes critical. But how do you enforce least privilege on an agent that needs wide access to be useful?

This talk presents a practical, hook-based approach to securing AI coding agents. Using Claude Code’s event-driven hook system, it demonstrates how PreToolUse and PostToolUse interception points enforce security policies mapped directly to the OWASP Top 10 for LLM Applications. Six of the ten risks have a clean, hook-shaped answer: blocking dangerous commands before execution (LLM06 Excessive Agency), detecting secret exfiltration (LLM02), scanning generated code for vulnerabilities (LLM05), guarding system prompt leakage (LLM07), and capping runaway consumption (LLM10). The session is honest about the other four risks, which are training-time or hallucination problems hooks cannot touch.

The talk includes a walkthrough of open-source hook scripts (block-dangerous-commands, protect-secrets, and an audit logger), plus performance benchmarks comparing Node.js and Python implementations. Hooks run synchronously, so every millisecond counts. The session shares real data on keeping security controls under 100ms per invocation.

Attendees leave with a ready-to-use, open-source toolkit (439 stars, MIT, 262 tests), a framework for applying defense-in-depth to any agent that executes code, and concrete patterns for building custom hooks without degrading agent performance. Everything demonstrated runs in production and is on GitHub.

Session outline

1. Threat model: what autonomous coding agents can actually do, at machine speed
2. Why sandboxes fail in practice, and where hooks fit (defense in depth)
3. Hook architecture: the 6 security-relevant events, the JSON in / JSON out contract, sync vs async
4. OWASP LLM Top 10 mapping: the 6 that fit, the 4 that do not, and why
5. Live demo: block-dangerous-commands, protect-secrets, audit logger
6. Performance engineering: bash vs Node vs Python vs HTTP hooks, the sub-100ms budget
7. Beyond Claude Code: the pattern across Codex, Copilot, Cursor. Three universal principles.

Format

Talk, 30-40 minutes (adaptable to a 20-minute cut).

Notes for reviewers

• Prior delivery: an earlier version of this talk was delivered at the OWASP GenAI Security Virtual Summit in May 2026. Write-up and slides: https://karanbansal.in/blog
• Non-vendor, open source: everything shown is the MIT-licensed claude-code-hooks toolkit (https://github.com/karanb192/claude-code-hooks, 439 stars, 262 tests). No product pitch, no vendor content. The three closing principles transfer to Codex, Copilot, and Cursor.
• Live demo runs fully offline. No network dependency, no cloud calls. Dangerous commands are blocked live on stage with the rule ID shown for each block.
• Location: I am based in Bengaluru, so in-person or online both work.
• Reference material: blog post https://karanbansal.in/blog/claude-code-hooks/ | talks page https://karanbansal.in/talks/

Speaker bio

Karan Bansal is Global Head of AI and Security Innovation at ArmorCode, with over 10 years in security. He previously led security and privacy at Urban Company (a $2.8B unicorn) and was a founding engineer at AvidSecure, acquired by Sophos in 2019. He authored “Claude Code’s Most Underrated Feature: Hooks” and maintains the open-source claude-code-hooks toolkit, a collection of security hooks for AI coding agents mapped to the OWASP LLM Top 10. He also built reddit-mcp-buddy (748 stars) and curates awesome-claude-skills (420 stars). He contributes to SGLang and vLLM, and speaks at DEFCON and OWASP.