Agent2Shell is a family of zero-day RCE chains against the three flagship AI coding agents (Anthropic Claude Code, Cursor, and Google Gemini), all reproducible on the latest stable builds with default settings on Windows. The chains have been responsibly disclosed to the affected vendors and are under coordinated embargo. HITCON 2026 will be the first comprehensive technical deep-dive on the full research set.

What separates this work from the LLM-security research dominating the field today: the LLM is never invoked. Every chain triggers before any prompt reaches the model. Prompt Injection defenses, Guardrails, Output Filtering, and Agent Alignment all sit on the wrong side of the boundary and never observe the payload. We name this attack class Pre-Prompt RCE.

Several chains are 0-click: open a folder, double-click a small file, or run a routine command, and arbitrary code executes on a fully patched Windows machine. The remainder require at most one user action. Several are bypasses of recently patched CVEs in the same products, evidence the patches addressed instances rather than the underlying class.

The talk reconstructs the trust-boundary, auto-approval, and config-pollution failure classes shared across all three vendors, and shows why the bug class will keep producing instances until vendors redesign rather than patch. Live demos reproduce the most striking 0-click and 1-click chains end-to-end on stage.