Your AI Agent, Through the Eyes of an Attacker

You’ve spent the last two days learning how to build better AI systems. Give me 45 minutes to show you how attackers break them.
This is not another talk about how to build a secure AI agent. Instead, we’ll look at AI applications through the eyes of an attacker: what we look for, how we turn seemingly harmless behavior into attack primitives, and how we chain them into real impact.
We’ll go beyond the familiar “ignore previous instructions” examples and explore how modern AI applications can be attacked without direct user input, how agents can be socially engineered into performing legitimate actions for malicious purposes, and why agent guardrails should never be treated as security boundaries.
Through practical demonstrations and real-world offensive security research, including CVE-2026-25724, we’ll see what happens when AI-native attacks meet traditional application vulnerabilities, permissions, tools, and trust boundaries.
The goal is not to give you another security checklist. It is to give you the attacker’s mindset, so the next time you design an AI system, you can look at it not only as its builder, but also as the person trying to break it.