AI Security for Developers, including 3 Workshops

What can go wrong when you use someone else's MCP server? Probably a lot. But what if you build your own? Turns out, that can be just as dangerous.

In this session, we'll explore how seemingly innocent mistakes in MCP server development and integration can open the door for attackers to hijack your application, execute unauthorized actions, or access sensitive data.

Add to Calendarcalendarcalendarcalendarcalendar

You'll examine a vulnerable MCP server, identify security flaws, and then fix them yourself. Walk away with practical techniques for securely developing, reviewing, and integrating MCP servers.

Add to Calendarcalendarcalendarcalendarcalendar

The session explores how securing AI agents requires moving beyond traditional least privilege toward least agency - controlling not only what an agent can access, but what it can autonomously decide and execute. Through a demo, I’ll show how an enterprise agent with access to GitHub, Jira, internal knowledge and deployment tools can be manipulated through indirect prompt injection, turning legitimate permissions into an attack path.

I’ll then apply practical controls such as tool-level permissions, approval gates and runtime policies to demonstrate how the same attack can be contained.

Add to Calendarcalendarcalendarcalendarcalendar

Join this hands-on workshop to learn how to secure AI agents against prompt injection, enforce least agency, and implement runtime policies that prevent unauthorized actions, including production deployments.

Add to Calendarcalendarcalendarcalendarcalendar

Skills are how AI agents learn new jobs. A skill is a small folder of instructions and scripts. The agent loads it when needed and follows it with your access: your files, your terminal, your credentials. We'll start with why skills are so useful, what they look like, and what is really inside one.

Then we'll look at what downloading a skill from the internet really means, and how much control and trust the agent hands it. Next, we'll show why static analysis of skills is not enough. So instead of reading skills, we run them in a detonation chamber and watch what the agent does. That is how we caught a real malicious campaign that ran for weeks and passed 1.7 million installs.

Then the fun part: how we could have compromised over 500K users in a single week, going from one ordinary skill download to a full reverse shell.

Add to Calendarcalendarcalendarcalendarcalendar

You'll get a set of skills and try to judge which ones are malicious. Up for the challenge? Walk away with a new way to look at skills and evaluate them before your agent trusts them.

Add to Calendarcalendarcalendarcalendarcalendar