Rita Sabri
Cybersecurity educator and researcher
Washington, District of Columbia, United States
Actions
Rita Sabri is a cybersecurity educator and researcher working at the intersection of AI security and applied threat modeling. She holds an M.S. in Computer Science from the University of Pennsylvania and teaches Cybersecurity. She is committed to expanding access, awareness, and curriculum development in cybersecurity education across underserved communities, with a long-term interest in supporting the growth of AppSec practice and framework adoption across North Africa, particularly Morocco, and the broader MENA region.
Area of Expertise
Topics
Threat-Modeling Vision-and-Action AI Through the OWASP Agentic Top 10
A new class of AI agent has entered production, and these agents do not interact with the world through the structured tool calls and function calls that most threat models assume. They are called vision-and-action agents, for example, Anthropic's computer-use capability, OpenAI's Operator, and several open-source browser-driving projects. They operate the rendered interface directly and interact through the screen, the DOM, clicks, and keystrokes inside the user's own authenticated session.
This places a new actor inside the trust boundary and creates a direct collision with classical web security. Indeed, a clickjacking overlay fools a vision-driven agent the same way it fools a human user. The perception layer of these agents (pixels for some systems, the DOM for others) introduces an attack surface that most security teams have not yet modeled.
In this talk, I will apply the OWASP Agentic Security Initiative (ASI) Top 10 as a threat map for this agent subclass. Some ASI categories apply without modification, whereas others change character entirely. For instance, ASI01 Goal Hijacking expands from poisoned documents to any content the agent renders on screen; ASI02 Tool Misuse manifests as unintended clicks and form submissions in an authenticated session where no tool-permission layer exists to constrain them, and ASI03 Identity and Privilege Abuse changes character when the agent holds the human's live session and every downstream system treats the agent's actions as indistinguishable from the human's.
I will map each relevant ASI category to its vision-and-action equivalent and draw on concrete failure modes from publicly documented systems and published research on indirect prompt injection against agentic browsers. Attendees will leave with a design-time threat-modeling worksheet applicable to any browser-driving agent, whether they are building one, buying one, or defending the environment one is about to enter.
The Agent That Drives Your Browser: Adapting the OWASP Agentic Top 10 for Vision-and-Action Agents
The OWASP Top 10 for Agentic Applications (2026), published in December 2025, is the field's first shared map of the agentic threat surface. Almost every attack scenario it describes assumes the agent interacts with the world through structured calls to APIs, function calls, MCP servers, RAG retrievers, and code interpreters. Indeed, the agent reasons, calls a tool, and receives a structured response.
A different class of agent is now in production. Vision-and-action agents (also called Computer-Using Agents) reach the world by looking at a rendered screen and operating the same interface a human would. Anthropic shipped Claude for Chrome and Claude Cowork to consumers between 2025 and early 2026. OpenAI's Atlas browser with Agent Mode shipped in late 2025, built on its Computer-Using Agent technology. The open-source browser-use project surpassed 50,000 GitHub stars in roughly a year. Those systems work through pixels, clicks, and keystrokes inside the user's authenticated browser session. They operate in the rendered browser and do not use any API. They intersect directly with classical web security concerns: Same-origin assumptions, session handling, and UI redress attacks like clickjacking, but with a new actor inside the trust boundary
The ten ASI categories remain valid descriptions of the agentic threat surface. The assumptions underlying their attack scenarios, however, do not extend cleanly to vision-and-action systems. Agent Goal Hijack (ASI01) extends beyond poisoned documents to any content rendered on the pages the agent visits, including elements not visible to the human user.
Tool Misuse and Exploitation (ASI02) shifts from unintended API calls to unintended clicks and form submissions inside the user's authenticated session, where no tool-permission layer exists to constrain them.
Identity and Privilege Abuse (ASI03) changes in character when the agent holds the human's active session and acts indistinguishably from the human to every downstream system.
Human-Agent Trust Exploitation (ASI09) introduces a new failure mode in the mid-session handoff between human and agent operating inside the same browser, where attribution of individual actions becomes ambiguous.
This talk presents an adaptation of the ASI Top 10 for this subclass. Each of the ten categories is mapped to its vision-and-action equivalent, with concrete failure modes drawn from publicly documented systems and the published research on indirect prompt injection against agentic browsers.
This talk introduces a threat-modeling worksheet that practitioners can apply at design time to any product team shipping or evaluating a browser-driving agent. The presentation will give the AppSec community a way to threat-model the subclass of agent that is now reaching the buyer, the user, and the support queue inside the products our organizations are already shipping.
Stop Pressing 1: Matching Oversight to Autonomy in AI-Assisted DevSecOps
AI-assisted development tools are entering government and defense DevSecOps pipelines at an accelerating pace. Coding agents, automated testing systems, and AI-powered workflow tools promise increased velocity and faster time to deployment. But the oversight model has not kept up. Human review remains the primary security control, and it is based on the assumption that the person approving an AI-generated action has actually read and understood what it does.
AI has accelerated the amount of code that is being shipped, and speed without comprehension is a security failure. An operator who approves an agent's action without understanding it has not performed oversight, and it can cascade onto the QA engineer and the entire team.
I call this the reading problem. I encounter it both as a security practitioner working with AI agents and as an educator who has spent years designing systems around the fact that people do not read before they act. This design has direct implications for any DevSecOps pipeline that relies on human review as a security gate.
This talk proposes a two-part solution. First, a three-level framework of agent autonomy: suggest-and-approve, act-and-monitor, and independent operation--that identifies how the reading problem undermines the security model at every level. Each level demands different controls. Misclassifying the autonomy level means deploying the wrong ones: approval prompts where rate limits were needed, monitoring dashboards where containment boundaries were needed, policies where permission isolation was needed.
Second, a comprehension gate: an oversight mechanism adapted from formative-assessment techniques I have refined with over 100 students. Before a high-risk AI-generated action can be approved, the system analyzes the proposed change and generates targeted questions about what is changing and what the risk is. I will demo a working prototype and walk through where comprehension gates catch genuine oversight gaps versus where they introduce friction without commensurate security benefit. The goal is a practical framework: classify the autonomy level of each AI tool in your pipeline, match it to the right oversight mechanism, and stop relying on human review at stages where nobody is actually reading.
Stop Pressing 1: Comprehension Gates for AI Agent Oversight
Human oversight is the default safety model for AI coding agents. But it depends on an assumption that almost no workflow actually verifies: that the person approving an action has read and understood it. In practice, approval often happens without comprehension: the engineer glances at the output, hits approve, and moves on. This creates the appearance of control while leaving the action itself unexamined.
I call this the reading problem. I encounter it while being a cybersecurity practitioner working with AI tools and as an educator who has spent years designing systems around the fact that people skip the reading step. It is a design failure. The approval interface asks for a decision without confirming the understanding that the decision requires.
This talk presents a three-level framework for AI agent autonomy: suggest-and-approve, act-and-monitor, and independent operation. It shows how the reading problem undermines the security model at every level. For each level, I identify the specific failure mode and the corresponding controls: comprehension gates for approval workflows, rate limits and action logs for monitoring workflows, and hard containment boundaries for autonomous operation. Misclassifying the autonomy level means deploying the wrong controls, which is how teams end up with approval UX when they need rate limits or monitoring dashboards when they need sandboxing.
I will demo a working prototype of the comprehension gate, which is an intervention adapted from formative assessment in education, based on 100 students.
Before a high-risk AI-generated action can be approved, the system analyzes the proposed change and generates targeted questions about what is actually changing and what the risk is. I will walk through where this catches genuine gaps in comprehension versus where it introduces friction without meaningful benefit.
The goal is to show a decision framework: classify the autonomy level, match it to the right oversight mechanism, and stop relying on human review at levels where no one is actually reading.
Did You Actually Read That? Comprehension Gates for Agent Oversight
Human oversight remains the primary trust mechanism between operators and agents as agentic AI systems move into production. This trust rests on an unverified assumption: the approving operator/engineer actually reads and understands the action. Approval often collapses into a single click within MCP clients and agent frameworks alike.
This talk proposes two complementary controls to answer the question: Did your engineer read and understand the agent suggestions?
The first control introduces a three-level model of agent autonomy: suggest-and-approve, act-and-monitor, and independent operation. This model highlights the reading problem, breaking trust differently at each operational level.
The second control implements a comprehension gate. The system asks targeted questions about the agent's actions and potential risks before an operator approves a tool call or system change.
I will demonstrate a working prototype of agent approval flows featuring MCP tool-call dialogs and show the system's question-generation process.
Please note that Sessionize is not responsible for the accuracy or validity of the data provided by speakers. If you suspect this profile to be fake or spam, please let us know.
Jump to top