Breaking AI: Live coding and hacking applications with Generative AI

Is your organisation ready to revolutionize your coding experience with generative AI tools, like copilot, ChatGPT, or code whisperer? Do you know how to code safely with generative AI tools increasing your delivery speed without compromising security? In this session, we’ll discuss some of the dangers of generative AI, including hallucinations and security risks. We’ll live code a Spring coffee shop application using copilot, and ChatGPT, and live hack the results, showing how the generated code can be exploited in a running app. We’ll uncover generated SQL injections, Cross site scripting, directory traversal and more. Don't miss this electrifying opportunity to explore the cutting edge of coding technology. Join us and embark on a journey where velocity meets security, and innovation knows no bounds. Secure your spot now and get ready to code like never before! In this session you'll learn how you can leverage the power of AI to increase your velocity while mitigating risks and staying secure.

Capture the Flag 101

Capture the Flag events are exciting and competitive. But, they can be scary to developers and security practitioners who have never participated in them.

In this session, I introduce CTFs, discuss their benefits to developers, and examine an easy and medium-difficulty CTF challenge in depth.

Together, we walk through the wiley attacker's thought process and how to pick up clues based on the programming language and protocols involved. We google, form theories and test against what little information is provided in the challenge.

You don't need any prior knowledge of a specific programming language. Rather, we focus on developing the skills needed to participate in a Capture the Flag event.

After an introduction to Capture the Flag events, we dig into two challenges. These are real challenges from past CTF events.

For each challenge, we follow a pattern of discovery:

1. Introduce the challenge
2. Review clues from the challenge text and challenge interface
3. Give participants time to take on the challenge
4. Pause and review progress and give a hint
5. Give participants more time to solve the challenge
6. Review the solution and lessons learned

Kicking JavaScript to the Curb with Vaadin

I've been using Spring Boot for a very long time. I learned the JavaScript framework, Vue.js, in order to build a modern web app that's been in service for about 7 years.

Vaadin is an open source framework for building modern web apps in pure Java. I recently refactored the application so that it's end-to-end Java.

In this talk, I share the experience and dive into real-world challenges going from a frontend JavaScript to using Java all the way.

I cover coding, security, testing, debugging, and migrating. The pace is quick and you learn a lot in this session as we kick JavaScript to the curb!

01. Sobriety - What? Why is this here? Code & Recovery
02. TNRA - A brief history of the Taking the Next Right Action Group
03. Java + JS - You want a web app? It's gotta be JavaScript! Or, does it?
04. Java + Java - Vaadin & Spring Boot - a beautiful thing!
05. Bumbling - You made it work, now make it good.
06. Takeaways

AI Board Game Experiments: Autonomy, Reasoning, and Deception

Following in the same vein as "Claude Plays Pokemon", I did a number of experiments with popular models to play board games. My goal was to make them as autonomous as possible. In this talk, I walk through the highlights of these different experiments. In some play-throughs, I tried to be as helpful to the AI as possible. In others, I did whatever the AI said without comment. And in others, I tried to actively deceive it. Which models did well, and which flopped? What level of autonomy was achieved? What does this reveal about the reasoning models? All this is answered during this talk. At the end, we'll take a poll of the participants to pick from among a few online board games. We'll then gather prompts from the audience to get as far into the game with an AI as time permits.

Outline

0. Intro
1. overview of gaming with models: 2024-2026
2. phase 1: describe and prompt
play on behalf of the model
3. phase 2: screenshot to victory
submit screenshots to the model and let it interpret
4. phase 3: I can see with MCP
let's give the model eyes and let it take its turn autonomously
5. phase 4: audience participation
we'll pick from amongst a few online games (boardgamearena.com) and see how the model does
6. learnings, takeaways and q&a

How I became a repo man for a day

In the summer of 2024, I became a repo man for a day. I legally recovered a vehicle without any confrontation or repercussions.

In this talk, I describe the circumstances that led to this eventful day. I approached this problem like I do a capture the flag event or other ethical hacking activities: Identify the problem, gather information, analyze the clues, consult other professionals and take action.

I go into detail on the upfront planning work I did, how I was able to legally retake ownership of the vehicle and then physically take possession of the vehicle all while doing my best to avoid any confrontation. I also cover the measures I took to ensure that this process couldn’t be re-implemented as a counter attack on me.

We then work together on some real-life security challenges, CTF style. Participants will have the opportunity to solve 1 or 2 challenges. I'll review the clues and reveal the solutions along the way.

I wrap up the talk with how my adversary could have prevented me from recovering the vehicle and talk in general about good personal security behaviors.

NOTE:

This was first published in the Fall 2025 edition of 2600 magazine; a quarterly hacker magazine I've been reading since the '80s. It was a dream come true to have this story published in this magazine.

This session was given recently to a packed room at ConFoo and was very well received.

outline:

0. Intro
1. Cast of Characters
2. Act I - The Job
3. Act II - The Plans
4. Act III - Repo Man for a Day
5. Act IV - Wheaton's Law

AI Security Engineer Foundations

### 1. OWASP Top 10 for Agentic Applications

Gain a practical understanding of the key security risks introduced by agentic AI applications. This module explains how risk changes when AI systems can reason, plan, use tools, access memory, interact with other agents, and take actions across business workflows.

By the end of this module you'll be able to:

- Explain the OWASP Top 10 for Agentic Applications vs. the Web and LLM versions
- Describe how agentic AI changes security models through goals, tools, memory, identity, permissions, and orchestration
- Define ten agentic risks, including Agent Goal Hijacking, Tool Misuse, Identity and Privilege Abuse, and Agentic Supply Chain Vulnerabilities
- Map risks to controls: least privilege, scoped identities, tool allowlisting, approval gates, memory isolation, and audit logging
- Assess an agent's boundaries — its capabilities, authority, data access, callable tools, and logging/approval requirements

### 2. Addressing Shadow AI

Step into the shoes of the AI Security Engineer to navigate the unexpected things that surface when you look under the hood of your AI posture. This module operates at the intersection of platform security, ML engineering, and threat intelligence.

By the end of this module you'll be able to:

- Define Shadow AI vs. Shadow IT, and cite current prevalence and cost data
- Recognize what makes Shadow AI harder to govern than traditional shadow IT
- Identify common Shadow AI risk scenarios inside an enterprise
- Define an AI Bill of Materials (AIBOM) and its governance functions
- Compare an AIBOM against an SBOM across scope, behavior, risk classes, and update cadence
- Generate an AIBOM using the Snyk CLI and inspect it in the Evo platform

### 3. AI Governance & Policy as Code

This module tackles why most corporate AI policies exist only on paper. It opens by diagnosing the common failure patterns, unenforced wiki policies, review boards too slow to keep up with development, and outright bans that just push AI use underground, before making the case that governance only works when it's built directly into the software pipeline rather than handled through traditional vendor-style approval processes.

From there, the module walks through the practical mechanics of doing this well: identifying the four trust boundaries inside an AI system (data ingestion, external data sources, context construction, and downstream actions) that any real policy needs to address; turning plain-language governance rules into automated checks that run in continuous integration; and stress-testing those rules against ambiguous, real-world edge cases where reasonable teams disagree. It also covers designing a fast, visible exception process so legitimate exceptions don't quietly undermine the policy, and closes with what auditors and regulators actually expect to see, an inventory, a risk assessment, and an enforcement log, tying this back to frameworks like NIST's AI RMF, the EU AI Act, and Gartner's AI TRiSM.

By the end, a learner should come away understanding how to convert an AI governance intent into an enforceable, auditable control rather than a static document, and how to spot the gaps and blind spots that make most current AI policies unenforceable in practice.

### 4. Securing Agents & MCP

*How SKILL.md Introduced Malware.*

A two-part session covering "ToxicSkills" research on supply-chain threats targeting agent ecosystems, plus active exploitation techniques against Model Context Protocol (MCP) deployments — credential exfiltration via malicious tool descriptions, and arbitrary code execution via insecure servers.

By the end of this module you'll be able to:

- Explain the Model Context Protocol, why it exists, and its server security fundamentals
- Articulate why MCP security is urgent in 2026: SDK download scale, agentic IDE adoption, and MCP's placement in a developer's most privileged context
- Define tool poisoning and the impact of hidden instructions
- Distinguish malicious MCP servers from vulnerable server code
- Run MCP-Scan against a local configuration and interpret its findings
- Run Snyk Code against MCP server source and interpret command-injection and path-traversal findings

### 5. Securing Vibe Coding

In this module, we break down the security implications of vibe coding and share actionable strategies to secure AI-generated code at scale — including Snyk Studio's approach to securing the AI-powered SDLC from code to deployment.

By the end of this module you'll be able to:

- Define vibe coding and explain how it changes the development process
- Describe the "Lobster Ecosystem" — agentic AI tools, agent skill registries, and automation frameworks — and its supply-chain attack surface, including agent skill poisoning and slopsquatting
- Apply a five-layer Secure-by-Design Playbook to vibe-coded projects
- Identify common AI-generated code vulnerability patterns: disabled row-level security, hardcoded secrets, missing authentication, and client-side security logic
- Map vulnerabilities to the OWASP Top 10 for LLM Applications
- Distinguish vibe coding from vibe *hacking*

### 6. AI Pen Testing

Gain a practical understanding of how to test AI-powered and agentic applications for security weaknesses. This module explains how AI penetration testing goes beyond traditional web and API testing by examining prompts, model behavior, context handling, tool access, memory, permissions, and downstream actions.

By the end of this module you'll be able to:

- Explain how AI penetration testing differs from traditional application, API, and infrastructure testing
- Identify AI-specific attack surfaces: prompts, system instructions, RAG pipelines, embeddings, tools, agents, memory, and MCP-connected services
- Test for common weaknesses: prompt injection, sensitive information disclosure, system prompt leakage, excessive agency, and unsafe output handling
- Build safe, repeatable test cases without harmful or production-impacting techniques
- Map findings to remediation: input/output validation, tool allowlisting, scoped tokens, human approval gates, and audit logging
- Combine AI-specific testing with standard API, authentication, authorization, and dependency testing