In 2026, a developer asked a burrito chain's chatbot to reverse a linked list before ordering their meal. The bot delivered a solution, then asked what they wanted.

A user does not need to be malicious to embarrass an enterprise, just a little bit weird. The model will help, enthusiastically. But that burrito bot sits in a production cluster that someone (probably you) is responsible for, wired into real tools and data. More than reputation is at stake.

In this session we build a chatbot for a fictional burrito chain connected to an under-protected MCP server and deploy on a full IDP (internal developer platform). It starts wide open, and we let the audience hack it live.

We show you the relevant Kubernetes security layers you should already have. Then we turn on LLM-specific guardrails, like pre- and mid-inference prompt analysis. Finally we show good GenAI observability practices. By the end the chatbot is selling burritos. Nothing more.

Bring your weirdest off-topic question.