AI agents are hitting production faster than security teams can keep up. They have tool access, persistent memory, API keys, and broad permissions, and most teams building them are focused on capability, not attack surface.

This session is a live teardown. We’ll stand up a deliberately vulnerable AI agent wired into GitHub, Slack, and document retrieval, and systematically exploit it. Not with jailbreaks or exotic prompt tricks, but with the kinds of architectural mistakes that show up in real systems: over-permissioned tools, unvetted retrieval sources, and implicit trust in model outputs.

You’ll watch credentials leak, unintended actions execute, and data flow where it shouldn’t all from decisions that looked reasonable at design time.

Then we fix it. Same app, different architecture. We’ll walk through what least privilege actually means for tool-calling agents, how to enforce policy controls on sensitive actions, where retrieval trust boundaries must exist, and when human-in-the-loop safeguards are required.

If you’re building or reviewing AI-powered systems, this is the threat model your design review is probably missing.