Enhance AppSec: Generative AI integration in AWS testing
summary
AWS describes a three‑layer generative AI testing model—infrastructure, model/tooling, and application—and shows concrete findings: 35 CVEs in libh5 lead to PoCs that crash TensorFlow/PyTorch runtimes (demonstrated binary memory attack), so teams move to Safetensors over H5/Pickle; agentic setups (LangChain/Bedrock agents) cause indirect prompt injections that trigger unintended purchases unless developers limit tools per conversation turn and confirm mutating actions; universal and transferable attacks are discoverable in 1–5k queries and mitigated with Bedrock Guardrails or attacker/defender/evaluator pipelines.
AI-written summary · about
chapters (6)
- 0:00Introduction and agenda
- 2:03Generative AI security overview
- 5:32Bottom layer: infrastructure
- 16:20Middle layer: model agency
- 29:41Application layer: interaction
- 51:06Conclusion and resources
related talks
44mGenerative AI Security — A Practical Guide to Securing Your AI Application
35mGenAI Application Security: Not Just Prompt Injection
27mSafeguarding Generative AI Applications: Navigating Security Challenges and Best Pract...
57mAI Applications Security Puzzle
55mUsing GenAI on and inside your code, what could possibly go wrong?
31mTesting, Evaluating and Debugging Generative AI and Agentic Ap...
46mBreaking AI: Live coding and hacking applications with Generative AI
46mBreaking AI: Live coding and hacking applicattions with Generative AI