A Practical Guide to AI Threats & Mitigation Strategies
summary
Walks through OWASP LLM top risks and shows live prompt injection via Gandalf.ai plus a Chevrolet chatbot exploit example, compares GPT, Claude, Gemini, Mistral and Copilot producing the same cross-site scripting flaw from a simple Express prompt, and demonstrates an agentic note app that containers itself but ships CSRF mitigation while still exposing XSS, info leaks and missing rate limiting. Recommends input/output filtering, sandboxing, ESBOM inventory, dependency vetting with Snyk Advisor and human review plus red teaming.
AI-written summary · about
chapters (19)
- 0:00Introduction to AI threats
- 2:33Challenges with large language models
- 11:18Prompt injection explained
- 12:00Excessive agentic AI risks
- 13:44Data and model poisoning
- 16:11AI supply chain vulnerabilities
- 19:41LLM misinformation risks
- 22:53Sensitive information disclosure
- 24:18AI in software development
- 27:33Trusting AI generated code
- 30:03Cross-site scripting in AI code
- 35:14Evaluating AI suggested packages
- 38:23GitHub Copilot vulnerabilities
- 40:07Prompt engineering limitations
- 42:10AI coding editors risks
- 42:51Understanding vibe coding
- 44:59Live demo of AI code generation
- 48:51Key takeaways and best practices
- 50:57Learning resources and next steps
related talks
18mDefending the unknown using AI and cybersecurity
25mPreventing an OWASP Top 10 in the world of AI
01h 14mBreaking the Bot: GenAI Web App Attack Surface & Exploitation
57mAI Applications Security Puzzle
30mWhat Are the Security Risks Associated with AI-Generated Code? 🤔
30mNavigating the New AI Security Landscape
36mAgentic AI Under Attack: Live Demos of Exploits Through Autonomy and Trust
24mHow to Build Trustworthy AI