Rapid Threat-to-Test for Agents
summary
Maps agent risks to a concrete Maestro seven-layer breakdown (foundation models, data ops, frameworks, deployment, observability, compliance, ecosystem plus cross‑layer behaviors) and turns OASPs ASI items into hands‑on tests. Uses an itinerary example with flight/weather/lodging agents to show specific failures: prompt injection for upgrades, cross‑agent poisoned messages, injected tool params and storage bias. Builds simple attack trees to derive tests (poisoned Bali guide, soft preference injection, session‑scoping checks), recommends scoping memory, removing shared state and automating tests at the right layer.
AI-written summary · about
chapters (16)
- 0:00Introduction
- 2:50AI agents and security
- 9:52Threat modeling for QA
- 14:00Agents need unique security
- 17:53MASTRO framework
- 25:17Threat modeling sample architecture
- 27:45Intent-breaking threats
- 33:25Threats to testable scenarios
- 38:45Prioritizing threats and mitigations
- 41:59Threat modeling in development
- 42:44Resources and next steps
- 43:05Q&A
- 44:51Measuring threat coverage
- 46:35Securing AI agents in pipelines
- 49:07Skills for security testing
- 51:37Closing remarks
related talks
30mNavigating the New AI Security Landscape
42mSecuring AI Agents...
48mSecuring Agentic AI
33mSecuring Agentic AI With PyTorch: Threat Modeling & LLM Red Teaming in Practice
37mAI agents testing How to evaluate the unpredictable
56mAttacking AI
27mKeynote: Towards Building Safe and Secure Agentic AI
19mKeynote: Towards Building Safe and Secure Agentic AI