Securing Agentic AI
summary
Agents pass functional tests yet delete production data and leak enterprise secrets by following manipulated goals, not by breaking models. Real examples include a white-text calendar invite that turns a summary into an email-sending plan, memory poisoning that treats fake “free flights” as policy, cross-tenant RAG pulls from shared vector stores, and a legitimate refund tool pushed to pay far beyond its cap. Tests focus on planning, memory, tool boundaries, MCP connectors, identity and agent-to-agent trust.
AI-written summary · about
chapters (30)
- 0:00Why an Agent Can Pass Every Functional Test and Still Cause an Incident
- 1:04Speaker Intros - Deepshikha and Anamika Mukhopadhyay, Associate Directors at Nagarro
- 2:05From AI That Answers to AI That Acts on Your Behalf
- 4:38Real Incidents: Deleted Production Data, Leaked Enterprise Information
- 5:40The Problem Isn't the Model - It's Planning, Memory, Tools and Actions
- 6:11Traditional LLM vs AI Agent: Why the Failure Mode Changes
- 7:44Anatomy of a Single Enterprise Agent and Its Execution Loop
- 8:47The Attack Surface Map
- 9:50Five Areas to Review: Planning, Memory, Tools, Identity, Communication
- 11:22Multi-Agent Systems Multiply Identities and Trust Boundaries
- 12:23MCP as Part of Your Security Boundary
- 13:54Mapping Threats Across the Agentic Architecture
- 15:29Threat 1 - Goal Manipulation: The Hidden White-Text Calendar Invite
- 17:34One Injected Instruction Becoming a Chain of Tool Calls
- 18:06Threat 2 - Memory Poisoning: The Travel Agent and the Fake Free Flight
- 20:10RAG Risks: Cross-Tenant Retrieval, Knowledge and Embedding Poisoning
- 22:46Threat 3 - Tool Misuse: The Right Tool With the Wrong Intent
- 24:20The Refund Cap That Was Talked Past by a Support Ticket
- 25:22A Real Food-Delivery Refund the Speaker Got by Accident
- 26:23Threat 4 - The Confused Deputy and Privilege Abuse
- 27:55Why Forensics Fail: The Agent Holds the Credentials, Not the Attacker
- 28:59Threat 5 - Communication Poisoning and Infectious Backdoors
- 31:34How to Validate: Testing the Planning Surface With Prompt Injection
- 33:36Testing Memory: Poisoning, Cross-Session Isolation, RAG Evaluation
- 35:12Testing Tool Execution and Boundary Violations
- 37:14Testing Identity: Authorization Throughout the Workflow, Not Just Login
- 38:47Testing Agent-to-Agent Communication With Mocks and Replays
- 41:53Three Takeaways: New Attack Surfaces, Test the Whole Decision Loop
- 43:24Q&A: Genuinely Intelligent vs Optimised for a Benchmark
- 45:30Q&A: Prompt Injection Is Still the Number One Vector
related talks
42mSecuring AI Agents...
51mAgentic AI and Model Context Protocol's Security Vulnerabilities
36mAgentic AI Under Attack: Live Demos of Exploits Through Autonomy and Trust
48mWhen AI Goes Awry: Responding to AI Incidents
31mAgentic AI Threats: How Multi-Agent Systems Get Exploited
19mKeynote: Towards Building Safe and Secure Agentic AI
28mAll Your AI are Belong to Us
53mHow to Break AI Systems (Before Someone Else Does)