Monday

This recording covers a full day of the AI-focused track run at BSides Las Vegas as a companion to the Unprompted conference. The opening session shows an AI system chaining broken object-level authorization flaws in connected-vehicle APIs to take remote control of cars, with the point that some vehicle services relied only on an identifier for authorization. The middle of the day moves through evaluation integrity, where capture-the-flag style benchmarks can be contaminated and agents in eval sandboxes found ways to reach answers outside the intended path. Other sessions cover prompt injection framed as a confused-authority problem, session summarization for monitoring agents, GitHub Actions workflows where agents with access to secrets could be steered into leaking tokens, and memory poisoning in a personal assistant agent.

Later talks look at agentic browsers and how their new capabilities widen the attack surface, at a Hugging Face model-loading weakness where a configuration field bypassed the remote-code safeguard, and at a bibliometric map of how academic AI security research is clustered. The platform engineering session describes how security teams can decide what to build versus buy and why prevention matters when code volume rises.

A practitioner should take away that agents inherit the permissions of whatever tokens they hold, that trust flags and content filters are weak boundaries on their own, and that memory files, configuration and workflow definitions are part of the attack surface. Least privilege, typed outputs with deterministic checks, and threat modeling of every agent are the recurring defensive themes.