Breaking Agentic Workflows

The talk follows a single untrusted PDF as it becomes model input in a fictional HR hiring pipeline. The speakers frame the problem around agents connected to tools and MCP servers, recent reports of agents escaping sandboxes, and the difference between locally controlled models and cloud models the operator cannot tune. They also set out a shared vocabulary of vulnerabilities, attacks, risks, policies and controls.

The middle section covers demos. An open-source OWASP scanner, ZeroJail, sends a few hundred prebaked challenges at a model endpoint and reports where it complied, including encoded and layered payloads that some models decode without context. A resume PDF carrying a hidden instruction was then passed to a hiring agent, which recommended hiring the candidate. The walkthrough traces the attack through ingestion, the step where content becomes agent context, and a privileged admin agent whose web background checks can pull in poisoned pages. From there, the next payload could ask the agent to gather data on other candidates and send it out. The talk also covers ablation, which removes guardrails from open models.

The closing section lays out layered defenses: deterministic checks on size, type and schema, analytical checks for invisible characters and encoded content, OWASP Core Rule Set rules, and guard models placed before and after the model. The speakers suggest scanning model files for poisoned pickles and running a home lab with client-side chat so no central server holds every conversation. Their takeaway is that agent security is still ordinary software security applied at every boundary.